On February 9, 2016, the United States Substance Abuse and Mental Health Services Administration (“SAMHSA”) announced a proposed change to the Confidentiality of Alcohol and Drug Abuse Patient Records Regulations (the “New Rules”) [42 C.F.R. Part 2]. The New Rules will modernize the Regulations by taking into account the significant changes that have occurred in the United States health care system over the past 25 years. Some of the proposed changes are substantial and of potential concern.
Overview of the New Rules
The New Rules are primarily designed to facilitate the electronic exchange of information for treatment and other legitimate health care purposes. The underlying goal is to allow individuals with substance abuse issues to participate in and benefit from developing health care models and technology. In particular, SAMHSA aims to facilitate integrated health care delivery models that emphasize quality measures and information sharing with a particular focus on health information exchanges, as well as to improve health care quality, population health, and to reduce costs, all while respecting the “legitimate privacy concerns of individuals seeking treatment for a substance abuse disorder.”
The New Rules are intended to protect “the confidentiality of the identity, diagnosis, prognosis, or treatment of any patient records which are maintained in connection with the performance of any federally assisted program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation or research.” Specifically, the New Rules:
- Change 11 definitions. Notably, the definition of “Records” will include both paper and electronic records and the definition of “Written” will include paper and electronic documentation.
- Include “general medical practices” along with “general medical facilities” as those excepted from the scope of 42 C.F.R Part 2 under certain provisions of the law.
- Add five new definitions, including the definition of a “Part 2 Program,” which clarifies that federally assisted programs must comply with 42 C.F.R. Part 2.
- Revise the consent form required for the disclosure of information covered by 42 C.F.R. Part 2. Specifically, the new consent form requirements allow that, upon request, patients may include a general designation in the “To Whom” section of a consent form authorizing the general disclosure of covered information in addition to the specific designation that was previously authorized. This general designation language is specifically designed to allow information sharing among health information exchanges. However, those patients who authorized such a general designation must be provided a list of entities to whom their information has been disclosed. In addition, the New Rules add a requirement to the consent form that, if the general designation is used, the patient understands the terms of his/her consent.
- Clarify the prohibition on re-disclosure of information by limiting the scope to information “that would identify, directly or indirectly, an individual as having been diagnosed, treated or referred for treatment for a substance abuse disorder.” This would authorize other shared health information to be re-disclosed.
- In certain sections, the New Rules clarify that information may be provided in “paper or electronic format,” where previously the Regulations only addressed paper format.
- Authorize electronic signatures.
The New Rules also change the agency to whom a violation must be reported from the Food and Drug Administration to SAMHSA, as required by law; gives providers more discretion to determine when bona fide medical emergencies exist; and makes further efforts to modernize other provisions. The New Rules also discuss the proposed costs of compliance and contemplates five specific costs that may be incurred. Significantly, health IT costs and consent form costs could be significant.
The New Rules establish a regulatory framework designed to facilitate electronic information sharing and attempt to strike a balance between the legitimate need for privacy and sensitivity in dealing with health information by the public.
Comments on the New Rules must be received by April 11, 2016. It will be interesting to see the extent to which public comment results in changes to the proposed New Rules.
The New Rules are available at https://www.gpo.gov/fdsys/pkg/FR-2016-02-09/html/2016-01841.htm
Attorney Advertising. Prior results do not guarantee a similar outcome. This publication is provided as a service to clients and friends of Harter Secrest & Emery LLP. It is intended for general information purposes only and should not be considered as legal advice. The contents are neither an exhaustive discussion nor do they purport to cover all developments in the area. The reader should consult with legal counsel to determine how applicable laws relate to specific situations. ©2016 Harter Secrest & Emery LLP