The Department of Health and Human Services has updated the rule on Confidentiality of Substance Use Disorder Patients Records. In relation to this, the regulation on Substance Abuse and Mental Health Services Administration (SAMHSA) also changed. The reason for the update is to align regulations with technological advances in healthcare delivery in the U.S. without violating patient’s privacy when treating substance abuse disorders. The final rule discusses the permitted uses and disclosures of patient identifying information when healthcare operations, audits, payment and evaluations need it.
The last time the Confidentiality of Alcohol and Drug Abuse Patient Records (4 CFR part 2) regulations had substantial changes was in 1987. SAMHSA submitted an update proposal to 42 CFR part 2 in 2016. Included in the update proposal are the use of electronic exchange of patient information and the development of integrated health care models.
SAMHSA welcomed public comments on the update proposal before publishing the final rule in January 2017. The final ruling had greater flexibility for disclosures within the healthcare system at the same time ensuring the confidentiality of substance use disorder records.
There were additional proposals covering disclosures related to
· payment and healthcare operations applicable to contractors, subcontractors and legal representatives by lawful holders under the part 2 rule consent provisions
· purposes of carrying out Medicaid, Medicare or Children’s Health Insurance Program (CHIP) audits or evaluations
After taking into consideration the 55 public comments on the proposed revisions, SAMHSA finalized the proposed revisions. SAMHSA tried to align the revisions with HIPAA and the HITECH Act, although both are quite distinct from 4 CFR part 2 in terms of implementing regulations.
Compared to HIPAA and other health privacy laws, part 2 offers stricter federal protection. It seeks to safeguard individuals with substance use disorders who could possibly suffer discrimination and legal consequences if their information is misused or disclosed.
In the revised part 2, SAMHSA did not include care coordination and case management in the list of permissible activities under payment and healthcare operations. The list remained substantially unchanged. SAMHSA clarified that disclosures to contractors, subcontractors and legal representatives are not allowed for activities related to a referral for treatment, patient’s treatment and diagnosis. SAMHSA will still review the other issues raised and will find ways to improve the 42 CFR part 2 rules.
On March 21, 2018, there will be a public meeting to know how 42 CFR part 2 affected patient care, patient privacy and health outcomes. Stakeholders will be given the opportunity to share the results of their part 2 implementation.