Final Rule on Confidentiality of Alcohol and Drug Abuse Patient Records Issued by HHS

In February 2016, the Department of Health and Human Services released a proposed change to the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, (42 CFR Part 2) to facilitate health integration and information exchange. HHS has now finalized the Part 2 changes after a thorough evaluation of public comments, according to a recent press release from the Substance Abuse and Mental Health Services Administration (SAMHSA).

The Confidentiality of Alcohol and Drug Abuse Patient Records regulations were passed in 1975 to protect the privacy of patients receiving treatment in relation to substance abuse and mental health disorders. At the time there was some worry about the revelation of patients’ identities would have major social consequences and a lack of privacy may discourage individuals from seeking treatment.

The healthcare delivery system has changed massively during the past 40 years and Part 2 regulations were in need of being updated. While the privacy of patients must and will still be secured, the Part 2 changes will help to promote health integration and allow information exchange with research institutions.

HHS Deputy Assistant Secretary, Kana Enomoto, the Part 2 said it “will further enhance health services research, integrated treatment, quality assurance and health information exchange activities while at the same time safeguarding the essential privacy rights of people seeking treatment for substance use disorders.” Enomoto went on to explain that “These efforts clear the way for integrated health care models that can provide a better, more cost-effective health care system that also empowers people to make key decisions about their health care.”

A range of new provisions have been finalized in the HHS Final Rule including:

• Any lawful holder of patient identifying information will be allowed to disclose Part 2 identifying information to qualified individuals for purposes of scientific research, provided the research fulfils certain regulatory requirements. The sharing of data will enable groups to conduct essential research on substance use disorders. SAMHSA will also allow data linkages between data sets and data repositories holding Part 2 data, if certain regulatory requirements are in place.

• In certain instances, patients will be allowed to use general designations such as “My Treating Providers” when giving consent to share personal information. Patients are not obligated to agree to disclosures of their personal information, although by doing so they will be able to take advantage of integrated healthcare systems. If patients do use the general disclosure designation, they can ask for a list of individuals and entities with whom their information has been shared.

• Amendments have been made that outline audit/evaluation procedures necessary to meet the requirements of CMS-regulated accountable care group and other CMS-regulated groups. The changes allow financial and quality assurance functions critical to ACOs and other healthcare groups.

• Part 2 has been amended to cover physical and electronic documentation

• SAMHSA will develop more sub-regulatory guidance on the finalized provisions and will review the implementation of the Final Rule.

HHS has also released a Supplemental Notice of Proposed Rulemaking (SNPRM) and is seeking input and comments from the public on additional clarifications and suggestions on a range of new provisions including:

• Clarifying and restricting the circumstances under which contractors, subcontractors and legal representatives of lawful holders of Part 2 data can be sent information for payment and healthcare operations activities.

• An abbreviated alternative statement for the notice to accompany disclosure.

• Using contractors, sub-contractors, and legal representatives by CMS-regulated entities to complete audit and evaluation activities necessary to meet the obligations of a CMS-regulated program.