The CARES Act revises 42 CFR Part 2 (confidentiality of substance use disorder patient records) eliminating consent, except for the first time, after which they can revoke it at any time. After almost 10 years, it looks as if confidentiality has finally met its match, in a killer pandemic. What the insurance industry, the American Society of Addiction Medicine, and the electronic health record industry couldn’t do, COVID-19 did overnight in the time-honored secret legislative method of inserting a pet project into a giant piece of emergency lawmaking.
The changes were made as part of the $2 trillion stimulus package, added as an amendment in the COVID-19 legislation, in which many regulations were loosened and money was given to businesses and health care.
The PDMP and Methadone Patient Data
There is already a pending rulemaking on 42 CFR Part 2 from the Substance Abuse and Mental Health Services Administration (SAMHSA), which would allow opioid treatment programs (OTPs) to input patient information to the prescription drug monitoring program (PDMP). The CARES Act says that it is the “sense of Congress” that OTPs should not disclose patient information to the PDMP, but rather access the PDMP for their own patients—as is currently done. However, “sense of Congress” is one thing—it doesn’t necessarily mean that HHS couldn’t go its own way. SAMHSA has already made it clear that it wants methadone patient data in the PDMPs.
H. Westley Clark, MD, JD, Dean’s Executive Professor of Public Health at Santa Clara University, and former director of the Center for Substance Abuse Treatment at SAMHSA, thinks that the pending notice of proposed rulemaking (NPRM) on 42 CFR Part 2 from SAMHSA should be suspended. He also believes that 42 CFR Part 2 should be formally moved from SAMHSA to the Office of Civil Rights (OCR) of the Department of Health and Human Services, since OCR has the function to collect data, monitor breaches, and impose penalties.
We asked SAMHSA whether they would drop their pending rulemaking based on this law. Christopher Garrett, SAMHSA press spokesman, told AT Forum March 31 that there was no information on that question.
There will need to be changes in 42 CFR Part 2 regulations, because the CARES Act states that SAMHSA or the federal agency in charge needs to promulgate rules in order to implement the provisions. This will take 12 months, based on the legislation.
So there is time, during which advocates like Zachary Talbott, chief clinical officer with ReVIDA Recovery Centers, and president of the National Alliance for Medication Assisted Recovery, will be working tirelessly on patient rights. “We need to drive home professional ethical obligations,” he told AT Forum. “Many licensing boards and medical boards will care. I can say for certain the ethics committee of the Georgia A&D Counseling Board will care!” Mr. Talbott is president of the Alcoholism and Drug Abuse Certification Board of Georgia.
OASAS and Consent Documents
In New York State, the Office of Addiction Services and Supports (OASAS) develops its own consent documents, posting them on the website. Licensed providers use that consent form, and it “could be written to put walls around what information could be released,” said Robert A. Kent, general counsel for OASAS (he is leaving in the middle of the month, but will stay involved in this field, and his staff knows 42 CFR Part 2 well).
SAMHSA and DEA Allow More Take-Home Days
Connected to confidentiality, if not explicit in the CARES Act, are telemedicine and take-homes. SAMHSA and the DEA relaxed guidelines, and now allow patients to have 14 or 28 days of take-homes. This makes it less likely that patients will have to come to the clinic daily, or almost daily, and risk exposure to COVID-19, or risk infecting someone else (see https://atforum.com/2020/03/otp-regulations-loosened-due-to-pandemic/). This raises the question of counseling, however, and what kind of confidentiality online platforms for counseling, or even for basic communication, could give.
“You can use FaceTime, you can use Zoom,” said Mr. Kent.
But these are not even HIPAA-compliant (Zoom has one platform that is, but it costs $200 a month). Doxy.me is what many programs use.
Virginia had originally required that SUD treatment programs use Bluestream for a telemedicine platform, but last week they removed that requirement, said Carol McDaid, principal with Capitol Decisions, a lobbying firm.
HIPAA-complaint or not, there is just not going to be much enforcement of patient confidentiality, said Danielle Tarino, who is with Young People In Recovery (and used to be at SAMHSA). “The new lightened regulatory situation implies that there will be low prosecution and acceptances made amidst the COVID-19 crisis and provisioning of telehealth services,” she told AT Forum. “That said, there still exists an ethical issue, and obligation of providers to ensure the protection of confidentiality and privacy via cyber services, to the best of their ability. In my opinion, that includes informed patient consent, or, at a minimum, conversation that is open and honest, when utilizing non-HIPAA compliant technologies.”
What would informed consent look like? Here’s what Megan Marx-Varela, MPA, director of integrated care at Oregon Recovery and Treatment Centers (and formerly in charge of SUD treatment accreditation at the Joint Commission) is using:
When meeting with patients for the first time via telehealth or telephonic connection please read the following statement to each patient:
“At this time, in accordance with federal guidelines on “social distancing”, as well as state and/or local government bans or guidelines on gatherings of multiple people, your treatment program has elected to offer most treatment services via telehealth or via telephone. This is not how services are usually provided. The federal government recognizes that we are currently experiencing a public health emergency and it is in the best interests of our patients and our staff to observe federal, state and local guidelines to prevent the spread of disease. During this time your treatment program may not be able to obtain your written consent for disclosure of your substance use disorder treatment records. As a result, it is possible that patient identifying information held by your treatment program may be disclosed to medical personnel, without your consent, to the extent necessary to meet a bona fide medical emergency. It is important for you to know that your treatment program is responsible for determining whether a bona fide medical emergency exists for the purpose of providing needed treatment, and they are required to document certain information in their records after a such a disclosure is made.”
WHAT DOES THIS MEAN
Essentially this means that patient identifying information about them may be released to medical personnel by the treatment program, without their permission, if the patient is experiencing a medical emergency. Typically, we would be required to obtain written consent from patients before we would provide patient identifying information, however, we may be unable to collect written consent while we are providing services via telehealth or telephone.
DOCUMENTATION (very important)
Please document that you have reviewed this information with the patient in the patients chart stating:
“Reviewed COVID-19 Public Health Emergency Response and 42 CFR Part 2, disclosure of patient identifying information without consent for medical emergencies.”
She is also adding that the policy is time-limited.
NYC: COVID-19 Epicenter, Many Methadone Patients
New York City is the epicenter of the COVID-19 pandemic right now, and also has most of the state’s methadone patients. “We’ve been talking to OTPs—people should not be coming to get counseling, you need to be pushing extended take-homes as much as you clinically can,” Mr. Kent said. Times need to be staggered, so patients aren’t all coming in on the same day.
“And to be honest with you–and I’ve said this to the OTPs–they’re responsible for social distancing outside the clinic as well as inside, for everybody waiting to get in. If you have people waiting in line, that’s your responsibility. If you don’t have full staff, get them, get some more security people, and don’t let it happen the next day.”
We talked with Mr. Kent a few days after headline after headline reported lines of patients waiting outside methadone clinics in New York City, prompting calls for a more liberal take–home policy. It took COVID-19 to get the public to recognize that is a problem.
“We’re balancing a bunch of bad alternatives,” said Mr. Kent.
The state has more than 40,000 methadone patients, 32,000 of whom are in the New York City area, said Mr. Kent.
For the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) as signed by President Trump March 27, go to https://www.congress.gov/116/bills/hr748/BILLS-116hr748enr.pdf
Also see https://atforum.com/2019/06/42-cfr-part-2-still-under-threat/