Confidentiality of Substance Use Disorder Patient Records: 42 CFR Part 2: Final Rule: Federal Register

2017·0.54 MB·English

6052 Federal Register/Vol. 82, No. 11/Wednesday, January 18, 2017/Rules and Regulations
DEPARTMENT OF HEALTH AND e. Withdrawal Management 3. Documentation of Medical Emergency
HUMAN SERVICES 2. Existing Definitions 4. Other Comments on Medical Emergency
a. Central Registry N. Research (§2.52)
Office of the Secretary b. Disclose or Disclosure 1. General
c. Maintenance Treatment 2. Suggestions for Improvement of the
d. Member Program Research Provisions
42 CFR Part 2
e. Patient 3. HIPAA and HHS Common Rule
[SAMHSA–4162–20] f. Patient Identifying Information Requirements
g. Person 4. Data Linkages
RIN 0930–AA21 h. Program 5. Multi-Payer Claims Database
i. Qualified Service Organization O. Audit and Evaluation (§2.53)
Confidentiality of Substance Use j. Records P. Other Public Comments on the Proposed
Disorder Patient Records k. Treatment Rule
3. Terminology Changes 1. Requests to Extend the Public Comment
AGENCY: Substance Abuse and Mental 4. Other Comments on Definitions Period
Health Services Administration, HHS. E. Applicability (§2.12) 2. Rulemaking Process
ACTION: Final rule. F. Confidentiality Restrictions and 3. Implementation Timeline and Other
Safeguards (§2.13) Barriers to Implementation
SUMMARY: The Department of Health and 1. Delayed Implementation of List of 4. Educational Opportunities
Human Services (HHS) is issuing this Disclosures Provision 5. Increased Enforcement
final rule to update and modernize the 2. Responsibilities Under the List of 6. Other Miscellaneous Comments on the
Confidentiality of Alcohol and Drug Disclosures Process Proposed Rule
3. Technological Challenges and Burden of VI. Rulemaking Analyses
Abuse Patient Records regulations and
the List of Disclosures Provision A. Paperwork Reduction Act
facilitate information exchange within 4. Recommendations to Further Protect B. Regulatory Impact Analysis
new health care models while Patient Privacy C. Regulatory Flexibility Act
addressing the legitimate privacy 5. Other Comments and Recommendations D. Unfunded Mandates Reform Act
concerns of patients seeking treatment on the List of Disclosures Provision E. Federalism (Executive Order 13132)
for a substance use disorder. These G. Security for Records (§2.16)
H. Disposition of Records by Discontinued Acronyms
modifications also help clarify the
Programs (§2.19)
regulations and reduce unnecessary ACO Accountable Care Organization
I. Notice to Patients of Federal
burden. Confidentiality Requirements (§2.22) ABAM American Board of Addiction
Medicine
DATES: Effective date: This final rule is J. Consent Requirements (§2.31) ADAMHA Alcohol, Drug Abuse and Mental
1. General Comments on Consent
effective February 17, 2017. Health Administration
Requirements
FORFURTHERINFORMATIONCONTACT: a. General APCD All Payer Claims Database
Danielle Tarino, Telephone number: b. Consent Form Validity Period ARRA American Recovery and
(240) 276–2857, Email address: c. Technical Challenges to Proposed Reinvestment Act of 2009 (Pub. L. 111–5)
ASAM American Society of Addiction
[email protected]. Consent Requirements
Medicine
SUPPLEMENTARYINFORMATION: d. Requests for Exemptions and Exceptions ATR Access to Recovery
e. Commenter Recommendations
C-CDA Consolidated-Clinical Document
Preamble Table of Contents 2. To Whom
Architecture
a. General
I. Executive Summary CCD Continuity of Care Document
b. Determination of Treating Provider
A. Purpose of the Regulatory Action CCLF Claim and Claim Line Feed
Relationship
B. Summary of the Major Provisions c. Requests for Clarification CCO Coordinated Care Organization
C. Summary of Impacts d. Commenter Recommendations CFR Code of Federal Regulations
II. Background e. Proposed Alternative Approach for ‘‘To CHIP Children’s Health Insurance Program
A. Significant Technology Changes Whom’’ Section CMS Centers for Medicare & Medicaid
B. Statutory and Rulemaking History 3. Amount and Kind Services
III. Overview of the Final Rule a. General CPCMH Certified Patient-Centered Medical
IV. Effective Date b. Impact of the Amount and Kind Home
V. Discussion of Public Comments and Final Requirement on Providers and Patients DS4P Data Segmentation for Privacy
Modifications to 42 CFR part 2 c. Required Substance Use Disorder EHR Electronic Health Record
A. General Comments on the Proposed Information on Consent Forms EQRO External Quality Review
Rule d. Requests for Clarification Organization
1. General Feedback on the Proposed Rule 4. From Whom FAQ Frequently Asked Question
a. General Support for the Proposed Rule 5. New Requirements FAX Facsimile
b. General Opposition to the Proposed Rule K. Prohibition on Re-Disclosure (§2.32) FDA Food and Drug Administration
2. The Proposed Rule Did Not Go Far 1. General FR Federal Register
Enough To Facilitate Information 2. Impact of Re-Disclosure Prohibition on HHS Department of Health and Human
Exchange Patient Privacy and Patient Choice Services
3. Final Rule Should Balance Patient 3. Disclosure of Information that May HIE Health Information Exchange
Protections With Enhanced Information Indicate a Substance Use Disorder HIO Health Information Organization
Exchange 4. Technical Challenges in Preventing HIPAA Health Insurance Portability and
4. Part 2 Should Align With the Health Unauthorized Re-Disclosure Accountability Act of 1996 (Pub. L. 104–
Insurance Portability and Accountability 5. Requests for Clarification of the Re- 191)
Act Disclosure Prohibition HITECH Health Information Technology for
ES6 B. Statutory Authority (§2.1) 6. Recommendations to Improve the Economic and Clinical Health Act of 2009
RUL C. Reports of Violations (§2.4) Prohibition on Re-Disclosure (Pub. L. 111–5, title XIII of division A and
with D. Definitions (§2.11) L. Disclosures to Prevent Multiple title IV of division B)
D 1. New Definitions Enrollments (§2.34) HITPC Health Information Technology
O
PR a. Part 2 Program M. Medical Emergencies (§2.51) Privacy Committee
T082 b. Part 2 Program Director 1. General IG Implementation Guide
G9 c. Substance Use Disorder 2. Definition of ‘‘Bona Fide Medical IRB Institutional Review Board
SK3 d. Treating Provider Relationship Emergency’’ IT Information Technology
D
mstockstill on VerDate Sep<11>2014 22:14 Jan 17, 2017 Jkt 241001 PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E:\FR\FM\18JAR6.SGM 18JAR6
Federal Register/Vol. 82, No. 11/Wednesday, January 18, 2017/Rules and Regulations 6053
MCO Managed Care Organization within the U.S. health care system that 2.2 into §2.1, we redesignated §§2.2
MPCD Multi-Payer Claims Database were not envisioned by the current through 2.5 accordingly.
NCQA National Committee for Quality (1987) regulations, including new Reports of violations (§2.4) revises
Assurance models of integrated care that are built the requirement for reporting violations
NPRM Notice of Proposed Rulemaking
on a foundation of information sharing of these regulations by methadone
N-SSATS National Survey of Substance
to support coordination of patient care, programs (now referred to as opioid
Abuse Treatment Services
OHRP Office for Human Research the development of an electronic treatment programs) to the Food and
Protections infrastructure for managing and Drug Administration (FDA) because the
OMB Office of Management and Budget exchanging patient information, and a authority over these programs was
ONC Office of the National Coordinator for new focus on performance measurement transferred from the FDA to the
Health Information Technology within the health care system. SAMHSA Substance Abuse and Mental Health
PDMP Prescription Drug Monitoring wants to ensure that patients with Services Administration (SAMHSA) in
Program substance use disorders have the ability 2001.
