42 CFR Part 2 Final Rule

In January 2017, SAMHSA issued the final rule for 42 CFR Part 2, Confidentiality of Substance Use Disorder Patient Records (January 18, 2017; 82 FR 6052). In a Federal Register (FR) notice issued on February 16, 2017, SAMHSA delayed the effective date of the final regulations for 60 days in accordance with instructions received in a January 20, 2017, memo from the Assistant to the President and Chief of Staff (82 FR 10863). The revised 42 CFR Part 2 regulations became effective on March 21, 2017. (Source)

42 CFR Part 2 Covered Entity or Individual

Coverage includes, but is not limited to, those treatment or rehabilitation programs, employee assistance programs, programs within general hospitals, school-based programs, and private practitioners who hold themselves out as providing, and provide substance use disorder diagnosis, treatment, or referral for treatment. However, the regulations would not apply, for example, to emergency room personnel who refer a patient to the intensive care unit for an apparent overdose, unless the primary function of such personnel is the provision of substance use disorder diagnosis, treatment, or referral for treatment and they are identified as providing such services or the emergency room has promoted itself to the community as a provider of such services. Federal assistance to program required. If a patient’s substance use disorder diagnosis, treatment, or referral for treatment is not provided by a part 2 program, that patient’s record is not covered by the regulations. Thus, it is possible for an individual patient to benefit from federal support and not be covered by the confidentiality regulations because the program in which the patient is enrolled is not federally assisted (42 CFR § 2.11)

Most drug and alcohol treatment programs are federally assisted. For-profit programs and private practitioners that do not receive federal assistance of any kind would not be subject to the requirements of 42 CFR Part 2 unless the State licensing or certification agency requires them to comply. However, any clinician who uses a controlled substance for detoxification or maintenance treatment of a substance use disorder requires a federal DEA registration and becomes subject to the regulations through the DEA license.

Updates that impact consent requirements

To Whom Section

The final rule now allows for a general designation and also disclosure to entities without a treating provider relationship.

For example: XYZ HIE who in turn may disclose the information to any of my treating providers involved in my care.

This designation would allow for the disclosure to past, present and future providers that have a treatment relationship with the patient without specifically identifying each.

However, When using a general designation, a statement must be included on the consent form that the patient (or other individual authorized to sign in lieu of the patient), confirms their understanding that, upon their request and consistent with this part, they must be provided a list of entities to which their information has been disclosed.

From Whom Section

SAMHSA decided not to finalize its proposed changes to the “From Whom” section, but did make minor updates to the terminology in the text.  Therefore, a general designation is still allowed.

For example: “XYZ Treatment Facility” or “XYZ ACO” or “XYZ HIE”

This is important because using the general designation allowed under the To Whom provision, coupled with a multi-party, bidirectional consent, the general designation permitted by the From Whom provision under the final rule, will allow for disclosure to and among the participants in an integrated care environment such as an HIE.

Amount and Kind

The Consent must include how much and what kind of information is to be disclosed, including an explicit description of the substance use disorder information that may be disclosed.

For example: (Acceptable) “medications and dosages, including substance use disorder-related medications,” or “all of my substance use disorder-related claims/encounter data.”

(Not Acceptable) “all of my records” or “only my substance use disorder records my family knows about”

Revocation and Expiration

The consent must include a statement that the consent is subject to revocation at any time except to the extent that the part 2 program or other lawful holder of patient identifying information that is permitted to make the disclosure has already acted in reliance on it.

For Example: “I can revoke this Consent and Authorization at any time by giving written notice to the person or organization named above in the “To Whom” or “From Whom” sections except to the extent that those persons or organizations have acted in reliance upon my authorization.”

The consent must include a statement regarding the date, event, or condition upon which the consent will expire if not revoked before. This date, event, or condition must ensure that the consent will last no longer than reasonably necessary to serve the purpose for which it is provided.

For example, it is permissible for a consent form to specify the event or condition that will result in revocation, such as having its expiration date be “upon my death.”

Re-disclosure

Each disclosure made with the patient’s written consent must be accompanied by a written statement with the specific language contained in 42 CFR Part Section § 2.32.  The federal rules prohibit individuals or entities from making any further disclosure of information that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted by 42 CFR part 2.

Thus, the context and not necessarily the data itself is the determining factor of whether data could be re-disclosed. This may be difficult for electronic systems to flag or segment.

The preamble to the final rule confirms that the disclosure from one treating provider to another treating provider in an HIE would be considered a re-disclosure. Thus, the consent process described above using the From Whom provision is necessary to avoid the prohibition.

Medical Emergencies

Patient identifying information may be disclosed to medical personnel to the extent necessary to meet a bona fide medical emergency in which the patient’s prior informed consent cannot be obtained.

It is important to note that immediately following disclosure, the part 2 program shall document, in writing, the disclosure in the patient’s records, including:

1. The name of the medical personnel to whom disclosure was made and their affiliation with any health care facility;
2. The name of the individual making the disclosure;
3. The date and time of the disclosure; and
4. The nature of the emergency

For the purposes of an HIE, the HIE would need to provide a disclosure notice any time there was a “break the glass” or “break the seal” activity and 42 CFR Part 2 protected data was disclosed to any and all organizations whose data was disclosed. This disclosure notice should be kept as part of the patient’s chart.  It is not necessary to notify the patient of the disclosure unless requested.

Research

Part 2 Programs may also disclose SUD information for the purpose of conducting scientific research if person with responsibility for disclosure determines that (i) the recipient is a covered entity or business associate under HIPAA and has obtained appropriate authorization or waiver from the patient; (ii) the recipient is subject to the human subjects protection Common Rule (45 CFR Part 46) and has obtained the patient’s informed consent or an appropriate waiver or exemption; or (iii) both HIPAA and Common Rule compliance is met, when applicable. Researchers must not re-disclose patient information, but may include part 2 data in research reports only in aggregate form in which patient identifying information has been rendered non-identifiable such that the information cannot be reidentified and serve as an unauthorized means to identify a patient, directly or indirectly, as having or having had a substance use disorder. Researchers must follow Part 2 storage requirements including destruction of SUD-data, and must retain the patient records in accordance with all applicable laws.

QSO

SAMHSA has revised the definition of QSO to include population health management in the list of examples of services a QSO may provide. SAMHSA also revised the term “medical services” as listed in the examples of permissible services offered by a QSO to clarify that it is limited to “medical staffing services.” SAMHSA made this revision to emphasize that QSOAs should not be used to avoid obtaining patient consent.

Specifically, population health management refers to increasing desired health outcomes and conditions through monitoring and identifying individual patients within a group. To achieve the best outcomes, providers must supply proactive, preventive, and chronic care to all of their patients, both during and between encounters with the health care system. For patients with substance use disorders, who often have comorbid conditions, proactive, preventive, and chronic care is important to achieving desired outcomes.

Because a QSOA is a two-way agreement between a part 2 program and the entity providing the part 2 program and an individual or entity providing a service to a part 2 program, agreements between more than those two parties (e.g. multi-party agreements) are prohibited. A QSOA cannot be used to avoid obtaining patient consent in the treatment context.