HHS Proposes Changes to Regulations Governing Confidentiality of Substance Use Disorder Patient Records

On August 22, 2019, the U.S. Department of Health and Human Services (“HHS”), Substance Abuse and Mental Health Services Administration (“SAMHSA”) proposed a number of changes to 42 CFR Part 2 (“Part 2”), which is a series of regulations that govern the confidentiality of patient records created by federally-assisted substance use disorder treatment programs. As the first part of HHS’s agency-wide regulatory reform efforts, dubbed Regulatory Sprint to Coordinated Care, the proposed changes are intended to support better care coordination by reducing regulatory burdens to accessing and recording addiction treatment information, while maintaining privacy safeguards. In addition, to help combat the nation’s opioid addiction crisis, the proposed changes seek to alleviate onerous legal requirements that discourage providers from treating substance use disorder patients.

The Part 2 regulations were promulgated in 1975, decades before the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), to protect such patients from the stigma associated with substance abuse, and, in turn, encourage them to seek treatment. The subsequent adoption of HIPAA and its regulations, followed by the rise of the opioid crisis, have highlighted the need to update the Part 2 regulations.

SAMHSA most recently amended the Part 2 regulations in 2017 and 2018, during which time it signaled its intent to continue monitoring the implementation of Part 2 and to explore further rulemaking to better address privacy and interoperability concerns. SAMHSA’s August 2019 proposed changes include the following:

1. The proposal would amend the definition of “records” that are subject to Part 2 regulations to exclude information conveyed orally by a Part 2 provider to a non-Part 2 provider for treatment purposes where the non-Part 2 provider reduces such information to writing. Accordingly, non-Part 2 providers could use such information to engage in informed independent conversations with patients, and record such information without becoming subject to the complex Part 2 regulations not otherwise applicable to such provider.
2. The proposal would allow non-Part 2 providers who from time to time manage care for patients with substance use disorders to access central registries to determine whether a patient is already receiving opioid treatment through a Part 2 provider. Similarly, the proposal would allow Part 2 providers to disclose dispensing and prescribing data, as required by applicable state law, to prescription drug monitoring programs, subject to patient consent. These proposals are intended to prevent duplicative enrollments and prescriptions related to substance use disorder treatment.
3. The proposal would allow HIPAA covered entities to disclose Part 2 patient data to individuals and organizations who are neither HIPAA covered entities nor subject to the Federal Policy for the Protection of Human Subjects (i.e., the Common Rule) for the purpose of conducting scientific research, provided that the disclosure is made in accordance with the HIPAA Privacy Rule.
4. The proposal would allow patients to consent to the disclosure of their treatment information to a wide range of entities (e.g., Social Security Administration and treatment providers) without naming the specific individual receiving the information on behalf of the given entity.
5. Related to item 4 above, the proposal would further clarify, through an illustrative list of seventeen example activities, which disclosures are permitted with a patient’s written consent for the purpose of “payment and health care operations.”

The proposed changes, however, would not amend: the basic framework of the Part 2 protections; the prohibition against law enforcement using a patient’s substance use disorder records in criminal prosecution against the patient; or, subject to limited explicit exceptions, the restriction against the disclosure of such records without patient consent.

Many providers and industry organizations, including the American Hospital Association, have called for a more comprehensive overhaul of Part 2 to align the regulations with HIPAA privacy protections. HHS Secretary Alex Azar indicated, however, that such a change would require Congressional action.[1]

Comments to the proposed changes must be received by no later than 5 p.m. EST on October 25, 2019.

The full text of the proposed rule can be found here.

[1] The Overdose Prevention and Patient Safety Act and the Protecting Jessica Grubb’s Legacy Act have been introduced in the United States House of Representatives and Senate, respectively, to align Part 2 with HIPAA.