The Substance Abuse and Mental Health Service Administration's long-awaited final rule updating the Confidentiality of Alcohol and Drug Abuse Patient Records, 42 Code of Federal Regulations Part 2 (Part 2) will be published Jan. 18 and is available for review on the Federal Register website.
Despite widespread criticism of the approach taken in the proposed rule, the final rule largely follows its outline and will go into effect 30 days from publication.
The Partnership to Amend 42 CFR Part 2, a coalition of nearly 30 healthcare organizations committed to aligning Part 2 with HIPAA, put out a statement saying that the final rule takes helpful steps to modernize Part 2, but it does not go far enough.
“The new final rule makes important updates, but more work needs to be done. We look forward to working with our partners and Congress this year to improve the confidentiality law so that it continues to offer important patient protections without impeding good care,” said Jeffrey Goldsmith, M.D., president of the American Society of Addiction Medicine, in a prepared statement.
In its final rule, SAMHSA noted that “Part 2 and its governing statute are separate and distinct from HIPAA and its implementing regulations. Because of its targeted population, part 2 provides more stringent federal protections than most other health privacy laws, including HIPAA.”
The 42 CFR Part 2 regulations restricting how data of patients with substance use disorders (SUDs) is shared were written in 1975 out of concern that the information could be used against individuals, causing them to avoid seeking needed treatment. But the way the regulation was written, it required the patient to consent every time their data was shared or accessed, which HIEs and healthcare organizations have found very difficult to implement. Many HIEs have just avoided the issue during their startup phases.
In updating the 42 CFR Part 2 rules, SAMHSA is seeking to address the need to:
• Increase opportunities for individuals with substance use disorders to participate in new and emerging health and healthcare models and health IT;
• Facilitate the sharing of information within the health care system to support new models of integrated healthcare;
• Improve patient safety while maintaining or strengthening privacy protections for individuals seeking treatment for substance use disorders; and
• Decrease burdens associated with several aspects of the rule, including consent requirements.
When the updated rule was proposed last year, however, many in both the informatics and behavioral healthcare communities published comments expressing concern about the details.
For instance, the American Medical Informatics Association noted that SAMHSA proposes to allow SUD patients to use a general designation in the “To Whom” section of the consent form, so that consent is not required each time it is requested by a clinician, a hospital, HIE or an accountable care organization.
AMIA said the long-anticipated proposed rule takes one step forward – allowing a consent to specify a class of treating providers, but also takes two steps back: (1) potentially making it more difficult to disclose Part 2 information to an organization without a treatment relationship; and (2) providing patients with the right to an accounting of disclosures that HIPAA has shown to be of dubious value in comparison to its burden.
“The difficulty of managing SUD data differently than every other piece of health information is, in itself, a dated concept and a flawed approach,” said AMIA Board Chair and Medical Director of IT Services at the University of Washington’s UW Medicine, Thomas H. Payne, M.D., in a prepared statement.
Yet the final rule, while noting the criticisms, retains the approach of the “List of Disclosures” requirement in the proposed rule.
In response to the proposed rule, Kaiser Permanente had written: “SAMHSA appears to have gone out of its way to make sharing clinical information for treatment purposes more difficult, other than nominal easing of consent form requirements for a very limited type of HIE. SAMHSA has not created a treatment exception, has not permitted patients to consent to disclosure of information to “all of my treating providers ….and has made consent forms more complicated and confusing.”
In response to the final rule, Pamela Greenberg, president and CEO of the Association for Behavioral Health and Wellness, noted that while the final rule is an improvement over current regulations and over the proposed rule, it continues to limit communication among providers, and in some cases, the ability to use existing medical information to identify members at risk for substance, such as opioid, misuse or diversion,
“ABHW applauds SAMHSA for addressing this important matter. Our hope was that the final rule would align substance use privacy protections with the Health Insurance Portability and Accountability Act (HIPAA). Unfortunately, it does not,” Greenberg said in a prepared statement. “Separation of substance use from the rest of medicine creates several problems: primary care lacks the ability to coordinate a patient’s medical and substance use treatment; substance use treatment programs lack the capability to coordinate a patient’s medical and substance use care; and patients are put at risk of unsafe, uncoordinated, and uninformed care.”
