Final rule allows more sharing of substance abuse treatment information
The Substance Abuse and Mental Health Services Administration (SAMHSA) of the Department of Health and Human Services recently issued a final rule that will allow more flexibility for sharing patient records relating to substance use disorders.
The final rule amends Title 42 of the Code of Federal Regulations Part 2 (Part 2 Regulations), which governs the confidentiality of substance use disorder records and sets forth more stringent privacy protections than the HIPAA Privacy Rule. The Part 2 Regulations had not been substantively amended since 1987 and therefore did not reflect changes in health care such as the use of electronic health records and integrated care models involving the sharing of information to coordinate care. SAMHSA stated its goal with this final rule is to ensure patients with substance use disorders can benefit from new integrated health care models without fear of putting themselves at risk.
The final rule will relax patient consent standards (which under the existing Part 2 Regulations require recipients of patient information to be named in the patient’s consent) so that a patient will be allowed to consent to the disclosure of his or her information to general categories of individuals or entities who have treatment relationships with the patient. In particular, patients will be allowed to consent to the disclosure of their information to any one or more of the following:
An intermediary (e.g., an HIE, ACO or research institution) that relies on a general designation to disclose information covered under the Part 2 Regulations will be required to provide the patient with a list of disclosures that occurred during the two-year period prior to the patient’s request. The list must be provided within 30 days of the patient’s request. In addition, the consent form must inform the patient of the right to such a list of disclosures.
The final rule also sets conditions allowing expanded sharing of patient identifying information for scientific research.
Compliance with the final rule will require prompt action to update health information technology (HIT) systems, train staff and update patient consent forms. In addition, HIEs, ACOs, research institutions and other intermediary organizations that disclose information in reliance on general designations will need to establish processes to identify participants who have treating provider relationships with particular patients2, keep track of disclosures pursuant to general designations, and timely provide lists of disclosures in response to patient requests.
The final rule will be published in the Federal Register on Jan. 18, 2017, and will take effect on Feb. 17, 2017. In the meantime, the final rule is available here and SAMHSA’s press release is available here.
To learn more about the new Part 2 Regulations or other behavioral health related legal topics, such as the new mental and behavioral health care billing codes, contact one of the health care attorneys listed below.
(1) SAMHSA indicated in commentary that it would construe a general designation of “my treating providers” to be limited to current treating providers.
(2) As examples of mechanisms to determine the existence of a treating provider relationship, SAMHSA’s commentary notes that an HIE could implement a policy requiring that a recipient attest to having a treating provider relationship with the patient, or could maintain a patient portal allowing patients to designate their treating providers.
The final rule amends Title 42 of the Code of Federal Regulations Part 2 (Part 2 Regulations), which governs the confidentiality of substance use disorder records and sets forth more stringent privacy protections than the HIPAA Privacy Rule. The Part 2 Regulations had not been substantively amended since 1987 and therefore did not reflect changes in health care such as the use of electronic health records and integrated care models involving the sharing of information to coordinate care. SAMHSA stated its goal with this final rule is to ensure patients with substance use disorders can benefit from new integrated health care models without fear of putting themselves at risk.
The final rule will relax patient consent standards (which under the existing Part 2 Regulations require recipients of patient information to be named in the patient’s consent) so that a patient will be allowed to consent to the disclosure of his or her information to general categories of individuals or entities who have treatment relationships with the patient. In particular, patients will be allowed to consent to the disclosure of their information to any one or more of the following:
- A specific individual
- A specific entity that has a treating provider relationship with the patient
- A specific entity that is a third-party payer
- An intermediary entity, such as a health information exchange (HIE), accountable care organization (ACO) or research institution, provided that if the intermediary does not have a treating provider relationship with the patient and is not a third-party payer, the “To Whom” section must also identify the name of an individual participant in the intermediary, the name of an entity that is a participant in the entity and has a treating provider relationship with the patient, or a general designation of individual or entity participants who have treating provider relationships with the patient. For example, the “To Whom” section of the consent may list a specific HIE or ACO and “my current and future treating providers.”1
An intermediary (e.g., an HIE, ACO or research institution) that relies on a general designation to disclose information covered under the Part 2 Regulations will be required to provide the patient with a list of disclosures that occurred during the two-year period prior to the patient’s request. The list must be provided within 30 days of the patient’s request. In addition, the consent form must inform the patient of the right to such a list of disclosures.
The final rule also sets conditions allowing expanded sharing of patient identifying information for scientific research.
Compliance with the final rule will require prompt action to update health information technology (HIT) systems, train staff and update patient consent forms. In addition, HIEs, ACOs, research institutions and other intermediary organizations that disclose information in reliance on general designations will need to establish processes to identify participants who have treating provider relationships with particular patients2, keep track of disclosures pursuant to general designations, and timely provide lists of disclosures in response to patient requests.
The final rule will be published in the Federal Register on Jan. 18, 2017, and will take effect on Feb. 17, 2017. In the meantime, the final rule is available here and SAMHSA’s press release is available here.
To learn more about the new Part 2 Regulations or other behavioral health related legal topics, such as the new mental and behavioral health care billing codes, contact one of the health care attorneys listed below.
(1) SAMHSA indicated in commentary that it would construe a general designation of “my treating providers” to be limited to current treating providers.
(2) As examples of mechanisms to determine the existence of a treating provider relationship, SAMHSA’s commentary notes that an HIE could implement a policy requiring that a recipient attest to having a treating provider relationship with the patient, or could maintain a patient portal allowing patients to designate their treating providers.