PPS Performing Provider System to participate in, and benefit from health Definitions (§2.11) revises some
QE Qualified Entity system delivery improvements, existing definitions, adds new
QSO Qualified Service Organization
QSOA Qualified Service Organization including from new integrated health definitions of key terms that apply to 42
CFR part 2, and consolidates all but one
Agreement care models while providing
of the definitions that are currently in
RFA Regulatory Flexibility Act appropriate privacy safeguards. These
other sections into §2.11 (e.g., the
RHIO Regional Health Information new integrated models are foundational
Organization to HHS’s delivery system reform goals of definition of ‘‘Minor’’ previously found
SAMHSA Substance Abuse and Mental better care, smarter spending, and in §2.14(a)). We revised the definitions
Health Services Administration of ‘‘Central registry,’’ ‘‘Disclose or
healthier people.
SBIRT Screening, Brief Intervention, and disclosure,’’ ‘‘Maintenance treatment,’’
Referrals for Treatment Legal Authority for Regulatory Action ‘‘Member program,’’ ‘‘Patient,’’ ‘‘Patient
S&I Standards and Interoperability identifying information,’’ ‘‘Person,’’
TEDS Treatment Episode Data Set This final rule revises 42 CFR part 2,
‘‘Program,’’ ‘‘Qualified service
U.S.C. United States Code Confidentiality of Alcohol and Drug
organization (QSO),’’ ‘‘Records,’’ and
USAO United States Attorney’s Office Abuse Patient Records regulations. The
‘‘Treatment.’’ We also added definitions
VA Department of Veterans Affairs authorizing statute, Title 42, United
of ‘‘Part 2 program,’’ ‘‘Part 2 program
States Code (U.S.C.) 290dd–2, protects
I. Executive Summary director,’’ ‘‘Substance use disorder,’’
the confidentiality of the records
‘‘Treating provider relationship,’’ and
A. Purpose of the Regulatory Action containing the identity, diagnosis,
‘‘Withdrawal management,’’ some of
The laws and regulations governing prognosis, or treatment of any patient which replaced existing definitions. In
the confidentiality of substance use that are maintained in connection with addition, SAMHSA revised the
disorder records were written out of the performance of any federally regulatory text to use terminology in a
great concern about the potential use of assisted program or activity relating to consistent manner. The following
substance use disorder information substance abuse (now referred to as definitions were not revised
against individuals, causing individuals substance use disorder) education, substantively: ‘‘Diagnosis,’’
with substance use disorders not to seek prevention, training, treatment, ‘‘Informant,’’ ‘‘Minor,’’ ‘‘Third-party
needed treatment. The disclosure of rehabilitation, or research. Title 42 of payer,’’ and ‘‘Undercover agent.’’
records of individuals with substance the CFR part 2 was first promulgated in Applicability (§2.12) continues to
use disorders has the potential to lead 1975 (40 FR 27802) and last apply the 42 CFR part 2 regulations to
to a host of negative consequences, substantively updated in 1987 (52 FR a program that is federally assisted and
including: Loss of employment, loss of 21796). holds itself out as providing, and
housing, loss of child custody, B. Summary of the Major Provisions provides, substance use disorder
discrimination by medical professionals diagnosis, treatment, or referral for
and insurers, arrest, prosecution, and Proposed modifications to 42 CFR treatment. Most changes to the
incarceration. The purpose of the part 2 were published as a Notice of applicability of the part 2 regulations
regulations at title 42 of the Code of Proposed Rulemaking (NPRM) on result from SAMHSA’s decision not to
Federal Regulations (CFR) part 2 (42 February 9, 2016 (81 FR 6988). After finalize one of its proposed changes to
CFR part 2) is to ensure that a patient consideration of the public comments the definition of ‘‘Program’’ (see §2.11,
receiving treatment for a substance use received in response to the NPRM, Definitions). Whereas the NPRM
disorder in a part 2 program is not made SAMHSA is issuing this final rule definition of ‘‘Program’’ included, under
more vulnerable by reason of the amending 14 major provisions of 42 certain conditions, ‘‘general medical
availability of their patient record than CFR part 2, as follows: practices’’ in addition to ‘‘general
an individual with a substance use Statutory authority for confidentiality medical facilities,’’ the definition in this
disorder who does not seek treatment. of substance use disorder patient final rule is limited to ‘‘general medical
Now, more than 29 years since the part records (§2.1) combines old §2.1 facilities.’’ However, consistent with the
2 regulations were last substantively (Statutory authority for confidentiality NPRM, the definition of ‘‘Program’’
amended, this final rule makes policy of drug abuse patient records), and §2.2 continues to use the term ‘‘general
changes to the regulations to better align (Statutory authority for confidentiality medical facility’’ rather than both
S6 them with advances in the U.S. health of alcohol abuse patient records) and ‘‘general medical facility’’ and ‘‘general
ULE care delivery system while retaining deleting references to 42 U.S.C. 290ee– medical care facility’’ that were used
with R important privacy protections. 3U .aSn.dC .4 s2e cUti.Son.Cs. w29e0red dom–3i,t taesd t hbyes Peu blic idnetfeirncihtiaonng oefa b‘‘lPyr oing rtahme .1’’9 F8o7r f einxaalm rpullee,
ROD Need for Regulatory Action Law 102–321 and combined and an identified unit within a general
P
G9T082 regTuhlea tliaosnt ss uwbasst ainn t1iv9e8 7u.p Odvaeter ttoh eth laesste 29 rCeonnafmideedn tiinatloit Sy eocft iroenco 2r9d0sd. Bde–c2a, use mhoelddisc iatls efalfc ioluitty a iss psurobvjeidcti ntog ,p aanrdt 2 if it
K3 years, significant changes have occurred SAMHSA combined former §§2.1 and provides, substance use disorder
S
D
mstockstill on VerDate Sep<11>2014 22:14 Jan 17, 2017 Jkt 241001 PO 00000 Frm 00003 Fmt 4701 Sfmt 4700 E:\FR\FM\18JAR6.SGM 18JAR6
6054 Federal Register/Vol. 82, No. 11/Wednesday, January 18, 2017/Rules and Regulations
diagnosis, treatment, or referral for lawful holder of patient identifying addressed in this final rule nor were
treatment. In addition, if the primary information to include a statement on they discussed in the NPRM because
function of medical personnel or other the consent form when using a general SAMHSA is maintaining their content
staff in a general medical facility is the designation in the ‘‘To Whom’’ section substantively unchanged from the 1987
provision of such services and they are of the consent form that patients have a final rule.
identified as providing such services, right to obtain, upon request, a list of
C. Summary of Impacts
they are considered a ‘‘Program’’ and, entities to which their information has
thus, subject to part 2. This final rule been disclosed pursuant to the general In the first year that the final rule is
revises §2.12(d)(2)(i)(C) so that designation (see §2.13). In addition, in effect, we estimate that the total costs
restrictions on disclosures also apply to SAMHSA revised §2.31 to permit associated with updates to 42 CFR part
individuals or entities who receive electronic signatures to the extent that 2 will be roughly $70,691,000. In year
patient records from other lawful they are not prohibited by any two we estimate that costs will be
holders of patient identifying applicable law. $17,680,000, and increase annually as a
information, such that patient records In Section K., Prohibition on Re- larger share of entities implement List of
subject to the part 2 regulations include disclosure (§2.32), SAMHSA clarifies Disclosures requirements and respond
substance use disorder records that the prohibition on re-disclosure to disclosure requests. Over the 10-year
maintained by part 2 programs, as well only applies to information that would period of 2016–2025, the total
as those records in the possession of identify, directly or indirectly, an undiscounted cost of the part 2 changes
‘‘other lawful holders of patient individual as having been diagnosed, will be about $241 million in 2016
identifying information.’’ treated, or referred for treatment for a dollars. When future costs are
Confidentiality restrictions and substance use disorder, such as discounted at 3 percent or 7 percent per
safeguards (§2.13) adds a requirement indicated through standard medical year, the total costs become
that, upon request, patients who have codes, descriptive language, or both, approximately $217,586,000 or
included a general designation in the and allows other health-related $193,098,000, respectively. These costs
‘‘To Whom’’ section of their consent information shared by the part 2 are presented in the tables below.
