SAMHSA Issues Final Changes to 'Part 2' Confidentiality Regulations
On January 18, 2017, the United States Department of Health and Human Services Substance Abuse and Mental Health Services Administration (“SAMHSA”) issued final regulations (the “Final Rule”) intended to update and modernize the Confidentiality of Alcohol and Drug Abuse Patient Records regulations set forth at 42 C.F.R., Part 2 (“Part 2”). The Final Rule marks the most substantive update to Part 2 since 1987.
Obviously, significant changes have occurred in the health care industry since 1987, including new models of integrated care built on a foundation of information sharing to support the coordination of patient care, the widespread adoption of electronic information technology, and a new focus on performance measurement. According to SAMHSA, the purpose of the Final Rule is to better align Part 2 with these advances, while retaining the stringent protections for patient identifying information.
The Final Rule was slated to take effect on February 17, 2017. However, on January 20, 2017, President Trump issued a 60-day “regulatory freeze” on rules that have been published, but have yet to take effect. It is unclear if the president’s directive will impact the implementation of the Final Rule. At this time, it appears that the earliest the Final Rule will become effective is March 21, 2017.
Below is an overview of the significant changes to Part 2 contained in the Final Rule.
The Final Rule revises most of the definitions contained in Part 2. The most notable change is to the definition of “qualified service organization” (“QSO”), which now includes an individual or entity that provides population health management services to a Part 2 program.
The Final Rule expands the Part 2 restrictions to individuals or entities that receive patient identifying information from “other lawful holders of patient identifying information.”
Confidentiality Restrictions and Safeguards
The Final Rule permits patients to include in a written consent a general designation (described below) of individuals or entities that may disclose and/or receive patient identifying information. It also requires Part 2 programs to provide, upon a patient’s request, a list of entities to whom their identifying information has been disclosed (i.e., a “List of Disclosures”).
Security for Records
Under the Final Rule, Part 2 programs, and other lawful holders of patient identifying information, must have formal policies and procedures in place to reasonably protect against unauthorized uses and disclosures of patient identifying information. The policies and procedures must cover paper and electronic records, and address, among other things, creating, receiving, maintaining, transmitting, and destroying such records.
The Final Rule provides that patients may consent to the disclosure of their identifying information using a general designation identifying certain individuals and/or entities (for example, “all my treating providers”). However, Part 2 programs are not permitted to use general designations until they are able to provide patients with a List of Disclosures.
Prohibition on Redisclosure
The Final Rule makes two modifications to the content of the notice required to accompany all disclosures. First, the notice must provide that the prohibition on re-disclosure applies only to information that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder. Second, the notice must make clear that Part 2 restricts the use of the information to criminally investigate or prosecute a patient with a substance use disorder.
The Final Rule authorizes a lawful holder of patient identifying information to disclose such information to qualified personnel for purposes of conducting scientific research if the researcher meets certain regulatory requirements. De-identified patient information still may be shared for research purposes. The Final Rule also permits data linkages to enable researchers holding Part 2 data to link to data sets from federal and non-federal data repositories, provided certain regulatory requirements are met.
Audit and Evaluation
The Final Rule permits an audit or evaluation in order to meet the requirements for accountable care organizations (“ACOs”) or similar CMS-regulated organizations.
Supplemental Notice of Proposed Rulemaking
Along with the Final Rule, SAMHSA issued a Supplemental Notice of Proposed Rulemaking (“SNPRM”). Under the SNPRM, SAMHSA seeks input on certain additional clarifications and suggestions in relation to Part 2. The SNPRM includes proposals to:
- Clarify the circumstances in which contractors, subcontractors and legal representatives of lawful holders may receive and utilize patient identifying information for purposes of carrying out the lawful holder’s payment and health care operations activities;
- Clarify the use of contractors, subcontractors and legal representatives to carry out audit and evaluation activities that are necessary to meet the requirements of a CMS-regulated program (for example, ACOs); and
- Determine whether an abbreviated notice of prohibition on re-disclosure should be adopted.
According to the SNPRM, comments to the proposals must be received no later than 5 p.m. on February 17, 2017. It is unclear whether President Trump’s “regulatory freeze” will impact the SNPRM or the comment deadline.
Assuming the Final Rule is implemented, Part 2 providers will need to take action to ensure compliance with the changes noted above. Specifically, they will need to, among other things, revise their consent documents, prohibition on re-disclosure statements, and review and update their policies and procedures pertaining to security and permitted disclosures. Likewise, with the change to the definition of QSO, it also would be wise to inventory all vendors to ensure each is being appropriately categorized as a QSO, and that all appropriate contractual documentation is in place.
The Iseman, Cunningham, Riester & Hyde Health Care Practice Group will continue to monitor the effective date of the Final Rule, in addition to any other regulatory changes that might occur as a result of the SNPRM. If you have any questions regarding the changes to Part 2, how they might impact your operations, or would like assistance with implementing any of the new provisions, please contact a member of our Health Care Practice Group at 518-462-3000.