HHS Finalizes Regulations on Substance Use Disorder Patients’ Confidentiality

Earlier this week, the Department of Health and Human Services’ (HHS') Substance Abuse and Mental Health Services Administration (SAMHSA) issued a final regulation modifying 42 CFR Part 2—a set of regs that govern the confidentiality of patient records for the treatment of substance use disorder (SUD).

SAMHSA is finalizing most of the changes it proposed in last year’s proposed reg. In ACEP's comments on the proposed reg, we had supported SAMHSA’s efforts to modernize 42 CFR Part 2 and provide access to vital data while still protecting patient privacy. In all, SAMHSA is making modifications to 42 CFR Part 2 that are aimed at advancing care coordination for patients with SUD and clarifying existing policies for Part 2 treatment Programs (federally assisted alcohol or drug abuse programs) and other health care providers.

Some of the highlights of the final reg include:

• Reducing burden on many non-Part 2 providers (such as physicians) when handling treatment records covered under 42 CFR Part 2.
• Allowing patients with SUD to provide their consent to releasing their information to entities (such as the Social Security Administration) without naming a specific person at that entity. (Previously, these patients had a hard time applying for benefits since they were forced in the application to pick a specific person to which their Part 2 records were being released.)
• Codifying a list of 18 examples of “payment and health care operations” for which disclosure is permitted with written consent and clarify that this list of activities is not intended to cover care coordination or case management.
• Allowing opioid treatment programs (OTPs) to enroll in state prescription drug monitoring programs and submit data consistent with applicable state laws.
• Enabling non-OTPs to query a central registry to determine whether patients are already receiving SUD treatment through a member program.
• Broadening the bona fide medical emergencies exception to include declared emergencies from natural disasters that disrupt treatment facilities and service.
• Broadening the research exception to include disclosures by a HIPAA-covered entity or business associate to individuals and entities who are not covered by HIPAA or the common rule (regarding research on human subjects).

Interestingly, SAMHSA did not address a proposed policy in the final reg that would expand the scope of investigations in which law enforcement could receive confidential communications from 42 CFR Part 2 programs. ACEP opposes this specific proposed policy, which we believe, if finalized, could lead to situations where law enforcement could have broad access to patient records and other confidential communications that are beyond the scope of their investigations. During a call with stakeholders, Dr. Elinore McCance-Katz—who leads SAMHSA— stated that the proposed change is still under consideration and may be finalized at a later date.

The release of this final reg is part of HHS’ broader strategy to streamline and modernize burdensome regulations that do not align with current clinical practices or hinder efforts to better coordinate care. Next on HHS’ list is potentially making modifications to the Health Insurance Portability and Accountability Act (HIPAA) and finalizing proposed changes to the physician self-referral law and the anti-kickback statute.

And, speaking of upcoming regs, stay tuned for the 2021 Medicare physician fee schedule proposed reg, which could be released any day now! Until next week, this is Jeffrey saying, enjoy reading regs with your eggs!