form (see §2.31) must be provided a list program to be re-disclosed, if Costs associated with the 42 CFR part
of entities (referred to as a List of permissible under other applicable 2 final rule, include: updates to health
Disclosures) to which their information laws. IT system costs, costs for staff training
has been disclosed pursuant to the Disclosures to prevent multiple and updates to training curricula, costs
general designation. enrollments (§2.34) modernizes the to update patient consent forms, costs
Security for records (§2.16) clarifies terminology and definitions and moves associated with providing patients a list
that this section requires both part 2 the definitions to §2.11 (Definitions). of entities to which their information
programs and other lawful holders of Medical emergencies (§2.51) revises has been disclosed pursuant to a general
patient identifying information to have the medical emergency exception to designation on the consent form (i.e.,
in place formal policies and procedures make it consistent with the statutory the List of Disclosures requirement), and
addressing security, including language and to give providers more implementation costs associated with
sanitization of associated media, for discretion to determine when a ‘‘bona the List of Disclosures requirements. We
both paper and electronic records. fide medical emergency’’ exists. assumed that costs associated with
Disposition of records by Research (§2.52) revises the research modifications to existing health IT
discontinued programs (§2.19) exception to permit data protected by 42 systems, staff training costs associated
addresses both paper and electronic CFR part 2 to be disclosed to qualified with updating staff training materials,
records. SAMHSA also added personnel for the purpose of conducting and costs to update consent forms will
requirements for sanitizing associated scientific research by a part 2 program be one-time costs the first year the final
media. or any other individual or entity that is rule is in effect and will not carry
In Section I., Notice to Patients of in lawful possession of part 2 data if the forward into future years. Staff training
Federal Confidentiality Requirements researcher provides documentation of costs other than those associated with
(§2.22), SAMHSA clarifies that the meeting certain requirements related to updating training materials are assumed
written summary of federal law and other existing protections for human to be ongoing annual costs to part 2
regulations may be provided to patients research. SAMHSA also revised §2.52 programs, also beginning in the first
in either paper or electronic format. to address data linkages to enable year that the final rule is in effect. The
SAMHSA also revised §2.22 to require researchers holding part 2 data to obtain List of Disclosures costs are assumed to
the statement regarding the reporting of linkages to other datasets, provided that be ongoing annual costs to entities
violations include contact information appropriate safeguards are in place as named on a consent form that disclose
for the appropriate authorities. outlined in section 2.52. patient identifying information to their
Consent requirements (§2.31) Audit and evaluation (§2.53) participants under the general
permits, in certain circumstances, a modernizes the requirements to include designation. Costs associated with the
patient to include a general designation provisions governing both paper and List of Disclosures provision are limited
in the ‘‘To Whom’’ section of the electronic patient records. SAMHSA to implementation costs for entities that
consent form, in conjunction with also revised §2.53 to permit an audit or chose to upgrade their health IT systems
requirements that the consent form evaluation necessary to meet the in order to comply with the List of
include an explicit description of the requirements of a Centers for Medicare Disclosures requirements. Several
S6 amount and kind of substance use & Medicaid Services (CMS)-regulated provisions in the final rule reference
ULE disorder treatment information that may accountable care organization (CMS- other lawful holders of patient
D with R bfien adliiszcel oitsse dp.r oSpAoMseHdS cAh adnegceisd etod tnhoet to rreegguullaatteedd AorCgOan) iozra tsiiomni (lianr cCluMdSin- g a iwdietnht pifayritn 2g pinrfoogrrmamatsi.o Tn hines ceo omthbeinr ation
RO ‘‘From Whom’’ section, but did make CMS-regulated Qualified Entity (QE)), lawful holders must comply with part 2
P
G9T082 mtexint.o Sr AupMdHatSeAs taol stoh er etveirsmedin §ol2o.g3y1 itno the unTdheer coethrteari nse ccotniodnisti ionn s4.2 CFR part 2 rineqfourimreamtieonnt sth weiyt hm raeisnpteacint ttoh at is
K3 require the part 2 program or other that are not referenced above are not covered by part 2 regulations. However,
S
D
mstockstill on VerDate Sep<11>2014 22:14 Jan 17, 2017 Jkt 241001 PO 00000 Frm 00004 Fmt 4701 Sfmt 4700 E:\FR\FM\18JAR6.SGM 18JAR6
Federal Register/Vol. 82, No. 11/Wednesday, January 18, 2017/Rules and Regulations 6055
because this group is not clearly defined to eligible providers for the adoption Reorganization Act), Public Law 102–
with respect to the range of and meaningful use of certified EHR 321 (July 10, 1992). The regulations
organizations it may include, we are technology; and numerous other federal were promulgated as a final rule on July
unable to include estimates regarding agencies’ programs—all of which served 1, 1975 (40 FR 27802). In 1980, the
the number and type of these the objective of ensuring patient health Department invited public comment on
organizations and are only including information is secure, private, accurate, 15 substantive issues arising out of its
part 2 programs in this analysis. and available where and when needed. experience interpreting and
The benefits of modernizing the part SAMHSA’s role in encouraging the use implementing the regulations (45 FR
2 regulations is to increase of health IT by behavioral health 53). More than 450 public responses to
opportunities for individuals with (substance use disorder and mental that invitation were received and taken
substance use disorders to participate in health) providers, included: (1) into consideration in the preparation of
new and emerging health and health Collaborating with ONC to develop two a 1983 NPRM (48 FR 38758).
care models and health information sets of Frequently Asked Questions Approximately 150 comments were
technology (IT). The final rule will (FAQs) and convening a number of received in response to the NPRM and
facilitate the sharing of information stakeholder meetings to provide were taken into consideration in the
within the health care system to support guidance on the application of 42 CFR preparation of the final rule released on
new models of integrated health care part 2 to HIE models; (2) a one-year pilot June 9, 1987 (52 FR 21798).
which, among other things, improve project with five state HIEs to support The Department published an NPRM
patient safety while maintaining or the exchange of health information again in the Federal Register (FR) on
strengthening privacy protections for among behavioral health and physical August 18, 1994 (59 FR 42561), which
individuals seeking treatment for health providers; and (3) the Data proposed a clarification of the definition
substance use disorders. Moreover, as Segmentation for Privacy (DS4P) of ‘‘Program’’ in the regulations.
patients are allowed, in certain initiative within ONC’s Standards and Specifically, the Department proposed
circumstances, to include a general Interoperability (S&I) Framework to clarify that, as to general medical care
designation in the ‘‘To Whom’’ section facilitated: facilities, these regulations cover only
of the consent form, we anticipate there • The development of standards to specialized individuals or units in such
will be more individuals with substance improve the interoperability of EHRs facilities that hold themselves out as
use disorders participating in containing sensitive information that providing and provide alcohol or drug
organizations that facilitate the must be protected to a greater degree abuse (now referred to as substance use
exchange of health information (e.g., than other health information due to 42 disorder) diagnosis, treatment, or
health information exchanges (HIEs)) CFR part 2 and similar state laws, referral for treatment and which are
• six DS4P Implementation Guide federally assisted, directly or indirectly.
and organizations that coordinate care
(IG) use case pilot projects including the On May 5, 1995, the final rule was
(e.g., ACOs and coordinated care
Department of Veterans Affairs (VA)/ released (60 FR 22296).
organizations (CCOs)), leading to
SAMHSA Pilot that implemented all the SAMHSA posted a document in the
increased efficiency and quality in the
DS4P use cases and passed all FR on May 12, 2014, (79 FR 26929)
provision of health care for this
conformance tests, and announcing a public Listening Session
population. In addition, the revisions to
• the development of the application planned for June 11, 2014, to solicit
the research provision (§2.52) will
branded Consent2Share, an open-source feedback on the Confidentiality of
allow additional scientific research to be
health IT solution based on DS4P which Alcohol and Drug Abuse Patient
conducted that will facilitate continual
assists in consent management and data Records regulations, 42 CFR part 2.
