By REESA N. BENKOFF, ESQ
Benkoff Health Law, PLLC
On August 22, 2019, the Department of Health and Human Services (HHS) and the Substance Abuse and Mental Health Services Administration (SAMHSA) announced proposed changes to the Confidentiality of Substance Abuse Disorder Patient Records regulations, set forth in 42 CFR Part 2 (Part 2). Part 2 protects and prevents access to patient records created by federally assisted substance abuse disorder (SUD) treatment programs. SUD is a defined term, and includes cognitive, behavioral, and physiological symptoms indicating that an individual continues using a substance despite significant substance-related problems such as impaired control, social impairment, risky use, and pharmacological tolerance and withdrawal, but does not include tobacco or caffeine use.(1)
Part 2 was initially designed to protect SUD patient records so that patients seeking SUD treatment would not be deterred from doing so. For that reason, Part 2 contains more restrictions on the disclosure of patient records than HIPAA. However, the outdated regulations have created clinical and safety barriers for providers seeking to treat such patients amid the opioid crisis, even despite recent updates to Part 2 in 2017. Thus, the proposed rule seeks to balance the need to both coordinate care among providers that treat SUD and maintain privacy for patients seeking such treatment.
Notably, the proposed rule does not change Part 2’s prohibition on law enforcement’s use of SUD patient records in criminal prosecution against the patient. In addition, the proposed rule will not affect Part 2’s restriction on disclosure of SUD patient records without patient consent, except for those disclosures related to bona fide medical emergencies, based upon appropriate court orders for good cause (except that the proposed rule corrects a technical error), or made for the purpose of scientific research, audits, or program evaluation.(2) The substantial changes that HHS and SAMHSA propose to Part 2 follow.
First, the proposed rule seeks to facilitate coordination between Part 2 providers and non-Part 2 providers by clarifying that treatment records created by non-Part 2 providers that are derived from their own patient encounters will not be subject to Part 2 even when those records involve SUD, unless those records incorporate SUD records received from a Part 2 program. Accordingly, the proposed rule provides various methods by which a non-Part 2 provider can segment or otherwise hold apart the SUD records it receives from a Part 2 provider to ensure that new records created by the non-Part 2 provider will not become subject to Part 2.(3)
In addition, the proposed rule would permit non-opioid treatment providers that have a treating provider relationship with the patient to access central registries in order to determine whether the patient is already receiving opioid treatment through another program listed in the registry. The purpose of this proposed change is to coordinate care and prevent duplicative enrollments and prescriptions for excessive opioids.(4) Along those lines, the proposed rule would also allow Part 2 programs (including opioid treatment providers) to enroll in, and report required dispensing data for controlled substances to, state prescription drug monitoring programs upon obtaining written consent from the patient.(5)
The proposed rule also includes several provisions that would decrease the burden on patients. For example, the proposed rule would allow patients to consent to the disclosure of their Part 2 treatment record to a wide range of entities that do not have a treatment relationship with the patient (e.g., social security administration, halfway or sober living house programs, etc.) without being required to name the specific individual who will receive the record on behalf of the entity, as is currently required. In addition, the proposed rule would expand the definition of a “bona fide medical emergency” to allow Part 2 programs to disclose the patient’s treatment record to another Part 2 program without the patient’s consent (assuming that it cannot feasibly be obtained) during a state or federally declared natural or major disaster (e.g., hurricane) to ensure that the patient can continue to receive ongoing treatment during such disaster.(6)
Some of the changes proposed by HHS and SAMHSA are intended to resolve ambiguities within Part 2. Specifically, the proposed rule attempts to resolve confusion as to the disclosures of SUD treatment records that can be made with the patient’s written consent for payment and health care operational activities by providing a non-exhaustive list of 17 examples of permitted payment and health care operational activities.(7) Notably, this list differs from HIPAA’s definition of health care operations in that it specifically excludes disclosures made for the purposes of care coordination and case management. The proposed rule also attempts to resolve ambiguities regarding the scope of permitted disclosures without patient consent for audits and/or program evaluation purposes by allowing patient identifying information to be disclosed to government agencies and their contractors, subcontractors and legal representatives in the course of audits and evaluations mandated by statute or regulation when those activities that cannot be carried out using de-identified information.(8)
In addition, the proposed rule also seeks to facilitate disclosures of SUD patient treatment records for research purposes by better aligning the requirements under Part 2 with those under HIPAA’s Privacy Rule and the Common Rule. In general, this would be accomplished by permitting disclosures for research: (i) by a HIPAA covered entity or business associate to individuals and organizations who are neither HIPAA covered entities nor subject to the Common Rule, provided that the data is disclosed in accordance with the HIPAA Privacy Rule; (ii) to members of a HIPAA covered entity’s workforce for purposes of employer-sponsored research; and (iii) to recipients who are covered by FDA regulations for the protection of human subjects in clinical investigations.(9)
Lastly, the proposed rule seeks to provide further clarity with respect to certain Part 2 provisions. The proposed rule attempts to clarify the time period for the placement of undercover agents and informants within a Part 2 program by specifying a 12-month time period (which can be extended through the placement of a new court order) that begins when the undercover agent is placed, or the informant is identified, in the Part 2 program.(10) Furthermore, the proposed rule explains how Part 2 programs should handle communications made by their employees (and volunteers and trainees) using personal devices and accounts given that “records” under Part 2 can be interpreted as including emails and texts. The proposed rule clarifies that the employees do not need to relinquish, destroy or otherwise render their personal devices or accounts unusable in the event that the Part 2 program is discontinued in order to comply with Part 2’s “sanitization” requirement. Instead, the information should be immediately deleted from the employee’s personal account or device (after being forwarded to the Part 2 program’s authorized communication channel if the email or text contains patient identifying information).(11)
Notably, interested parties can submit comments regarding the proposed rule to SAMHSA by October 25, 2019.(12) For additional information or assistance regarding Part 2 or the proposed rule, contact Reesa Benkoff, Esq. of Benkoff Health Law, PLLC at (248) 482-2780.
(1) 42 CFR § 2.11.
(2)See HHS 42 CFR Part 2 Proposed Rule Fact Sheet (Aug. 22, 2019), available at: https://www.hhs.gov/about/news/2019/08/22/hhs-42-cfr-part-2-proposed-rule-fact-sheet.html.
(3)See 84 Fed. Reg. 44569 (Aug. 26, 2019).
(4)See id. at 44576.
(5)See id. at 44577.
(6)See id.
(7)See id. at 44575.
(8)See id.
(9)See id. at 44578.
(10)See id. at 44581.
(11)See id. at 44570.
(12)See id. at 44568.