SAMHSA Final Rule on Confidentiality of Substance Use Disorder Patient Records
February 15, 2017
On January 18, 2017, the Substance Abuse and Mental Health Services Administration (“SAMHSA”) published a Final Rule that updates the confidentiality requirements and provisions to improve the exchange of information of patients seeking treatment for a substance abuse disorder of 42 C.F.R. Part 2 (“Part 2”). Part 2 was last updated in 1987, therefore the Final Rule largely reflects changes in the health care system from the last 30 years. The Final Rule amends fourteen major provisions of Part 2, summarized below.
1. Statutory Authority (42 C.F.R. § 2.1). The statutory authority for confidentiality of drug abuse patient records and the statutory authority for confidentiality of alcohol abuse patient records are now combined into one provision titled “Statutory authority for the confidentiality of substance abuse disorder patient records.”
2. Reports of Violations (42 C.F.R. § 2.4). Violations of opioid treatment programs (previously methadone programs) are now required to be reported to SAMHSA. Violations were previously reported to the FDA, however, the authority over opioid treatment programs was transferred to SAMHSA in 2001.
3. Definitions (42 C.F.R. § 2.11). All definitions of Part 2 are now consolidated into § 2.11, with the exception of the definition of “federally assisted,” which remains in § 2.12. Additionally, the language of some existing Part 2 definitions is updated and new definitions, including “Part 2 Program,” “Part 2 Program Director,” “Substance Use Disorder,” “Treating Provider Relationship,” and “Withdrawal Management” are added to this Section.
4. Applicability (42 C.F.R. § 2.12). Part 2 continues to apply to federally assisted programs that provide substance use disorder diagnosis, treatment, or referral for treatment. Additionally, the restrictions on disclosures now also apply to the recipients of records from other lawful holders of patient identifying information, and the records subject to Part 2 are expanded to include substance use disorder patient records maintained by Part 2 Programs, as well as records in the possession of other lawful holders of patient identifying information.
5. Confidentiality Restrictions and Safeguards (42 C.F.R. § 2.13). When a patient uses a general designation in the “To Whom” section of their consent forms (as permitted by the amended § 2.31), that patient is permitted to request, in writing, and obtain a list of entities their information has been disclosed to.
6. Security for Records (42 C.F.R. § 2.16). Part 2 Programs and other lawful holders of patient identifying information are now required to have formal policies and procedures addressing the security of both paper and electronic records. Additionally, some of the language in this Section is updated for consistency with the HIPAA Security Rule.
7. Disposition of Records by Discontinued Programs (42 C.F.R. § 2.19). This Section now addresses both paper and electronic patient records and includes a new sanitization requirement for both forms of media.
8. Notice to Patients of Federal Confidentiality Requirements (42 C.F.R. § 2.22). The Notice may be provided to patients in either paper or electronic format and must include a statement regarding the reporting of violations, along with the contact information for the appropriate authorities for reporting such violations.
9. Consent Requirements ( 42 C.F.R. § 2.31). A patient is now permitted to use a general designation in the “To Whom” section of their consent form. However, the patient must also specify the “amount and kind” of substance use disorder information that may be disclosed. Part 2 Programs or other lawful holders of patient identifying information must also include a statement on the consent form informing the patient of their right to request and obtain a list of disclosures made pursuant to a general designation in the “To Whom” section of their consent form.
10. Prohibition on Re-Disclosures (42 C.F.R. § 2.32). The prohibition on re-disclosure only applies to information that would directly or indirectly identify an individual as diagnosed, treated or referred for treatment of a substance use disorder. Additionally, information shared by a Part 2 Program may be re-disclosed if permitted under other applicable laws. Finally, SAMHSA clarifies that uses of such information for criminal prosecutions or investigations of a patient with a substance use disorder are prohibited, except as otherwise permitted under Part 2.
11. Disclosures to Prevent Multiple Enrollments (42 C.F.R. § 2.34). Updated terminology and corresponding definitions are added to this Section for consistency with the other amendments of Part 2.
12. Medical Emergencies (42 C.F.R. § 2.51). SAMHSA revised the medical emergency exception with an update to the definitions for consistency with corresponding statutory definitions. Additionally, providers now have more discretion in determining whether there is a “bona fide medical emergency.”
13. Research (42 C.F.R. § 2.52). Information protected by Part 2 may be disclosed to qualified personnel for the purposes of conducting scientific research by any individual or entity in lawful possession of such Part 2 data, so long as the researcher meets certain additional requirements. Additionally, researchers holding Part 2 data may obtain data linkages, so long as the additional required safeguards are in place.
14. Audit and Evaluation (42 C.F.R. § 2.53). CMS-regulated accountable care organizations or similar CMS regulated entities may receive Part 2 data for the purposes of conducting a required audit or evaluation, if the organization meets certain requirements.
In addition to the Final Rule, SAMHSA issued a Supplemental Proposed Rule to clarify some of the provisions of the Final Rule. The original effective date of the Final Rule was February 17, 2017 and the comment period on the Supplemental Proposed Rule was to close on the same day. However, on January 20, 2017, a Memorandum on the Regulatory Freeze ordered by President Trump was issued to all Executive Department and Agency Heads that requires regulations that have been published but not yet effective to have the effective date temporarily postponed for sixty days from January 20, 2017. It is unclear how the Regulatory Freeze will specifically impact the effective date and the comment period, however, it appears the earliest the Final Rule will go into effect is March 21, 2017. The entire Final Rule may be accessed here.
If you have any questions on the Final Rule or related compliance efforts please contact Stephanie T. Eckerle or your regular Krieg DeVault health care attorney.