quality improvement of part 2 programs
segmentation. Consent2Share is SAMHSA accepted written comments
and the important services they offer.
currently being used by the Prince until June 25, 2014. The Listening
II. Background Georges County (Maryland) Health Session comments are posted on the
Department to manage patient consent SAMHSA Web site at http://
A. Significant Technology Changes
directives while sharing substance use www.samhsa.gov/about-us/who-we-are/
Since the promulgation of 42 CFR part disorder information with an HIE. laws-regulations/public-comments-
2, significant technology changes have Despite SAMHSA’s efforts, some confidentiality-regulations.
impacted the delivery of health care. stakeholders continued to request Prompted by the need to update and
The Office of the National Coordinator modernization of 42 CFR part 2 out of modernize the Confidentiality of
for Health Information Technology concern that part 2, as written in the Alcohol and Drug Abuse Patient
(ONC) was established as an office current (1987) regulation, continues to Records regulations at 42 CFR part 2, on
within HHS under Executive Order be a barrier to the integration of February 9, 2016, SAMHSA published
13335 on April 27, 2004. Subsequently, substance use disorder treatment and an NPRM that proposed revisions to the
on February 17, 2009, the Health physical health care. As noted below, part 2 regulations and requested public
Information Technology for Economic SAMHSA plans to release shortly an input on the proposed changes during a
and Clinical Health Act (HITECH Act) of updated version of Consent2Share with 60-day public comment period (81 FR
the American Recovery and improved functionality and ability to 6988). Although raised in the Listening
Reinvestment Act of 2009 (ARRA) (Pub. meet List of Disclosures requirements. Session public comments, SAMHSA
L. 111–5) expanded the Department’s decided not to address issues pertaining
B. Statutory and Rulemaking History
health IT work, including the expansion to e-prescribing and Prescription Drug
of ONC’s authority and the provision of The Confidentiality of Alcohol and Monitoring Programs (PDMPs) in the
S6
E federal funds for ONC’s activities Drug Abuse Patient Records regulations, NPRM because they were not ripe for
UL
R consistent with the development of a 42 CFR part 2, implement Section 543 rulemaking at the time due to the state
with nationwide health IT infrastructure. of the Public Health Service Act, 42 of technology and because the majority
D
RO This work included the certification of U.S.C. 290dd–2, as amended by Section of part 2 programs are not prescribing
P
G9T082 hEeleacltthro InTi;c tHhee aaluthth Roericzoartdio (nE HofR C) MS’ 1M3e1n otaf lt hHee aAlltcho Ahodlm, Dinriusgtr Aatbiouns e and cnoontetrdo ilnle tdh seu NbPstRaMnc,e Ss AelMecHtrSoAn iicnatlelny.d As s
K3 Incentive Program, including payments Reorganization Act (ADAMHA to monitor developments in this area to
S
D
mstockstill on VerDate Sep<11>2014 22:14 Jan 17, 2017 Jkt 241001 PO 00000 Frm 00005 Fmt 4701 Sfmt 4700 E:\FR\FM\18JAR6.SGM 18JAR6
6056 Federal Register/Vol. 82, No. 11/Wednesday, January 18, 2017/Rules and Regulations
see whether further action may be how lawful holders, including third- proposed to avoid confusion. However,
warranted in the future. SAMHSA party payers and others within the signed consent forms in place prior to
received 376 public comment healthcare industry, use health data or the effective date of this final rule will
submissions on the part 2 NPRM. The hire others to use health data on their be valid until they expire. Nonetheless,
comments received were detailed, behalf to provide operational services part 2 programs may update signed
thoughtful, and reflective of the such as independent auditing, legal consent forms consistent with the final
complex issues addressed and balanced services, claims processing, plan pricing rule, prior to the effective date of the
in the part 2 regulations. This final rule and other functions that are key to the final rule if they so choose. Consents
reflects SAMHSA’s thorough day-to-day operation of entities subject obtained after the effective date will
consideration of all substantive issues to this rule. We have previously need to comply with the final rule,
raised in the public comments in clarified in responses to particular regardless of whether the consents
response to its proposals in the NPRM. questions that contracted agents of involve patient identifying information
individuals and/or entities may be obtained prior to or after the effective
III. Overview of the Final Rule
treated as the individual/entity. date of this final rule.
In this final rule, the Department Questions raised by commenters during
Public Comments
finalizes the modifications to the this rulemaking have, however,
Confidentiality of Alcohol and Drug highlighted varying interpretations of One commenter urged that the final
Abuse Patient Records, 42 CFR part 2, the current (1987) rule’s restrictions on rule allow for implementation of the
including renaming it ‘‘Confidentiality lawful holders and their contractors’ research provision (§2.52) immediately
of Substance Use Disorder Patient and subcontractors’ use and disclosure or shortly after the rule takes effect.
Records.’’ The modifications modernize of part 2-covered data for purposes of Several commenters raised concerns
the rule by facilitating electronic carrying out payment, health care about how to interpret the two-year
exchange of substance use disorder operations, and other health care related delayed implementation of List of
information for treatment and other activities. In consideration of this Disclosures and whether the general
legitimate health care purposes while feedback and given the critical role that designation will be used during that
ensuring appropriate confidentiality third-party payers, other lawful holders, period.
protections for records that might and their contractors and subcontractors
SAMHSA Response
identify an individual, directly or play in the provision of health care
indirectly, as having or having had a services, SAMHSA is issuing a SAMHSA acknowledges commenters’
substance use disorder. supplemental notice of proposed confusion regarding the proposed two-
year delayed compliance date for the
rulemaking (SNPRM) to seek further
Overview of Public Comments
List of Disclosures requirements. After
comments and information on this
We received 376 public comments considering the public comments
matter.
from medical health care providers; received on this point, SAMHSA
behavioral health care providers; IV. Effective Date realized that such a two-year delayed
combined medical/behavioral health In this final rule, SAMHSA has compliance date for the requirements of
care providers; HIEs, ACOs, CCOs, and established a single effective date of 30 §2.13(d) is not helpful. As explained in
certified patient-centered medical days after the publication of the final the ‘‘To Whom’’ section of the part 2-
homes (CPCMHs), sometimes called rule, or February 17, 2017. On this date, compliant consent requirements (see
health homes; third-party payers; the revised 42 CFR part 2 will replace Section V.J.2 below), an entity that
privacy/consumer advocates; medical the 1987 version of part 2 in the CFR serves as an intermediary (e.g., HIE,
health care provider associations; and all part 2 programs and other lawful ACO, CCO) must comply with the List
behavioral health care provider holders of patient identifying of Disclosures provision in order to
associations; accrediting organizations; information must comply with all disclose information pursuant to a
researchers; individuals (with no stated aspects of the regulations. In the NPRM, general designation provided on the
affiliation); attorneys (with no stated SAMHSA proposed that, with the consent form (see
affiliation); HIT vendors; and state/local exception of §2.13(d), part 2 programs §2.31(a)(4)(iii)(B)(3)(i)). Therefore, an
governments. The comments ranged and other lawful holders of patient entity that serves as an intermediary
from general support or opposition to identifying information would have to would be prohibited from electing to
the proposed provisions to very specific comply with applicable requirements of disclose information pursuant to a
questions or comments regarding the the revised part 2 regulations beginning general designation without the ability
proposed rules. 30 days after the publication of the final to comply with the List of Disclosures
Some comments were outside the rule. See Section V.D.3 below for a requirement. It would not make sense to
scope of or inconsistent with discussion of ‘‘other lawful holders.’’ implement a two-year delayed
SAMHSA’s legal authority regarding the We proposed that entities would not compliance date for the List of
confidentiality of substance use disorder have to comply with the List of Disclosures requirements at §2.13(d)
patient records. Likewise, other Disclosures requirements of §2.13(d) because the only reason an entity that
comments did not pertain to specific until two-years after the effective date of serves as an intermediary would have to
proposals made by SAMHSA in the the final rule. As explained below, comply with the List of Disclosures
NPRM. In some instances, commenters because the right to obtain, upon requirements would be if they wanted to
raised policy or operational issues that request, a List of Disclosures is only disclose information pursuant to general
S6 are best addressed through available to patients who use a general designations that have been included in
ULE subregulatory guidance that SAMHSA designation in the ‘‘To Whom’’ section the ‘‘To Whom’’ section of the patient
D with R wfinilall c rounlesi. dCeorn issesuquinegn tsluyb, sSeAquMeHntS tAo dthidis ohfa vthee t hcoe ntesecnhtn fiocarml c,a epnatbitiileitsy m tou sptr oonvildy e cpoantiseenntst ftoor tmh,e wfahcitc thh aret qthueirye sh aavleer tai nrigg ht
RO not address these comments in this final the List of Disclosures if they take to request a list of entities to which their
P
G9T082 rulCeo. mmenters have also provided apdrovvainstiaogne. oTfh tehree fgoernee, rSaAl MdeHsiSgAna htiaosn i§n2fo.1r3m(dat)i)o. Tn hhuass, baene enn dtiitsyc ltohsaetd s e(prveer s as
K3 SAMHSA with informative feedback on revised the effective date from that an intermediary is prohibited from
S
D
mstockstill on VerDate Sep<11>2014 22:14 Jan 17, 2017 Jkt 241001 PO 00000 Frm 00006 Fmt 4701 Sfmt 4700 E:\FR\FM\18JAR6.SGM 18JAR6
Federal Register/Vol. 82, No. 11/Wednesday, January 18, 2017/Rules and Regulations 6057
disclosing information pursuant to a A. General Comments on the Proposed enhanced health information exchange
general designation without having the Rule for better care coordination (e.g.,
capability to comply with the List of CPCMHs, ACOs).
