LEXINGTON Not only is the opioid crisis straining the resources of our healthcare system, but the increasing need for treatment for substance use disorders creates complex issues for providers, including how to protect and manage the medical records of individuals seeking treatment. As much-needed treatment becomes more integrated with primary care, complicated issues of patient confidentiality are created. On January 3, 2018, the Substance Abuse and Mental Health Services Administration (SAMHSA) published its second final rule updating the Confidentiality of Substance Use Disorder Patient Records regulations in as many years. These regulations had not been updated since 1987. Like HIPAA, 42 CFR Part 2 (“Part 2”) serves to protect and preserve the privacy of patients with addictions. Confidentiality is a fundamental aspect of the physician-patient relationship and is especially important for patients with substance use disorders because of the legal and social ramifications, along with fear of prosecution. The original purpose of the Part 2 regulations was to mitigate the stigma associated with substance use disorder and shield those who actively seek treatment from social repercussions by preserving their privacy in treatment. With criminal penalties for wrongful disclosure of medical records, Part 2 is more aggressive than HIPAA confidentiality provisions. The new Part 2 regulations seek to align confidentiality requirements with the modern healthcare delivery system.
2017 Final Rule
Within two years the rulemaking process has published two Final Rules. The 2017 Final Rule focused on bringing Part 2 regulations in line with HIPAA by defining “protected health information” in a manner consistent with HIPAA, as well as incorporating requirements for maintaining the security of medical records in a similar fashion to HIPAA.
One key update in the 2017 rule is the ability of patients to give broader consent for disclosure of their information in the “To Whom” field on a consent form. Part 2 had very limited exceptions for disclosure and generally required explicit patient consent. The new rule allows patients to give a general designation to disclose information to all entities that have a treating provider relationship with the patient. Electronic signatures are also allowed, but must abide by state law if that law is more restrictive.
As Part 2 applies to any person or entity that receives federal funds and holds itself out as providing substance use disorder treatment, the 2017 Final Rule also attempted to define “holds itself out” more clearly as “any activity that would lead one to reasonably conclude that the individual or entity provides substance use diagnosis, treatment, or referral for treatment.” The rule gives examples such as authorization by a government agency to provide services, including licensure, or advertising substance use disorder/addiction services.
2018 Final Rule
The 2018 Final Rule is aimed at supporting operation and payment systems, building on the 2017 Final Rule. It takes the patient information disclosure even further, allowing patient consent to provide blanket disclosure of information to contractors, subcontractors, and legal representatives as needed to fulfill healthcare operations or payment needs. Patient-identifying information may also now be disclosed to contractors, subcontractors, and legal representatives for conducting a Medicare, Medicaid, or CHIP audit or evaluation.
Finally, Part 2 programs and “lawful holders” of protected information may use an abbreviated notice of the re-disclosure prohibition when disclosing information. Part 2 requires that every disclosure of protected Part 2 information must come with a notice prohibiting re-disclosure of the information. SAMHSA significantly shortened the required notice down to a sentence that is just 80 characters long and fits more efficiently within electronic healthcare system text fields.
The question of whether SAMHSA successfully aligned Part 2 with HIPAA and HITECH still returns a mixed answer. These two rules push those paradigms closer together to be sure, but Part 2 remains a more burdensome and administratively unwieldy system for substance use disorder providers. SAMHSA has begun work on modernizing Part 2’s provisions, but Part 2 regulations are still more onerous than HIPAA/HITECH.
The 2018 Final Rule was published on January 3, 2018, and went into effect on February 2.
Applicability – Must Your Practice Comply?
The crucial question for healthcare providers is whether their programs may now be subject to Part 2 in cases where they would not have been before. This distinction may not be driven so much by changes in the regulations as by the expansion of Medicaid/Medicare to cover substance use disorder or SAMHSA requirements.
Now that Medicaid and Medicare have extended coverage to previously uncovered areas of treatment in behavioral health, there’s a possibility that more providers, even physicians providing medically-assisted therapy, such as Suboxone, in private practice could be required to meet Part 2 regulations. There is also the matter of SAMHSA’s expanding position on who provides a treatment program for purposes of Part 2.
The importance of evaluating the need for compliance with Part 2 regulations cannot be overstated. As discussed earlier, Part 2 regulations are more aggressive than HIPAA; compliance with HIPAA does not equal compliance with Part 2.
Lisa English Hinkle is a Member of McBrayer, McGinnis, Leslie & Kirkland PLLC. Hinkle concentrates her practice area in healthcare law and is located in the firm’s Lexington office. She can be reached at lhinkle@mmlkcom or (859)-231-8780. This article is intended as a summary of federal law or regulation and does not constitute legal advice.