The Statewide Health Information Network for New York (SHIN-NY) is requiring that all seven of the state’s regional health information organizations offer patients the option of sharing specially protected substance use treatment data by March 31, 2019.
A 30-year-old federal regulation, 42 CFR Part 2 (referred to as Part 2) governs confidentiality of drug and alcohol treatment and prevention records. It requires limiting the use and disclosure of patients’ substance use records from certain substance use programs and requires specific patient consents about who the data will be shared with. In recent updates, the Substance Abuse and Mental Health Services Administration (SAMHSA) has made some incremental changes to allow for more sharing of the data. Nevertheless, stakeholders are pushing Congress to more closely align Part 2 with HIPAA.
In an interview with Healthcare Innovation, Jill Eisenstein, CEO and president of Rochester RHIO, and Amy Warner, the RHIO’s privacy officer, discussed the transition as they prepare to begin sharing Part 2 data.
“All the RHIOs were asked as part of our state accreditation process to include the SAMHSA data,” said Eisenstein. “Over the past year the Rochester RHIO has held a series of community meetings with providers to get their input on how to make this work and make people comfortable with sharing it, because really it is the providers that have been nervous about sharing the SAMSHA data because of the regulations at the federal and state level.”
Eisenstein stressed that because all the RHIOs in New York have opt-in policies for all types of data sharing already, they are well suited to begin sharing the SAMHSA Part 2 data. “When data gets sent to us, in order for anyone to have access to that data, they need to have explicit consent from the patient. It allows the patient to have control over who sees their information, whether from a primary care provider or a substance abuse provider. It is all treated the same way in our system now.”
So patients might give consent to their primary care practice’s organization; but if they go to see an unaffiliated specialist, such as a radiologist, they must also specifically consent to sharing their data with that practice. “That is how we have been doing business here with millions of patient consents,” Eisenstein said, “so access is gated by patient consent.”
Warner said one key changes SAMHSA made was to allow a general provider designation, so that instead of saying “Dr. Smith is entitled to see my data,” now you can do a general designation for an organization as long as they are providing care and upon request from the patient you include a list of the doctors that would include.
The consent form must include an explicit description of the amount and type of substance use disorder information that can be disclosed, she added.
SAMHSA also specified that designated “Qualified Service Organizations” are allowed to share SAMHSA data if they have agreements in place with their participants. (Rochester RHIO has those QSO agreements in place.) It also allows for “break-the-glass” access for emergency department providers in relation to SAMHSA data, and it allows the SAMHSA information to be used for research. The rule allows disclosure to other service providers such as accountants and lawyers, so you can do audits and evaluation functions.
“They are trying to take incremental steps to make this data more user friendly and similar to HIPAA,” Warner said. “They want providers to have the full patient record. This is how they are getting there.”
Eisenstein noted that SAMHSA data has been treated differently in the past and not shared. “We are doing a special communications campaign to make sure patients understand that if they gave consent a long time ago, they may want to revisit that if they are uncomfortable sharing SAMHSA data,” she said. “We do offer an option to opt out of sharing at all, so that nobody can access their data. We can also do an audit of anyplace they have given consent and give that to the patient so they can change their consent. We are going to support patients as we enter this new realm of sharing this data.”
She noted that Rochester RHIO has shared HIV data since it started. “There used to be a stigma around that when we started sharing a dozen years ago, but now it is just assumed that it is shared data, and I have a feeling in the next few years the same will be true for SAMHSA.”
Eisenstein believes the opt-in consent policy has allowed her organization to build trust with providers and patients. “We have been able to make so much more progress by allowing patients to have that power in the HIE. People like to have control over their own data. They have more trust in us.”