1. General Feedback on the Proposed
Disclosures requirements. For these
Rule SAMHSA Response
reasons, it is not advisable to include a
two-year delayed compliance date for a. General Support for the Proposed SAMHSA appreciates the support for
Rule updating the regulations. This final rule
the List of Disclosures provision. Some
is intended to modernize the part 2
entities that serve as intermediaries as Public Comments
regulations by facilitating the electronic
described by §2.31(a)(4)(iii)(B) may Many commenters expressed general
exchange of substance use disorder
elect never to disclose information support for the proposed rule, with
information for treatment and other
pursuant to a general designation and, some noting that the proposed rule
legitimate health care purposes while
thus, would not need to comply with would preserve the confidentiality
ensuring appropriate confidentiality
the List of Disclosures requirement. rights of substance use disorder patients
protections for records that might
Those that choose to disclose while facilitating the sharing of health
identify an individual, directly or
information pursuant to general information; would ensure that patients
indirectly, as having or having had a
designations must ensure the capability with a substance use disorder
substance use disorder. Many new
to comply with the List of Disclosures participate in, and benefit from, new integrated care models rely on
requirements at §2.13(d) before they integrated health care models without interoperable health IT and these
disclose the information pursuant to a fear of putting themselves at risk of proposed changes are expected to
adverse consequences; would help
general designation. But there is no support the integration of substance use
reduce the stigma associated with
timeframe in which they need to disorder treatment into primary and
substance use disorder; and would
comply; only the condition that if they other specialty care, improving the
provide patients comfort in knowing
choose to have the option of disclosing patient experience, clinical outcomes,
they have control of their record.
information pursuant to a general and patient safety while at the same
Several commenters expressed
designation on a consent form, they time ensuring patient choice,
general support for the NPRM’s
must also be capable of providing a List confidentiality, and privacy. Due to its
proposed part 2 changes to enhance
of Disclosures upon request per targeted population, part 2 provides
integrated care and information
§2.13(d). exchange. Multiple commenters, with more stringent federal protections than
most other health privacy laws,
Regarding the suggestion to allow for some stressing the need for patient
including HIPAA.
implementation of the Research privacy protections, suggested that
provision §2.52 immediately after the integrated networks of care between b. General Opposition to the Proposed
final rule takes effect, SAMHSA medical and behavioral health services Rule
declines to make this change. For clarity is current best practice and will benefit Public Comments
regarding part 2 compliance, the 1987 patients. Two commenters implied
part 2 final rule remains in effect until general support. The first of these two Some commenters expressed general
commenters stated that the current opposition to the proposed rule, with
the effective date for the 2016 part 2
practice of keeping paper substance use some arguing that it would eliminate the
regulations established in this final rule.
records separate from the EHR system right of patients to protect and control
Because of the revised definitions that
increases work required to maintain personal health information; would
impact the research provision, it would
records, creates redundancies, and introduce complexity, not
create unnecessary confusion to make
could contribute to providers missing simplification; and would maintain the
effective §2.52 before the rest of the
critical information needed for treating stigma surrounding drug use. One
final rule. patients. The second commenter stated commenter warned the proposed rule
V. Discussion of Public Comments and that the current (1987) part 2 regulations would create concessions to
Final Modifications to 42 CFR Part 2 are out of step with the health care institutional stakeholders, both
system’s rapid adoption of EHRs, its providers and researchers, who find the
In this section of the final rule, capacity to quickly exchange consent requirements inconvenient and
SAMHSA explains the finalized information (e.g., HIEs), the federal burdensome.
revisions to the part 2 regulations and privacy and security regulations (Health Many commenters requested that part
responds to public comments received. Insurance and Portability and 2 remain unchanged, with some stating
If a part 2 CFR section is not addressed Accountability Act [HIPAA] and that loosening part 2 regulations would
below, it is because SAMHSA did not HITECH) governing these EHRs and dissuade substance use disorder
propose changes to that part 2 provision exchanges, and the increasing treatment patients from seeking help out of fear of
and that this final rule maintains the of patients’ substance use in health care how their information could be used
existing language in that section. systems not covered by existing part 2 against them or that the proposed
However, SAMHSA notes that in regulations, but by HIPAA. regulations would not offer the intended
Another commenter expressed protection.
addition to the revisions discussed
support for the facilitation of electronic Some commenters asserted that
below, SAMHSA has made other
exchange of substance use disorder maintaining a separate set of
technical, non-substantive, and
S6 nomenclature changes to various part 2 treatment information where the confidentiality restrictions aimed solely
ULE provisions. Those changes are reflected confidentiality protections historically at substance use disorder providers and
ROD with R irnu lteh. e regulatory text at the end of this amffaAoirn fdteaewidn cpeodamt. iemnetns tbeyr sp satratt e2d a rthe at the paasnastdoi ecunilattsitme pdae wtrepiletyht un saeutgebasst titavhneelc yde i iusmcsrepi amdciitsnso artdioern
P
G9T082 psurobpstoasnacle w uosuel ddi hsoerldpe pras tbieenntesf iwt iftrho m psuagtigeensttsi nagn dth taht ei scsaurees t hofe ysu rbescteainvcee, use
K3 emerging care models that require disorder information confidentiality
S
D
mstockstill on VerDate Sep<11>2014 22:14 Jan 17, 2017 Jkt 241001 PO 00000 Frm 00007 Fmt 4701 Sfmt 4700 E:\FR\FM\18JAR6.SGM 18JAR6
6058 Federal Register/Vol. 82, No. 11/Wednesday, January 18, 2017/Rules and Regulations
should be part of the broader general maintain previous barriers and create commenters said the part 2 regulations
medical care confidentiality regulations. additional barriers that impede the keep the substance use disorder
Others argued that the fear of sharing of information exchange and treatment system isolated from general
discrimination is a real problem for care coordination necessary to health care providers and reduce access
many individuals suffering from a effectively treat patients who seek care to substance use disorder treatment
substance use disorder and being able to in a variety of settings. A few being added by general health care
receive treatment without worrying that commenters said the proposed part 2 organizations, which, due to
personal information will be leaked is revisions go beyond the protections administrative burden and liability
crucial in helping these people get the intended by the statutory requirements fears, are less likely to add substance
help they need so that they can return in 42 U.S.C. 290dd–2 and suggested that use disorder treatment. A few of these
to their communities as contributing the proposed changes would continue to commenters asserted that the part 2
members of society. decrease access to substance use regulations have unintended
disorder treatment and the achievement consequences, including disadvantaging
SAMHSA Response
of positive health outcomes. persons with a substance use disorder
SAMHSA wants to ensure that Citing concerns about people with and treatment providers because of the
patients with substance use disorders substance use disorders who visit burdens associated with constantly
have the ability to participate in, and multiple health care providers to obtain updating expiring consents. One of
benefit from, new and emerging health medication, one commenter advocated these commenters said that the burdens
care models that promote integrated that substance use disorder health care caused by the part 2 regulations are
care and patient safety while respecting records should be accessible to all particularly costly because patients with
the legitimate privacy concerns of health care facilities for the sole purpose substance use disorder are among the
patients seeking treatment for a of better treating and rehabilitating these highest cost utilizers in the health care
substance use disorder due to the patients. system.