Industries
February 15, 2017
On January 18, 2017, the Substance Abuse and Mental Health Services Administration (“SAMHSA”) published a Final Rule that updates the confidentiality requirements and provisions to improve the exchange of information of patients seeking treatment for a substance abuse disorder of 42 C.F.R. Part 2 (“Part 2”). Part 2 was last updated in 1987, therefore the Final Rule largely reflects changes in the health care system from the last 30 years. The Final Rule amends fourteen major provisions of Part 2, summarized below.
1. Statutory Authority (42 C.F.R. § 2.1). The statutory authority for confidentiality of drug abuse patient records and the statutory authority for confidentiality of alcohol abuse patient records are now combined into one provision titled “Statutory authority for the confidentiality of substance abuse disorder patient records.”
2. Reports of Violations (42 C.F.R. § 2.4). Violations of opioid treatment programs (previously methadone programs) are now required to be reported to SAMHSA. Violations were previously reported to the FDA, however, the authority over opioid treatment programs was transferred to SAMHSA in 2001.
3. Definitions (42 C.F.R. § 2.11). All definitions of Part 2 are now consolidated into § 2.11, with the exception of the definition of “federally assisted,” which remains in § 2.12. Additionally, the language of some existing Part 2 definitions is updated and new definitions, including “Part 2 Program,” “Part 2 Program Director,” “Substance Use Disorder,” “Treating Provider Relationship,” and “Withdrawal Management” are added to this Section.
4. Applicability (42 C.F.R. § 2.12). Part 2 continues to apply to federally assisted programs that provide substance use disorder diagnosis, treatment, or referral for treatment. Additionally, the restrictions on disclosures now also apply to the recipients of records from other lawful holders of patient identifying information, and the records subject to Part 2 are expanded to include substance use disorder patient records maintained by Part 2 Programs, as well as records in the possession of other lawful holders of patient identifying information.
5. Confidentiality Restrictions and Safeguards (42 C.F.R. § 2.13). When a patient uses a general designation in the “To Whom” section of their consent forms (as permitted by the amended § 2.31), that patient is permitted to request, in writing, and obtain a list of entities their information has been disclosed to.
6. Security for Records (42 C.F.R. § 2.16). Part 2 Programs and other lawful holders of patient identifying information are now required to have formal policies and procedures addressing the security of both paper and electronic records. Additionally, some of the language in this Section is updated for consistency with the HIPAA Security Rule.
7. Disposition of Records by Discontinued Programs (42 C.F.R. § 2.19). This Section now addresses both paper and electronic patient records and includes a new sanitization requirement for both forms of media.
8. Notice to Patients of Federal Confidentiality Requirements (42 C.F.R. § 2.22). The Notice may be provided to patients in either paper or electronic format and must include a statement regarding the reporting of violations, along with the contact information for the appropriate authorities for reporting such violations.
9. Consent Requirements ( 42 C.F.R. § 2.31). A patient is now permitted to use a general designation in the “To Whom” section of their consent form. However, the patient must also specify the “amount and kind” of substance use disorder information that may be disclosed. Part 2 Programs or other lawful holders of patient identifying information must also include a statement on the consent form informing the patient of their right to request and obtain a list of disclosures made pursuant to a general designation in the “To Whom” section of their consent form.
10. Prohibition on Re-Disclosures (42 C.F.R. § 2.32). The prohibition on re-disclosure only applies to information that would directly or indirectly identify an individual as diagnosed, treated or referred for treatment of a substance use disorder. Additionally, information shared by a Part 2 Program may be re-disclosed if permitted under other applicable laws. Finally, SAMHSA clarifies that uses of such information for criminal prosecutions or investigations of a patient with a substance use disorder are prohibited, except as otherwise permitted under Part 2.
11. Disclosures to Prevent Multiple Enrollments (42 C.F.R. § 2.34). Updated terminology and corresponding definitions are added to this Section for consistency with the other amendments of Part 2.
12. Medical Emergencies (42 C.F.R. § 2.51). SAMHSA revised the medical emergency exception with an update to the definitions for consistency with corresponding statutory definitions. Additionally, providers now have more discretion in determining whether there is a “bona fide medical emergency.”
13. Research (42 C.F.R. § 2.52). Information protected by Part 2 may be disclosed to qualified personnel for the purposes of conducting scientific research by any individual or entity in lawful possession of such Part 2 data, so long as the researcher meets certain additional requirements. Additionally, researchers holding Part 2 data may obtain data linkages, so long as the additional required safeguards are in place.
14. Audit and Evaluation (42 C.F.R. § 2.53). CMS-regulated accountable care organizations or similar CMS regulated entities may receive Part 2 data for the purposes of conducting a required audit or evaluation, if the organization meets certain requirements.
In addition to the Final Rule, SAMHSA issued a Supplemental Proposed Rule to clarify some of the provisions of the Final Rule. The original effective date of the Final Rule was February 17, 2017 and the comment period on the Supplemental Proposed Rule was to close on the same day. However, on January 20, 2017, a Memorandum on the Regulatory Freeze ordered by President Trump was issued to all Executive Department and Agency Heads that requires regulations that have been published but not yet effective to have the effective date temporarily postponed for sixty days from January 20, 2017. It is unclear how the Regulatory Freeze will specifically impact the effective date and the comment period, however, it appears the earliest the Final Rule will go into effect is March 21, 2017. The entire Final Rule may be accessed here.
If you have any questions on the Final Rule or related compliance efforts please contact Stephanie T. Eckerle or your regular Krieg DeVault health care attorney.