Substance Abuse Privacy Rules Could Be Changing

Executive Briefing | by | April 6, 2016

Monica E. Oss
Monica E. Oss

When we talk about primary care and behavioral health integration, coordinated care management, and health information exchange, one persistent problem always comes up – 42 CFR. What is 42 CFR? When executives of payers, provider organizations, or electronic health record (EHR) companies bring up “42 CFR,” they are referencing Title 42 of the Code of Federal Regulations regarding disclosure of patient information – specifically “Title 42 Part 2: Confidentiality of Alcohol and Drug Abuse Patient Records.” 42 CFR, Part 2 outlines under what limited circumstances information about a consumer’s addiction treatment may be disclosed with or without the consumer’s consent (see Code of Federal Regulations, Title 42: Public Health and Substance Abuse and Confidentiality: 42 CFR Part 2).

Strict interpretation of these regulations has long led to the exclusion of addiction treatment data from routine data exchange models – see ‘Prohibited Disclosure’ – Behavioral Health Locked Out Of HIEs. But a recent proposal by the federal Department of Health and Human Services (HHS), Substance Abuse and Mental Health Services Administration (SAMHSA) is looking to address that problem. On February 9, 2016 HHS released a proposal to modify federal privacy rules under 42 CFR, Part 2 to allow provider organizations (both specialty treatment programs and general medical providers) to share information about an individual who has been diagnosed or treated for addiction (see HHS Proposes Modifying Privacy Rules On Addiction Treatment Records).

While the proposal still maintains an existing requirement of the Health Insurance Portability and Accountability Act (HIPAA) that the individual must grant prior consent for their personal health information to be disclosed or exchanged, it would allow treatment facilities to obtain a general consent from the individual, rather than requiring the individual to specify who can receive the information. These changes to the consent requirements would affect the following fields on consent forms:

  • “To whom” — Current policy requires that the consent form list the name or title of each person who can receive the information. The revision would allow more general disclosures to a health information exchange (HIE) and “my treating providers.” The treating providers could include named professionals; a provider entity (e.g., a hospital); and payer entities.
  • “From whom” — SAMHSA proposes adding more restrictions to the “from whom” field to name the program or other lawful holder of the information permitted to make the disclosure.
  • “Amount and Kind of Information” — SAMHSA is proposing to require the consent form to explicitly describe the substance use disorder-related information to be disclosed. SAMHSA clarifies that descriptions such as “all my records” and “only my substance use disorder records my family knows about” are not sufficient descriptors.
  • In a new requirement, the consent form would contain statements that the individual understands the terms of the consent and that the individual understands his/her right to obtain the accounting information for disclosures pursuant to a general designation.

HHS is accepting comments on the rule through 5:00 p.m. on April 11, 2016 (see comments here). So far, many organizations, including Mental Health America (MHA), and The National Committee for Quality Assurance (NCQA) have voiced support of the changes:

Mental Health America (MHA) – [MHA] “announced their support for legislation in Congress that would update decades-old 42 CFR Part 2 regulations to streamline the patient consent process for sharing addiction treatment information with their healthcare providers. ‘It’s critical that these regulations be updated to permit the sharing of addiction treatment medical records, with patient consent, in new integrated care settings like Health Information Exchanges (HIEs), Accountable Care Organizations (ACOs), and Medicaid Health Homes,’” said Paul Gionfriddo, president and CEO of MHA (see 42 CFR Part 2 Updates Would Improve Access to Care Without Compromising Patient Privacy).

The National Committee for Quality Assurance (NCQA) – [The NCQA] “commends you and your staff for this proposal and strongly agrees with its intent to modernize privacy standards in a new era of high quality, integrated care. The rule will help patients with substance use disorders benefit from emerging care models that require enhanced health information exchange for better care coordination that these patients urgently need” (see Comment on FR Doc # 2016-01841).

And other organizations, such as the National Association of Medicaid Directors (NAMD), the American Hospital Association (AHA), and the Association for Behavioral Health and Wellness (ABHW) are calling for even greater changes:

National Association of Medicaid Directors (NAMD) –”The proposed rule doesn’t go nearly far enough towards making common sense changes that could improve the health care delivery for people with behavioral health needs. [We have] support for SAMHSA for addressing this long standing challenge and appreciated that they’ve taken this step, but don’t believe that it does much to actually change the system.” –Matt Salo, executive director, NAMD

American Hospital Association (AHA) – “The AHA believes that the proposed revision would not be an improvement over the current requirements as it does nothing to eliminate the barriers that significantly impede the robust sharing of patient information necessary for effective clinical integration….Instead, we urge full alignment of the Part 2 regulation with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulation as the proper and effective solution to eliminating the existing barriers to the sharing of patient information essential for care coordination…” (see Comment on FR Doc # 2016-01841).

The Association for Behavioral Health and Wellness (ABHW) – [ABHW] “is pleased to see that (SAMHSA) has recognized that the time has come to modernize Part 2; however, the proposed rule doesn’t go far enough to allow for fully integrated care. ABHW supports moving to the HIPAA standard for treatment, payment, and health care operations while at the same time protecting against unlawful  disclosure, limiting  the  sharing  of  information for  non-health care purposes, and providing meaningful enforcement penalties” (see Now Is The Time To Strengthen Protection Of Substance Use Records By Revisiting The Substance Use Privacy Law)

This is a critical issue for the success of care coordination programs and integrated behavioral health/primary care consumer service models. We’ll follow the debate and the final rule changes – and keep you posted on what they mean for consumers, professionals, and policymakers.



Support Request

Need help now?

Call our toll-free phone number 877-350-6463