Revisions to Federal Substance Abuse Confidentiality Regulations Improve Exchange of Medical Information, Attempt to Promote Clinical Integration

First published in 1975, 42 CFR Part 2 (Part 2) governs confidentiality and disclosures of medical records for patients of substance abuse treatment programs. The initial purpose of Part 2 was to ensure that a patient who receives treatment in a formal program for any substance use disorder is protected from the disclosure of his or her sensitive medical information.

Part 2 Regulations apply to all federally assisted alcohol and drug abuse programs.

Given that the most recent substantive updates were published in 1987, Part 2 revisions were necessary and arguably overdue to accommodate the evolving landscape of the delivery of healthcare services. The Substance Abuse and Mental Health Services Administration (SAMHSA) published the proposed revisions to Part 2 in the Federal Register on Feb. 9, 2017 (Final Rule). After a regulatory freeze following the inauguration of President Donald Trump, the effective date of the revisions was pushed to March 21, 2017.

At the risk of oversimplification, Part 2 generally requires that patient consent be obtained prior to sharing information subject to Part 2. Once information is disclosed, re-disclosure is generally not permitted without the patient’s express consent unless an exception applies. Limited exceptions to this requirement include medical emergencies, scientific research, audits and evaluations, child abuse reporting, crimes on program premises or against program personnel, disclosure pursuant to a valid court order, or communications with a qualified service organization. SAMSHA’s expressed intent of the Final Rule was to maintain the integrity and purpose of the statute and simultaneously modernize the rules to make them less burdensome on the treating provider.

Significant Changes

A primary purpose of the revisions was to allow more ease in the exchange of information among treating providers. This objective was partially addressed with changes to the patient consent form, which now allow a general designation in the “to whom” line. To facilitate this, the Final Rule defined the term “treating provider relationship” and allowed this more general designation. A “treating provider relationship” exists whether or not there has been an actual in-person encounter when a (i) patient agrees to be diagnosed, evaluated and/or treated for any condition by an individual or entity; and (ii) an individual or entity agrees to undertake diagnosis, evaluation and/or treatment of the patient, or consultation with the patient, for any condition. The existence of such relationship will permit a patient to consent to disclosures using a more general description without listing each individual specifically. A patient may also designate their treating providers by “past,” “current,” and/or “future” treating providers and carve out certain treating providers from the list if desired.

The Final Rule also revised the “medical emergency” exception to give providers more discretion to disclose information when a “bona fide emergency” exists. Currently, otherwise privileged information can only be disclosed without consent “for the purpose of treating a condition which poses an immediate threat to the health of any individual which requires immediate medical intervention.” Additional revisions include the allowance of disclosure to qualified personnel for the purpose of conducting scientific research and requirements regarding the re-disclosure of information.

Feedback

The Final Rule was met with mixed reviews. Critics shared a general concern in that the Final Rule did not do enough to fully accommodate the changing health care landscape. For example, the National Association of State Mental Health Program Directors (NASMHPD) expressed dissatisfaction with the lack of change and recommended the alignment of Part 2 protections with privacy protections under HIPAA. Additional recommendations included a push to accommodate e-prescribing and Prescription Drug Monitoring Program technologies. SAMHSA acknowledged and dismissed both comments. SAMSHA justified the lack of change catered to e-prescribing due to the state of technology and because the majority of Part 2 programs are not able to prescribe controlled substances electronically.

Practical Takeaways

To ensure compliance with the Final Rule, providers must make several immediate updates to internal policies and procedures. First, providers subject to Part 2 must update all consent forms. If the general designation is used on a consent form, the entity must also have procedures in place to determine whether the treating provider relationship exists. For example, a health information exchange could provide a patient portal that permits patients to designate treating providers as members of the patient’s treating provider team. Additional safeguards to protect patient information include the designation of the “amount and kind” of information to be disclosed with sufficient specificity. Necessary descriptors include certain medications and dosages or substance use disorder-related claims and encounter data. Second, providers must update policies and procedures which address consent procedures and physical and electronic security for records covered by Part 2. Getting up to speed with the Final Rule quickly is essential for all providers who are subject to Part 2.