Proposed Update to Regulations on the Confidentiality of Substance Use Disorder Records
On August 26, 2019, HHS’s Substance Abuse and Mental Health Services Administration (“SAMHSA”) published a Proposed Rule updating the regulations on the Confidentiality of Substance Use Disorder Records (“Part 2”). Part 2 Programs, which can be stand-alone facilities or individuals or departments of general medical facilities whose primary function is to diagnose, refer, or treat substance use disorders, are subject to the strict confidentiality restrictions of Part 2. The Proposed Rule amends Part 2 and provides guidance on the protections of Part 2 records to both Part 2 Programs and those providers who receive records from Part 2 Programs.
SAMHSA had updated Part 2 twice in the recent past, a 2017 overhaul of the prior regulations and some additional changes in 2018 to complement the 2017 changes. However, criticism of the stringent Part 2 restrictions on disclosures continued to persist. In particular, Part 2 is viewed by some to be an impediment to care coordination as Part 2 restricts disclosures between Part 2 programs and other health care providers without patient consent. In response to the criticism, SAMHSA described its intent behind the Proposed Rule as helping facilitate coordinated care while continuing to provide patients of Part 2 Programs appropriate privacy protections.
The Proposed Rule includes the following changes:
- Providing clarity to providers who are not Part 2 Programs that the independent recording of substance use disorder information does not itself subject the records to Part 2, provided that any records received from a Part 2 Program are segregated.
- Expanding the types of entities to which Part 2 patients can consent to the disclosure of Part 2 records without the need to name specific individuals at those entities.
- Revising the language of the required notice on the restriction on re-disclosures.
- Clarifying that patients can consent to disclosures for payment and health care operational activities, and adding an illustrative list of such disclosures that had previously been included only in commentary.
- Permitting central registries to disclose to non-member programs specified information about the programs’ patients.
- Permitting opioid treatment programs to disclose information to prescription drug monitoring programs (“PDMPs”) with patient consent.
- Amending the disclosures allowed for medical emergencies to permit Part 2 Programs to disclose Part 2 records to another such provider during declared natural and major disasters.
- Aligning Part 2 with HIPAA and the Common Rule related to the conduct of research.
- Providing clearer guidance on disclosures permitted for audit purposes.
- Revising certain requirements related to the placement of undercover agents.
- Providing guidance on how to handle the destruction of records contained on personal devices not regularly used in the course of business but have received communication (by text or email) from Part 2 patients.
The Proposed Rule does not appear to provide the degree of alignment with HIPAA many had hoped to see. This might not be surprising. SAMHSA has long stated that a change to the statute is necessary for it to change some of the underlying structure of Part 2, including the requirement for a patient’s consent to treatment-related disclosures. Until such a change in the law, SAMHSA appears to be working within the current statutory confines to address care coordination to the extent possible.
Comments to the Proposed Rule are due by October 25, 2019.