Department of Health and Human Services Proposes Changes to Confidentiality Rules for Substance Abuse Patient Records

April 12, 2016 | Health Services

The Substance Abuse and Mental Health Services Administration (SAMHSA), a branch of the federal Department of Health and Human Services (HHS), has published a proposed rule that would amend 42 CFR Part 2 (commonly referred to as “Part 2”) which governs confidentiality of drug and alcohol abuse patient records. Part 2 was last revised in 1987. HHS has acknowledged a need to modernize the regulations in response to emerging health information technologies and new models of integrated health care that rely on coordination of care and exchange of patient records among providers to maximize quality of care. Below is a summary of the main changes proposed by the rule. HHS is accepting public comments on the proposed rule until April 11, 2016.

A.  Changes to Consent Requirement for Disclosure of Patient Records

As the regulations currently stand, it is difficult for substance abuse patients to obtain treatment from providers who participate in alternative payment models, such as Accountable Care Organizations and Managed Care Organizations. Before a provider can disclose patient records, a patient must sign a consent form that specifically names each individual or organization to which the disclosure will be made. This requirement deters patients from participating in alternative payment models, which are founded on the concept of sharing information among providers, because it is too burdensome to provide consent for each individual provider that participates in a payment plan.

The proposed rule amends this requirement to allow general designations when identifying to whom patient information can be disclosed. General designations may be made to entities that have a treating provider relationship with a patient, or in other words, entities that employ or privilege one or more individuals who have a treating provider relationship with the patient. A “treating provider relationship” is established, regardless if there is an actual in-person encounter, when a patient agrees to, and a provider undertakes the diagnosis, evaluation or treatment of any condition. For example, consent can be given for disclosure of patient information to a Managed Care Organization “and all treating providers.” Such consent would satisfy the proposed rule and it would be the named organization’s responsibility to establish methodologies for determining which of their providers have a treating provider relationship with the patient.

The proposed rule also allows patients to submit written requests to entities named on their consent forms for a list of all disclosures that the entity made pursuant to their consent, provided however, that the request is limited to disclosures made in the previous two years. The list of disclosures would have to include all individual providers who received patient information pursuant to a general designation on the patient’s consent form. To ensure that affected entities have sufficient time to implement technologies and recording protocol to comply with this requirement, it will not become effective until two years after the proposed rule is passed and finalized.

B.  Additional Clarifications in the Proposed Rule

Definition of Part 2 Program

In addition to revising the consent requirement, the proposed rule also clarifies certain definitions and requirements under the current regulations. For example, because more substance abuse disorders are being treated in general and integrated health care setting, the proposed rule explains that the definition of Part 2 Programs does not include general medical practices or facilities, unless the practice or facility has an identified unit for substance abuse disorders and holds itself out as a provider of substance abuse diagnosis, treatment or referral. To “hold itself out” is further defined as any activity that would make a person reasonable conclude that the practice or facility provides such services (e.g. having authorization from state or federal authorities or distributing advertisements for diagnosis, treatment or referral of substance abuse disorders).

2.  Electronic Patient Records

The proposed rule also incorporates electronic patient records to ensure that both the current and proposed regulations would apply to such records. The rule suggests establishing protocol for sanitizing electronic media and handling electronic records subsequent to the discontinuation of a Part 2 Program. Sanitization would include purging patient information from electronic media and, in some instances, would also warrant destruction of the electronic media.

3.  Prohibition on Re-Disclosure

The proposed rule further clarifies that the prohibition on re-disclosure of previously disclosed patient information only applies if the re-disclosure would directly or indirectly identify the substance abuse disorder of the patient and not other health-related conditions. Substance abuse patients often receive treatment from a Part 2 Program for substance abuse disorders as well as other unrelated health conditions, such as high blood pressure. In such example, the re-disclosure prohibition would not apply to patient information related to the high blood pressure, so long as it does not implicate disclosure of the substance abuse disorder. However, if disclosure of the origin of the information, such as the name of the treatment facility, would reveal that the patient has a substance abuse disorder then the disclosure would be prohibited.

4.  Qualified Service Organizations Exception to Consent Requirement

The current regulations authorize disclosure without consent to Qualified Service Organizations (QSOs) that provide services to a Part 2 Program. The proposed rule clarifies that population health management is a type of service that may be offered by a QSO to a Part 2 Program. Thus, Part 2 Programs may disclose patient information to a QSO for purposes of monitoring and improving health outcomes of their patient population. However, the proposed rule explicitly states that coordination of care is not a type of service that can be provided by a QSO because it includes a treatment component and therefore, would not be an appropriate reason for disclosure of patient information.

        5.  Research Disclosure Exception to Consent Requirement

The current regulations also allow patient information to be disclosed without consent for purposes of scientific research if a Part 2 Program director determines that certain requirements are met. The proposed rule further expands this exception to the consent requirement by allowing any lawful holder of patient information (and not just a Program director) to disclose the information for research purposes. Lawful holders of patient information can include third party payors. Research disclosures would be permissible if one of the three requirements is met: (1) the researcher is a HIPAA covered entity or business associate and provides documentation that he/she obtained research participants’ authorization, or a waiver of authorization, for use or disclosure of their information for research purposes consistent with the HIPAA Privacy Rule; (2) the researcher is subject to just the HHS Common Rule and provides documentation that the researcher is in compliance with the rule, including requirements relating to informed consent or a waiver of consent; or (3) the researcher is both a HIPAA covered entity or business associate and subject to the HHS Common Rule and he/she satisfies the requirements of both (1) and (2).

Share this article:
  • Benjamin P. Malerba
  • Ada Janocinska





Related Publications


Get legal updates and news delivered to your inbox