SAMHSA Finalizes Changes to Part 2 Privacy Rules

• The final rule keeps the basic framework for confidentiality protection of SUD patient records but “clarifies” the scope of the privacy regulations around substance use disorder (SUD) treatment.
• The administration will target policies implemented in the CARES Act in a separate proposed rule.
• The changes are “just the beginning” of a comprehensive agenda for reforming health delivery and financing regulations.

Today the Trump administration finalized a much-anticipated rule updating the consent requirements governing the release of patient information for individuals seeking treatment for substance use disorder. The rule, developed by the Substance Abuse and Mental Health Services Administration (SAMHSA), is designed to address barriers to care coordination for providers that treat individuals with substance use disorder (SUD), while maintaining privacy safeguards for patients seeking treatment for SUD. Health and Human Services (HHS) Secretary Alex Azar stated that, thanks to the “valuable” input of stakeholders, the final rule will “make it easier for Americans to seek and receive treatment while lifting burdens on providers and maintaining important privacy protections.” HHS Deputy Secretary Eric Hargan added that the changes — part of the Regulatory Sprint to Coordinated Care — are “just the beginning of a comprehensive agenda for reforming regulations that govern the delivery and financing of American healthcare, with the ultimate goal of better care, and better health, at a lower cost.”

•  Background. Federal confidentiality law and regulations (42 CFR Part 2) impose more restrictions on the disclosure of SUD treatment records than most other Federal and State health privacy laws, including the Standards for Privacy of Individually Identifiable Health Information (Privacy Rule) under HIPAA. The Part 2 rules have been the subject of significant attention in the midst of the current opioid epidemic, as the public health crisis has created clinical and safety challenges for providers seeking to coordinate patient care. Many stakeholders have called on the administration and Congress to streamline consent policies associated with sensitive health information and align these policies with the consent policies under HIPAA. Stakeholders argue that the narrower scope of 42 CFR Part 2 permits fewer uses and disclosures of patient information without express written consent. SAMHSA proposed this rule to modify Part 2 in August 2019.

HHS noted that the basic framework for confidentiality protection of SUD patient records is not altered under the rule, and the U.S. Code will continue to prohibit law enforcement use of SUD patient records in criminal prosecution and restrict the disclosure of SUD treatment records without patient consent.

The final rule from SAMHSA modifies several sections of the substance use privacy law to encourage care coordination among providers. The rule updates the definition of what constitutes a Part 2 record and its applicability in order to ensure providers have additional clarity about what is, or should be, protected by Part 2. It also seeks to ensure that Part 2 providers are not discouraged from caring for patients with SUD or recording their information. SAMHSA clarifies that personal devices not involved in Part 2 program business do not have to be “sanitized” — i.e. record deletion — if a SUD patient accidentally messages a provider’s personal device. Additionally, non-Part 2 providers will have access to central registries to determine if a patient is enrolled in an Opioid Treatment Program (OTP) and receiving medications as part of SUD treatment to ensure at-risk patients are not accidently overprescribed or prescribed substances for which they are seeking treatment.

•  What’s Next. The administration had previously noted they have limited ability to ease sharing of substance use records without congressional authorization, and the CARES Act (H.R. 746) ordered HHS to make the sharing of substance use records more similar to the handling of other medical records governed under HIPAA. SAMHSA announced today that it will issue a separate proposed rulemaking to comply with the policies included in CARES, although the legislation stated the Part 2 provisions cannot take effect before March 27, 2021. Under CARES, patients can allow their substance use records to be shared within the health system, and to no specific entities, and have the option to revoke consent. The law also upholds existing restrictions on sharing substance use records for law enforcement investigations and civil trials.

The specific changes to 42 CFR Part 2 included in today’s proposed rule are:

• Applicability and Re-Disclosure — Treatment records created by non-Part 2 providers based on their own patient encounter(s) will not be covered by Part 2, unless any SUD records previously received from a Part 2 program are incorporated into such records. Segmentation or holding a part of any Part 2 patient record previously received can be used to ensure that new records created by non-Part 2 providers will not become subject to Part 2.
• Disposition of Records — When a SUD patient sends an incidental message to the personal device of an employee of a Part 2 program, the employee will be able to fulfill the Part 2 requirement for "sanitizing" the device by deleting that message.
• Consent Requirements — A SUD patient may consent to disclosure of his Part 2 treatment records to an entity (e.g., the Social Security Administration), without naming a specific person as the recipient for the disclosure.
• Disclosures Permitted with Written Consent — Disclosures for the purpose of "payment and health care operations" are permitted with written consent, in connection with an illustrative list of 18 example activities that constitute payment and health care operations now specified under the regulatory provision.
• Disclosures to Central Registries and PDMPs — Non-OTP (opioid treatment program) and non-central registry treating providers are now eligible to query a central registry, in order to determine whether their patients are already receiving opioid treatment through a member program. OTPs are permitted to enroll in a state prescription drug monitoring program (PDMP), and permitted to report data into the PDMP when prescribing or dispensing medications on Schedules II to V, consistent with applicable state law.
• Medical Emergencies — Declared emergencies resulting from natural disasters (e.g., hurricanes) that disrupt treatment facilities and services will meet the definition for a "bona fide medical emergency," for the purpose of disclosing SUD records without patient consent under Part 2.
• Research — Disclosures for research under Part 2 will be permitted by a HIPAA-covered entity or business associate to individuals and organizations who are neither HIPAA- covered entities, nor subject to the Common Rule. However, the final rule jettisons a provision from the NPRM that would have clarified that a lawful holder of Part 2 data may disclose the data to a member of the workforce of a HIPAA-covered entity provided that the research is being conducted at the direction or on behalf of that individual’s employer. Ambiguity that would have suggested that employers might be able to conduct SUD research on their employees triggered several comments in opposition, and HHS did not finalize that provision.
• Audit and Evaluation — Clarifies specific situations that fall within the scope of permissible disclosures for audits and/or program evaluation purposes.
• Undercover Agents and Informants — Court-ordered placement of an undercover agent or informant within a Part 2 program is extended to a period of 12 months, and courts are authorized to further extend the period of placement through a new court order.