In 2018, the federal Substance Abuse and Mental Health Services Administration (SAMHSA) finalized changes to the Confidentiality of Substance Use Disorder Patient Records regulation, 42 CFR Part 2, to make it easier for providers of consenting patients to share substance use disorder (SUD) data. Now state governments and nonprofit health information exchanges are working through implementing new consent rules and work flows.
Recently, Katie Gray, M.B.A., director of client operations and programs for HealthInfoNet, Maine’s statewide HIE, gave an online presentation, sponsored by All In: Data for Community Health, on how her organization is working with the state’s recovery community to develop rules for statewide SUD data sharing.
Her presentation noted that a culture of separation has developed in the provider community, preventing patients with SUD from being supported by behavioral health and general medical integrated care services. Gray added that Maine Gov. Janet Mills’ 10-Point Opioid Plan identifies data as a top priority.
Gray outlined the changes to Title 42 CFR Part 2 Final Rule established in 2018- 2019:
• Patients may now consent to disclose their Part 2 data to intermediary organizations (e.g., ACOs, HIEs) with which they may not have a direct treatment relationship.
• Patients may now include a general designation (i.e., “to whom”) and a description of the Part 2 information they wish to disclose (i.e., “amount and kind”). “To Whom” – allows patients to request HIE audits of who has accessed their Part 2 data. “Amount and Kind” – allows for all or some of patients’ Part 2 data to be disclosed.
• HIEs may disclose information to patients’ treating providers.
• Consent form must include the date to expire (e.g., one year; must be no longer than reasonably necessary to serve the purpose of the consent).
Gray then described the collaborative process HealthinfoNet has been going through over the past year to implement changes. “Changing participation agreements and trust frameworks has to be rooted in collaborative processes,” she said.
First, they identified stakeholders to bring to the table, and hired a third-party facilitator to convene discussions.
They created workgroups to work through issues that were identified. They developed and provided recommendations for statewide SUD data sharing. “The recommendations focusing on how SUD data is used to support prevention, treatment and care coordination,” she said. Among their key recommendations around consent are:
• Maintain one patient consent form for any “sensitive data category” (e.g., mental health, SUD, HIV)
• Patients may choose to opt-in to sharing SUD Part 2 information via general designation (i.e., “to whom”) to HealthInfoNet and “all treating participating providers” of the statewide HIE
• Patients may have two choices for SUD Part 2 information they wish to disclose (i.e.,“amount and kind”) to HealthInfoNet:
1. All SUD information supplied via HIE participants
2. All SUD information except SUD “documents” (this option meets technical constraints and patient concerns about sharing treatment plan/discharge summaries, etc.)
• Consent form will include an expiration date of one year for SUD data category only; mental health and HIV consent will never expire, until/if a patient revokes their previous opt-in request
Concerning workflow, they recommended consent education is provided as part of the overall SUD treatment program “intake” appointment. Gray noted that inpatient workflows should focus on “discharge” education workflow, not intake. HealthInfoNet consent forms are universal – they apply to all locations of care regardless of where completed or processed.
Patients can revoke their opt-in request at any time with a “revoke” form. HIE participants do not need to track HealthInfoNet consent “choices.”
“We have come to a set of agreements with the community on what is critical and what deal-breakers are,” Gray said. "We find that a phased approach is critical — to adjust when things are not working. Our stakeholders are used to ongoing evolution in the way we operate.”