potential for discrimination, harm to Other commenters requested further Some commenters asserted that
their reputations and relationships, and clarification on the regulations to ensure maintaining a separate set of
serious civil and criminal consequences. that coordination of care happens confidentiality restrictions aimed solely
This approach is consistent with the smoothly for all patients, especially at substance use disorder providers and
intent of the governing statute (42 U.S.C. those at the highest need of patients perpetuates the stigma
290dd–2) and regulations at 42 CFR part coordination, without unnecessary associated with substance use disorder
2, which is to protect the confidentiality barriers. Citing a 2010 report from the and ultimately negatively impacts
of substance use disorder patient President’s Council of Advisors on patients and the care they receive,
records. SAMHSA has added more Science and Technology, a couple of suggesting that issues of substance use
flexibility to some of the consent commenters urged SAMHSA to initiate disorder information confidentiality
a broad conversation among other HHS should be part of the broader general
provisions, including a range of ‘‘To
agencies to develop a granular data medical care confidentiality regulations.
Whom’’ consent options that includes
specification standard that enables Some commenters expressed concern
the current (1987) ‘‘To Whom’’ consent
patients to be in full control of all their that the proposed part 2 revisions did
requirement, but still retained core part
health data, not just part 2 data. not address information exchange issues
2 protections, including the prohibition
Citing technological barriers, a associated with specific types of health
on re-disclosure as well as requiring the
commenter asserted that additional care services delivery, including
‘‘Amount and Kind’’ section of the
changes to part 2 are necessary to allow integrated delivery systems operating
consent form to include how much and
for technological solutions for sharing with a behavioral health organization
what kind of information is to be
data. One commenter said new funding unit or department; organizations that
disclosed, including an explicit
for HIEs permitted by recent CMS include affiliated entities, such as
description of the substance use
guidance could be maximized by more jointly held and operated hospital-based
disorder information that may be
substantial revisions to part 2 that systems and health insurance plans;
disclosed. Changes to the research
would encourage the inclusion of risk-based Medicaid managed care;
provision also enable patients to benefit
substance use disorder providers in social service programs integrated with
from advanced research protocols while
HIEs. Expressing uncertainty as to publicly financed health delivery
still complying with part 2 protections
whether data segmentation can be systems; and combined behavioral
regarding patient confidentiality.
implemented effectively absent clear health service delivery.
However, with these conflicting
standards, a commenter expressed One commenter urged SAMHSA to
comments, as well all other comments,
concern the result would be a two-tier include the release of previous
SAMHSA was guided by the governing
system of how substance use disorder substance use disorder treatment
statute in developing the final rule,
data are defined both by payers and by information from insurance companies
which restricts disclosure without
local and state jurisdictions that has the to part 2 programs as disclosure
consent other than under a small
effect of having substance use disorder permitted without consent under part 2.
number of exceptions
data exchanged differently depending Another commenter expressed concern
2. The Proposed Rule Did Not Go Far on if the patient received services that SAMHSA did not propose an
Enough To Facilitate Information within or beyond the veil of part 2 allowance under part 2 regarding
Exchange regulation. appropriate disclosures by a health plan
S6 Public Comments Some commenters suggested that the for the coordination of a health plan
ULE current (1987) part 2 regulation and the member’s care.
R Several commenters suggested that proposed revisions maintain a status Expressing concern that the proposed
with the proposed part 2 revisions did not go quo of segregated substance use disorder part 2 revisions do not address many of
D
RO far enough to facilitate information information with minimal benefits to the issues on which SAMHSA has
P
G9T082 eexxcahmapnlgee, saonmd ed caotam smhaernintegr.s F aosrs erted pdaettieernretsn,c hei fgohr coormgapnliizaantcioen cso tsots p, raonvdi de iisnsfuoermd agtuioidna nnectew woirtkhs ,r eas cpoemctm toe nhteearl th
K3 that the proposed regulations would substance use treatment. Some of these asserted that such guidance is outdated
S
D
mstockstill on VerDate Sep<11>2014 22:14 Jan 17, 2017 Jkt 241001 PO 00000 Frm 00008 Fmt 4701 Sfmt 4700 E:\FR\FM\18JAR6.SGM 18JAR6
Federal Register/Vol. 82, No. 11/Wednesday, January 18, 2017/Rules and Regulations 6059
and creates unintended obstacles to the With this rulemaking, SAMHSA has essential for effective mental health
desired exchange of information on attempted to facilitate the electronic treatment.
patients with substance use disorders. exchange of substance use disorder A few commenters urged SAMHSA to
treatment records while ensuring ensure that the final rule respects
SAMHSA Response
patient privacy. SAMHSA patient choice for privacy in the
The governing statute (42 U.S.C. acknowledges that many EHRs and HIEs treatment of sensitive information like
290dd-2) and regulations at 42 CFR part are experiencing technical barriers to substance use disorder treatment
2 protect the confidentiality of segmenting or redacting substance use records, including the right to control
substance use disorder patient records. disorder treatment data. As a result, how their records are disclosed, even for
Consistent with the governing statute, SAMHSA has spent several years health and payment purposes. A
SAMHSA wants to ensure that patients supporting the continued development commenter said the proposed part 2
with substance use disorders have the of the Consent2Share application, an changes have substantially weakened
ability to participate in, and benefit open-source health IT solution based on the privacy protections surrounding the
from new and emerging health care DS4P, which assists in both consent sharing of a patient’s substance use
models which promote integrated care management and data segmentation. It treatment data. One commenter stated
and patient safety while respecting the is designed to integrate with existing that before an individual’s health data
legitimate privacy concerns of patients EHR and HIE systems via the developed can be accessed, there should be a
seeking treatment for a substance use standards. Consent2Share enables specific, legitimate reason, and a careful
disorder due to the potential for electronic implementation of various review of the patient’s set of
discrimination, harm to their sensitive health information disclosure permissions. In addition to suggesting
reputations and relationships, and policies by applying the information- that mental health and substance abuse
serious civil and criminal consequences. sharing rules needed to constrain the records be blocked from view by any
Toward that end, SAMHSA held a disclosure of sensitive data according to providers or staff not directly involved
Listening Session on June 11, 2014, to patient preferences. SAMHSA, in in the care and treatment of a patient,
solicit feedback on the Confidentiality conjunction with ONC and other federal a commenter asserted that a patient has
of Alcohol and Drug Abuse Patient partners, also continues to support the the right to have substance abuse and/
Records regulations. All the feedback development of data standards and IGs or mental health treatment records
received from the Listening Session was to further reduce technical barriers in blocked from view by even their
considered and helped to inform the the field. primary care provider or nurses.
development of the proposed and final Finally, SAMHSA has added A couple of commenters asserted that
rules. In addition, SAMHSA additional information from previously it is both necessary and technologically
collaborated with its federal partner issued FAQ guidance to the preamble possible to integrate substance use
experts in developing this final rule. discussion in this final rule, such as disorder and other health care
Information exchange is addressed in information about medical emergencies information and effectively exchange
both the applicability provision (§2.12) and ‘‘holds itself out,’’ and plans to substance use treatment data while
and the consent requirements provision issue additional subregulatory guidance maintaining the core protections of part
(§2.31), among other places in this final after publication of the final rule. 2, including consent requirements and
rule. SAMHSA has added more 3. Final Rule Should Balance Patient the prohibition on re-disclosure.
