Eight Things to Know About the New Federal Substance Use Disorder Privacy Rule

A final rule published on January 18 implements the first major revisions to the federal regulations governing the confidentiality of substance-use disorder patient records (Part 2) since 1987. It finalizes a proposal from last February to modernize the regulations in light of the significant changes in the health care delivery system. On the same day, the Substance Abuse and Mental Health Services Administration (SAMHSA), also issued a supplemental notice of proposed rulemaking to request comments on the disclosure of Part 2 covered data by contractors, subcontractors, and legal representatives for purposes of carrying out payment, health care operations, and other health care related activities.

The supplemental rulemaking requests comments by February 17, 2017, which is also the date the Final Rule would ordinarily be effective. However, a January 20, 2017 presidential memorandum to the heads of executive departments and agencies directs that all regulations that have not yet taken effect, if permitted by applicable law and not subject to an exception, be temporarily postponed for 60 days from January 20 “for the purpose of reviewing questions of fact, law, and policy they raise.” This directive means that the effective date for the Final Rule is delayed until at least March 21, 2017. If SAMHSA determines that the Final Rule raises “substantial questions of law or policy,” further action may be taken, potentially including delay or withdrawal of the rule or request for additional comment.

Here are eight key takeaways from the Final Rule:

1. Patient Consent Forms May Authorize a General Disclosure to Intermediate Entities Like Health Information Exchanges and Treating Providers (42 C.F.R. § 2.31(a)(4))

Part 2 requires that patient consent forms identify the recipients of confidential information. The Final Rule continues to permit consent forms to meet this requirement by authorizing disclosures to specific individuals or treating entities like hospitals or clinics; in addition, consent forms may now authorize disclosures pursuant to a general designation if certain requirements are met. For instance, the Final Rule allows a consent form to authorize disclosure to a health information exchange or other intermediate entity and “my current and future treating providers.” When this kind of general designation is used, the intermediate entity may further disclose the patient identifying information it receives only to those providers it can verify have a treating provider relationship with the patient. Further, the Final Rule entitles patients who have consented to disclose their information using a general designation to receive from the intermediate entity, upon written request, a list of entities to which their information has been disclosed within the last two years pursuant to the general designation.

2. Patient Consent Forms Must Include an Explicit Description of the Substance Use Disorder Information that May be Disclosed (42 C.F.R. § 2.31(a)(3))

The Final Rule clarifies the Part 2 requirement that consent forms must include the amount and kind of information to be disclosed by stating that there should be “an explicit description of the substance use disorder information that may be disclosed.” SAMHSA suggests that the types of information that could be specified include diagnostic information, medications and dosages, lab tests, allergies, substance use history summaries, trauma history summary elements of a medical record, employment information, living situation and social supports, and claims or encounter data. The agency also states that it is permissible for a patient to make a selection like “all my substance use disorder information” as long as the consent form accommodates more specific limitations.

3. A Qualified Services Organization May Provide Population Health Management Services (42 C.F.R. § 2.11)

In certain circumstances, Part 2 permits disclosure without patient consent to a Qualified Service Organization (QSO) that provides services to a Part 2 Program. The Final Rule clarifies that population health management is one kind of service that may be provided by a QSO. SAMHSA defines “population health management” as “increasing desired health outcomes and conditions through monitoring and identifying patients within a group.” The agency also takes the position that disclosures for population health management pursuant to a QSO agreement must be limited to the specific offices or units that are tasked with carrying out population health management for the organization. Care coordination is not considered by SAMHSA to be population health management because it includes a patient treatment component.

4. Health Care Providers Do Not Become Part 2 Programs Simply Because They Provide Screening, Brief Intervention, or Referral to Treatment (SBIRT) (42 C.F.R. § 2.11)

SAMHSA did not finalize a proposed revision to the definition of Part 2 “program.” However, the agency states in the preamble to the Final Rule that health care providers do not become a “program” simply because they provide screening, brief intervention, or referral to treatment (SBIRT) within the context of general health care. Consistent with previous guidance, SAMHSA also reiterates that “holds itself out” means “any activity that would lead one to reasonably conclude that the individual or entity provides substance use disorder diagnosis, treatment, or referral for treatment.” This includes authorization such as licensure or certification by the state or federal government to provide such services; advertisements, notices, or statements related to such services; and consultation activities related to such services.

5. The Prohibition on Re-Disclosure Applies Only to Identifying Information (42 C.F.R. § 2.32(a))

The Final Rule clarifies that the Part 2 prohibition on re-disclosure provision applies only to information that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder. Other health-related information that is unrelated to the substance abuse disorder, such as treatment for an unrelated health condition, may be re-disclosed, if permissible under the applicable law. In addition, if the origin of the data (such as a treatment clinic) would reveal that the individual has a substance abuse disorder, then the disclosure would be prohibited.

6. Confidential Information May Be Disclosed Without Consent to Meet a Bona Fide Medical Emergency (42 C.F.R. § 2.51)

The Final Rule aligns the definition of “medical emergency” with the statutory definition. The revised language states that a patient’s identifying information may be disclosed to medical personnel to the extent necessary to meet a bona fide medical emergency, in which the patient’s prior informed consent cannot be obtained. SAMHSA continues to require the Part 2 program to immediately document, in writing, specific information related to the medical emergency.

7. Part 2 Security Requirements Apply to Both Electronic and Paper Records (42 C.F.R. §§ 2.16, 2.31, 2.53)

The Final Rule incorporates electronic records in the security requirements under Part 2. Part 2 programs and other lawful holders of patient identifying information are required to have in place formal policies and procedures for the security of both paper and electronic records. Moreover, the Final Rule establishes procedures for sanitizing electronic media for handling electronic records subsequent to the discontinuation of a Part 2 program. Similarly, the electronic records are included in the exception for disclosure without consent for audit and evaluation activities.

8. Confidential Information May Be Disclosed For Scientific Research Without Patient Consent to Recipients Who Meet Relevant HIPAA and Common Rule Requirements (42 C.F.R. § 2.52)

The Final Rule liberalizes the Part 2 exception allowing patient information to be disclosed without consent for the purpose of conducting scientific research if the program director makes a determination that specified requirements have been met. It allows any individual in lawful possession of Part 2 data to disclose the information to qualified research personnel for the purpose of conducting scientific research if applicable requirements are satisfied, including privacy regulations under HIPAA and regulations for the protection of human subjects under the Common Rule. The Final Rule also addresses data linkages to enable researchers holding Part 2 data to link to federal data sets.