Proposed Changes to Part 2 Intended to Ease Regulatory Burden and Facilitate Care Coordination
On August 26, 2019, the Department of Health and Human Services (HHS) and the Substance Abuse and Mental Health Services Administration (SAMHSA) issued a proposed rule (the proposed rule) amending the federal regulations governing the confidentiality and privacy of substance use disorder (SUD) patient records created by federally-assisted SUD programs, known as 42 CFR part 2 (commonly referred to as “Part 2”).
Part 2 is intended to protect the confidentiality of SUD patient records by prohibiting unauthorized disclosures of such records except in limited circumstances. It is designed to encourage individuals with SUDs to enter and remain in treatment, without the fear that such information will be disclosed without their knowledge or consent. Part 2 applies to any information disclosed by a covered program that would identify an individual, directly or indirectly, as having a current or past drug or alcohol program, or as a participant in a covered program.
In recent years, SAMHSA has revised Part 2 to make it easier to share Part 2 information with providers and other entities who need access to such information. Nevertheless, providers have continued to express concern over the barriers that Part 2 creates in disclosing patient information among treating providers. The proposed rule is intended to further address and alleviate the challenges related to the exchange of health information and patient privacy within the constraints of the underlying statute, while also addressing the increasingly urgent need to streamline SUD services in light of the opioid epidemic.
The following is a brief summary of the major changes under the proposed rule. These changes are not effective until comments are reviewed and HHS releases a final rule.
- Applicability of Part 2 and Redisclosure (42 CFR Section 2.12): The proposed rule seeks to clarify that treatment records created by non-Part 2 providers based on their own patient encounters will not be covered by Part 2, unless any SUD records previously received from a Part 2 program are incorporated into the non-Part 2 provider’s records. Non-Part 2 providers can avoid becoming subject to Part 2 by ensuring that any records created by Part 2 providers are kept separate from the records created by the non-Part 2 provider.
- Consent Requirements (42 CFR Section 2.31): The proposed rule includes several provisions intended to streamline consent requirements. First, SAMHSA is proposing to allow a SUD patient to consent to disclosure of the patient’s Part 2 records to an entity (e.g. the Social Security Administration) without naming a specific person as the recipient for the disclosure. Existing regulations do not allow the patient to broadly consent to the disclosure to a particular organization or entity if the particular organization or entity is not providing treatment to the patient.
- Disclosures for Payment and Health Care Operational Activities (42 CFR Section 2.33): Recognizing there is lingering confusion under Part 2 about what activities count as “payment and health care operations,” the proposed rule clarifies that disclosures to specified entities for payment and health care operational activities are permitted with written consent and provides an illustrative, non-exhaustive list of payment and health care operations activities for which such disclosure is allowed. It is important to note the proposed rule retains the prohibition on disclosures to contractors, subcontractors and legal representatives for activities related to a patient’s diagnosis, treatment or referral for treatment. Unlike HIPAA which allows for disclosures related to case management and care coordination without the patient’s prior consent, the proposed rule continues to require the patient’s consent to disclose SUD records for activities related to a patient’s diagnosis, treatment or referral for treatment.
- Disclosures to Central Registries and Prescription Drug Monitoring Programs (42 CFR Section 2.36): The proposed rule would allow opioid treatment programs (OTPs) to enroll in state prescription drug monitoring programs (PDMPs) and submit the dispensing data for controlled substances consistent with applicable state laws. Further, it would allow non-OTP providers to query a central registry in order to determine whether their patients already are receiving opioid treatment through a member program.
- Medical Emergencies (42 CFR Section 2.51): The existing regulations allow Part 2 providers to disclose SUD records without patient consent in a “bona fide medical emergency.” The proposed rule expands the definition of “bona fide medical emergency” to include declared emergencies resulting from natural disasters.
- Audit and Evaluation (42 CFR Section 2.53): SAMHSA recognized existing regulations create some ambiguity about what activities are covered under the audit and evaluation exception under Part 2. The proposed rule seeks to clarify that government agencies and third-party payers are permitted to obtain Part 2 records without written patient consent in order to conduct audits or evaluations for specific purposes. Seeking to address confusion around what constitutes audit and evaluation, the proposed rule includes a new provision permitting patient identifying information to be disclosed to federal, state and local government agencies, and their contractors, subcontractors and legal representatives in the course of conducting audits or evaluations mandated by statute or regulation, provided those audits or evaluations cannot be carried out using de-identified information. A new section, “Quality Assurance Entities Included,” states disclosures may be made to accrediting bodies or similar organizations focused on quality assurance for purposes of audit and evaluation. The proposed rule also clarifies that Part 2 providers may provide government agencies and third-party payers access to patient information for activities related to the review of appropriateness of medical care, medical necessity and utilization of services.
- Research (42 CFR Section 2.52): In an effort to streamline the overlapping requirements related to research on human subjects under Part 2, the HIPAA Privacy Rule and the Common Rule, under the proposed rule, disclosures for research under Part 2 will be permitted by a HIPAA covered entity or business associate to individuals and organizations who are neither HIPAA covered entities, nor subject to the Common Rule. This change aligns Part 2 with the research requirements contained in the HIPAA Privacy Rule.
- Undercover Agents and Informants (42 CFR Section 2.67): In response to DOJ concerns that current policy is overly restrictive to some ongoing investigations of Part 2 programs, the proposed rule extends the period of time during which court-ordered placement of an undercover agent or informant may be placed within a Part 2 program to 12 months, and further provides that courts will be authorized to extend the period of placement through a new court order. For clarity, the proposed rule states Part 2 will continue to prohibit law enforcement use of SUD patient records in criminal prosecution against the patient, and also will continue to restrict the disclosure of SUD treatment records without patient consent unless an exception applies.
- Disposition of Records Contained on Personal Devices (42 CFR Section 2.19): The proposed rule provides clarification regarding “sanitization” of Part 2 program employees’ personal devices in the event a patient sends an incidental message to the personal device. In such instances, the device is considered “sanitized” if the message is deleted.
While the proposed rule seeks to reduce the burden for information sharing among Part 2 and non-Part 2 providers, the requirements under Part 2 continue to be nuanced and far more restrictive than HIPAA and many state privacy laws. SUD treatment providers must continue to be careful in their efforts to comply with the restrictions under Part 2 related to the disclosure of SUD patient information, and non-Part 2 providers must continue to be mindful of their obligations concerning records they may receive from a Part 2 provider. HHS and SAMHSA seek comments on the proposed rule which must be received no later than 5 p.m. on October 25, 2019.
For questions related to Part 2, or advice on other health law or privacy-related issues, please contact Breanne M. Rubin.
Disclaimer: This alert has been prepared by Eastman & Smith Ltd. for informational purposes only and should not be considered legal advice. This information is not intended to create, and receipt of it does not constitute, an attorney/client relationship.