flexibility to the ‘‘To Whom’’ section of Protections With Enhanced Information Emphasizing the importance of
the consent form, which will give Exchange patient confidentiality and privacy, a
patients the option to release their few commenters asserted that sacrificing
Public Comments
records to past, current, and/or future the dignity and well-being of a person
treating providers. In addition, §2.13 Numerous commenters emphasized seeking help for a substance use
requires a part 2-compliant consent that the part 2 revisions must balance disorder in the name of convenience,
form must list the date, event, or patient protections with enhanced administrative efficiency, and research
condition upon which the consent will information exchange and data sharing. is a poor way to achieve the well-being
expire, if not revoked before. Thus, it is Some commenters suggested that of either the person in need or the
not sufficient under part 2 for a consent patient confidentiality should not be community. One of these commenters
form to merely state that that compromised by any updates to the part recommended that SAMHSA delay the
disclosures will be permitted until the 2 regulations, reasoning that the stigma part 2 changes until the technology is
consent is revoked by the patient. It is, associated with having or having had a available to protect persons with
however, permissible for a consent form substance use disorder and the fear that substance use disorder.
to specify the event or condition that this information may be used against an Another commenter encouraged a
will result in revocation, such as having individual would lead them to not seek cautious, step-wise approach to making
its expiration date be ‘‘upon my death.’’ treatment. To this end, a few of these substance use treatment records more
The Applicability provision includes: commenters cautioned SAMHSA to integrated with general medical records.
‘‘The restrictions on disclosure in these remain diligent in the oversight of these This commenter expressed concern that
regulations do not apply to regulations to ensure that the making treatment records more
communications of information between information is only being conveyed to accessible to other providers would
or among personnel having a need for the appropriate parties with the sole exacerbate the stigmatization of
the information in connection with their intent to improve patient care. Other substance use disorder, particularly
S6 duties that arise out of the provision of commenters emphasized that sharing among pregnant women, which could
ULE diagnosis, treatment, or referral for patient information should be solely for lead to these individuals not seeking
D with R tdriesaotrmdeenrst iof ft hpea tcieonmtsm wuinthic asutibosntsa nacree use ncoemcemsseanryte mr aerdgiuceadl pthuarpt tohsee si.n Atenreostht einr tdriesaotrmdeenr to fro prr tehneaitra slu cbasrtea.n ce use
RO within a part 2 program; or between a integrating mental health care with
G9T082P pdairret c2t padromgirnamist raantdiv aen c oennttirtoyl tohvaetr h tahse pthhey esricoasli ohne aolrt he lcimarien sahtioounl do fn tohte r esult in SASMAHMSHAS ARe rsepiotenrsaete s its intent to
K3 program.’’ heightened privacy protections that are ensure that patients with substance use
S
D
mstockstill on VerDate Sep<11>2014 22:14 Jan 17, 2017 Jkt 241001 PO 00000 Frm 00009 Fmt 4701 Sfmt 4700 E:\FR\FM\18JAR6.SGM 18JAR6
6060 Federal Register/Vol. 82, No. 11/Wednesday, January 18, 2017/Rules and Regulations
disorders have the ability to participate many behavioral health providers have the allowable sharing of data for
in, and benefit from new and emerging yet to adopt electronic health records as purposes of care coordination and
health care models which promote incentive payments have been patient safety.
integrated care and patient safety while unavailable for such purposes for these Numerous commenters urged that
respecting the legitimate privacy providers under the HITECH substance use disorder records and
concerns of patients seeking treatment Meaningful Use Program. In addition, treatments should be held to the same
for a substance use disorder due to the paper records are still used today in level of privacy as all other health
potential for discrimination, harm to some part 2 programs and shared records. Other commenters raised the
their reputations and relationships, and through facsimile (FAX). Therefore, in concern of equal access, stating that
serious civil and criminal consequences. spite of advances in technology, some individuals with substance use disorder
This approach is consistent with the stakeholders are concerned that part 2, should have the same access to the
intent of the governing statute (42 U.S.C. as currently written, continues to be a benefits of increased care coordination
290dd-2) and regulations at 42 CFR part barrier to the integration of substance as individuals without substance use
2, which is to protect the confidentiality use disorder treatment and physical disorder.
of substance use disorder patient health care. Rather than waiting for the Commenters encouraged the broader
records. development and adoption of harmonization of part 2, HIPAA, and
In response to the commenters who technology, SAMHSA decided to issue HITECH into a single uniform set of
cautioned SAMHSA to remain diligent these final regulations to ensure that standards applicable for all personal
in the oversight of these regulations, patients with substance use disorders health information, including substance
SAMHSA has the statutory authority to have the ability to participate in, and use disorder treatment and payment.
promulgate 42 CFR part 2, but the benefit from new and emerging health Some commenters asserted that
Department of Justice retains the care models which promote integrated HIPAA is sufficient to protect patient
authority for enforcing 42 CFR part 2. care and patient safety while respecting privacy and part 2 is no longer
Reports of violation of these regulations the legitimate privacy concerns of necessary. Some commenters also
may be directed to the United States asserted that part 2 also predates the
patients seeking treatment for a
Attorney for the judicial district in development of EHR and HIEs, and
substance use disorder due to the
which the violation occurs. The report there is pressing need to reconsider
potential for discrimination, harm to
of any violations of these regulations by these rules in light of more recent
their reputations and relationships, and
an opioid treatment program may be technological and legal developments.
serious civil and criminal consequences.
directed to United States Attorney for Some commenters expressed concern
SAMHSA understands the importance
the judicial district in which the that complying with both part 2 and
of not compromising patient protection,
violation occurs as well as the SAMHSA HIPAA would lead to undue
and has, in §2.13(d) of these final
office for opioid treatment program administrative burden and management
regulations, required an entity that
oversight. SAMHSA has oversight of issues across the continuum of patient
serves as an intermediary (upon request)
opioid treatment programs through 42 care.
to provide a List of Disclosures made
CFR part 8. Related to oversight and A commenter recommended that
pursuant to the general designation
compliance education, SAMHSA SAMHSA should add the same release
option. Further, as discussed later in
expects to issue FAQs as it has done in requirements for substance use disorder
this preamble, the general designation
the past and develop other treatment as is required for
option may not be used until there is
subregulatory guidance such as psychotherapy notes under HIPAA,
technical capability to provide the
education and outreach materials. which are restricted from release
required List of Disclosures.
SAMHSA has added more flexibility without the client’s consent. According
to some of the consent provisions but 4. Part 2 Should Align With the Health to the commenter, this would give
still retained core part 2 protections, Insurance Portability and substance use disorder patients
including prohibition on re-disclosure Accountability Act protections with Business Associates
as well as consent options that would Agreements (instead of additional rules
Public Comments
continue to give patients significant and forms for Qualified Service
control. For example, the ‘‘To Whom’’ Many commenters expressed that part Organization Agreements [QSOAs]),
section of the consent form includes an 2 should be aligned with HIPAA. Some notification upon breach requirements,
option permitting a general designation commenters specifically mentioned and other rights already afforded
under certain circumstances. However, various areas for HIPAA alignment, persons receiving medical and mental
SAMHSA retained the option of listing including the consent form; Business health care.
the name(s) of the individual(s) to Associate Agreement standards; Several commenters said part 2
whom a disclosure is made. In addition, treatment, payment, and health care should be as consistent as possible with
any disclosure made under these operations; patient-requested HIPAA, except for the prohibition on
regulations must comply with the restrictions on disclosure; de- use for investigation, prosecution, or
‘‘Amount and Kind’’ of information to identification standards, medical criminal charges.
be disclosed and the purpose of the emergencies; research; the definition of
SAMHSA Response
disclosure, as provided on a part 2- ‘‘Patient identifying information;’’
compliant consent form. Furthermore, HIPAA penalties contained in the SAMHSA noted the many comments
§2.13(a) limits the information to be HITECH Act; and re-disclosure from a wide range of commenters that
S6 disclosed to that information which is provisions. Many commenters asserted requested that SAMHSA align part 2
ULE necessary to carry out the purpose of the that aligning the regulations with provisions with HIPAA where possible.
D with R dopistciolons utor ew. iMthohroeoldv ecro, nas penatti teon td hisacsl othsuer e HapIPpAroApr wiaoteu lbda lhaenlcpe t boe sttwriekeen a pnr otecting Iantt esommpete idn stota dnoce sso, SinA tMhiHs SfiAn ahl arsu le to
RO of any of their substance use disorder sensitive patient health information the extent the change was permissible
P
G9T082 infSoArmMaHtiSoAn. is aware that technology wcahreil.e M paronvyi cdoinmgm coenortedrisn uatregde,d q SuAalMityH SA utinmdee,r p 4a2rt U 2. San.Cd. i2t9s 0gdodv–e2rn. iAntg tshtea tsuatme ea re
K3 adoption is an ongoing process and that to align part 2 with HIPAA to broaden separate and distinct from HIPAA and
S
D
mstockstill on VerDate Sep<11>2014 22:14 Jan 17, 2017 Jkt 241001 PO 00000 Frm 00010 Fmt 4701 Sfmt 4700 E:\FR\FM\18JAR6.SGM 18JAR6
Federal Register/Vol. 82, No. 11/Wednesday, January 18, 2017/Rules and Regulations 6061
its implementing regulations. Because of disclosure of their substance use opioid treatment programs may be
its targeted population, part 2 provides disorder treatment, limit the use of reported to the U.S. Attorney’s Office for
more stringent federal protections than information shared for non-health the judicial district in which the
most other health privacy laws, purposes, provide meaningful violation occurred, as well as the
including HIPAA. enforcement and penalties, and more SAMHSA office responsible for opioid
In response to comments about effectively prevent discrimination. treatment program oversight.
alignment of this regulation with Another commenter recommended that
Public Comments
HIPAA, SAMHSA has aligned the modifications should be made to HIPAA
interpretation the definition of ‘‘Patient to incorporate special protections and SAMHSA received no public
identifying information’’ with HIPAA to limitations for substance use comments on this section. This section
the extent feasible. In addition, information and that the part 2 of the final rule is adopted as proposed.
SAMHSA revised Security for records regulations should be rescinded. If the
D. Definitions (§2.11)
(§2.16) to more closely align with intent of the part 2 changes is to prevent
HIPAA. inappropriate adverse consequences SAMHSA has consolidated all of the
definitions in 42 CFR part 2, with the
from the disclosure of substance use
B. Statutory Authority (§2.1) exception the definition of the term
disorder health data, a commenter
SAMHSA is adopting this section as suggested that those specific adverse ‘‘Federally assisted,’’ into a single
proposed. SAMHSA has combined what consequences should be targeted with section at §2.11. SAMHSA has retained
was §§2.1 (Statutory authority for legislation reform, rather than providing the definition of the term ‘‘Federally
confidentiality of drug abuse patient a blanket privacy allowance that hides assisted’’ in §2.12 (Applicability) for the
records) and 2.2 (Statutory authority for medical information from providers. purpose of clarity because it is key to
confidentiality of alcohol abuse patient understanding the applicability of the
records) and renamed the new §2.1, SAMHSA Response part 2 regulations. SAMHSA is adopting
Statutory authority for confidentiality of SAMHSA does not have the authority these structural changes as proposed in
substance use disorder patient records. to repeal or revise the governing statute the NPRM. Specific definitions are
We have re-designated §§2.2 through for the regulations codified at 42 CFR discussed in the sections below. If a part
2.5 accordingly. In the new §2.1, part 2 nor any other statute, as that 2 definition is not addressed below, it
SAMHSA has deleted references to 42 power is given to Congress. The part 2 is because SAMHSA did not propose or
U.S.C. 290ee–3 and 42 U.S.C. 290dd–3. authorizing statute, 42 U.S.C. 290dd–2, make substantive changes to that
Sections 290dd–3 and 290ee–3 were gives the Secretary broad authority to definition. However, as discussed
omitted by Public Law 102–321 and carry out the confidentiality provisions below, SAMHSA updated the terms in
combined and renamed into Section therein, but to promulgate requirements those definitions, as appropriate (e.g., to
290dd–2, Confidentiality of records. In to: (1) Carry out the purposes of the replace ‘‘program’’ with ‘‘part 2
addition, we have deleted references to legislation; (2) prevent its program,’’ and when ‘‘alcohol abuse’’
laws and regulations that have been circumvention or evasion; and (3) and ‘‘drug abuse’’ were used collectively
repealed in §2.21. facilitate its compliance. These part 2 to replace it with ‘‘substance use
revisions were drafted to further these disorder’’). The definitions in the
Public Comments
three purposes while, to the extent regulatory text of this final rule reflect
One commenter urged SAMHSA to allowable under the legislation, these changes.
assess whether existing statutory permitting disclosure and use to
1. New Definitions
authority is adequate to modernize part increase access to treatment and
2 regulatory requirements to keep pace improve treatment services. The intent a. Part 2 Program
with existing laws and industry of the part 2 regulations and its SAMHSA is adopting this definition
developments while also protecting governing statute (42 U.S.C. 290dd–2) is as proposed. SAMHSA defines a ‘‘Part
privacy, and to discuss necessary to protect the confidentiality of 2 program’’ as ‘‘a federally assisted
statutory changes in the final rule. substance use disorder patient records. program (federally assisted as defined in
Further, the commenter recommended Because individuals seeking treatment §2.12(b) and program as defined in
that SAMHSA encourage Congress to for substance use disorders may §2.11). See §2.12(e)(1) for examples.’’
convene public hearings to evaluate experience a host of negative We have retained the examples
proposals for statutory changes and consequences, including discrimination, provided in §2.12(e)(1) of the current
delay issuing a final rule if pending harm to their reputations and (1987) regulations, with minor
legislative proposals are enacted that relationships, and possibly serious civil clarifications in §2.12(e)(1), because
change the legal landscape for substance and criminal consequences should they explain the part 2 applicability and
use disorder information and related information regarding their treatment be coverage. SAMHSA has replaced the
protections. improperly disclosed, there is a specific term ‘‘program’’ with ‘‘part 2 program,’’
A commenter urged SAMHSA to need for strong privacy protections for where appropriate. For example, we
address the congressional action that substance use disorder records. have revised the definition of QSO,
may be needed to effectively expand the including replacing ‘‘program’’ with
C. Reports of Violations (§2.4)
ability to provide coordinated services, ‘‘part 2 program,’’ which is discussed in
such as including health and human SAMHSA is adopting this section as depth below (see Section V.D.2.i.,
services agencies’ field staff clearly into proposed. We have revised the Existing Definitions). We also replaced
S6 the definition of treatment terms. A few requirement of reporting violations of ‘‘program’’ with ‘‘part 2 program’’ in
ULE commenters suggested that the statutory these regulations by a methadone several other definitions, while making
with R areugtuhloartiitoyn usn (4d2er Uly.iSn.Cg .t h2e9 0pdadrt– 22 ) should paurothgorarmity t oo vthere mFDetAh a(d§o2n.e5 (pbr)o).g Trahme s noW adhdiliet iao ncoalu cphlea nogf ecso. mmenters
D
RO be revised. Another commenter asserted (now referred to as opioid treatment purported to address the proposed
P
G9T082 tshhaotu tlhde b 1e9 r9e2fo cromnefidd eton taifafloirtdy sptaattiuetnet s ptor oSgAraMmHsS) wA aisn t2ra0n0s1f e(6rr6e dF Rfr 4o0m7 6th).e FDA dneaftiunriet ioofn t hoef i‘r‘P caormt 2m pernotgsr mamad,’e’ tchlee ar
K3 greater protections against unlawful Suspected violations of 42 CFR part 2 by that their underlying concern was how
S
D
mstockstill on VerDate Sep<11>2014 22:14 Jan 17, 2017 Jkt 241001 PO 00000 Frm 00011 Fmt 4701 Sfmt 4700 E:\FR\FM\18JAR6.SGM 18JAR6