Disclosure of Substance Use Disorder Records Enters the 21st Century: SAMHSA Proposes Changes to Part 2, But Do They Go Far Enough?

Background
As many health care practitioners, health information management professionals, and health lawyers know, balancing patients’ privacy interests with the need to access accurate, up-to-date medical information can be challenging.  Over the decade and a half since the passage of HIPAA, [1] though, most have learned to maneuver within the mandates of the Privacy Rule [2] while navigating its intersection with more restrictive state laws.  Health care providers have implemented policies and procedures that safeguard patients’ health information—in compliance with federal and state requirements—while ensuring appropriate and timely access to medical records for permissible purposes, such as for treatment, payment, peer review, quality, public health, and law enforcement.  Substance abuse records, however, are subject to more restrictive federal requirements related to disclosure and have remained particularly vexing to assess and incorporate into today’s modern health care environment.  This is especially true as health care providers have sought to improve and enhance the interoperability of electronic health records, not only in response to the Affordable Care Act’s meaningful use and health information exchange (“HIE”) mandates, but also in response to the development of alternative payor models, innovative and collaborative care programs, and provider consolidation. 

The federal rule that protects substance abuse records is known formally as the Confidentiality of Alcohol and Drug Abuse Patient Records regulations and is commonly referred to as “Part 2.” [3]  In recognition of the stigma imposed upon patients who are referred to or receive substance abuse treatment, Part 2 provides more stringent federal protections for substance abuse records, as compared to other health privacy laws, such as the Privacy Rule.  Part 2 protects the confidentiality of records pertaining to the identity, diagnosis, prognosis, or treatment of any patient maintained in connection with a “federally assisted” program or activity (as defined by the rule) [4] relating to substance abuse education, prevention, training, treatment, rehabilitation, or research.  Written out of “great concern” that the misuse of substance abuse records could lead to a host of negative consequences such as loss of employment, housing, custody, and discrimination in the delivery of health care and public services, [5] the regulations generally allow disclosure of such records only with the individual’s express written consent, with an exception only for emergencies—but not for payment or treatment. [6] 

With regulations promulgated as a final rule in 1975, [7] and amended in 1987 [8] and 1995, [9] Part 2 predates the Privacy Rule and electronic health records.  Significantly, Part 2 also predates the movement among health care providers, payors, and the federal government to develop new models of integrated health care as a means of improving patient care and reducing costs, such as through continuing care organizations (“CCOs”) and accountable care organizations (“ACOs”), as well as the technological capabilities to meaningfully and timely exchange health information in a way that facilitates such integration. 

On February 9, 2016, the Substance Abuse and Mental Health Services Administration (“SAMHSA”), which implements and enforces Part 2, published a proposed rule that seeks to modernize the Part 2 regulations “to increase opportunities for individuals with substance abuse disorders to participate in new and emerging health and health care models and health information technology (IT),” [10] while retaining important privacy protections.  According to SAMHSA,

[t]his modernization is necessary because behavioral health, including substance abuse disorder treatment, is essential to overall health; the costs of untreated substance use disorders, both personal and societal, are substantial; and there continues to be a need for confidentiality protections that encourage patients to seek treatment without fear of compromising their privacy. [11] 

SAMHSA’s proposed rule is the result, at least in part, of general comments and feedback about Part 2, solicited through a public Listening Session, held June 11, 2014, and written comments received through June 25, 2014.  In addition to inviting general comments, SAMHSA solicited feedback about six key provisions—applicability, consent requirements, re-disclosure, medical emergency, Qualified Service Organizations (“QSOs”), and research.  Approximately 1,800 individuals participated in the Listening Session, at which 112 oral comments were made and 635 written comments were submitted during the comment period. [12]

In commentary to the proposed rule, SAMHSA reiterates the statute’s purpose, which is to protect the confidentiality of substance abuse patient records to assure that an individual receiving substance abuse treatment in a Part 2 program is no more vulnerable to adverse consequences than is an individual who does not seek treatment. [13]  Carefully setting expectations, SAMHSA states that, while it recognizes the importance of facilitating information exchange within new and emerging health care models to promote coordination of care and enhanced patient safety, it nonetheless must operate within the parameters of the authorizing legislation and its statutory intent, thus “respecting the legitimate privacy concerns of patients seeking treatment for a substance use disorder.” [14]

Proposed Changes to the Consent Requirements
Arguably, the most significant changes proposed to Part 2 to address concerns related to sharing of health information for care coordination, treatment, and payment occur in the context of the consent requirements.  As an initial matter, it may be helpful to articulate what SAMHSA does not do in its proposed rule: it does not create a general exception to the patient consent requirement for release of Part 2 records for treatment or payment purposes.  SAMHSA does, however, propose to move away from its current one-size-fits-all approach to consent form requirements that would vary, to a certain degree, depending on the relationship between the recipient of the information and patient.

Under the current rule, a consent form must specifically identify the name or title of the individual or organization to which a Part 2 Program may disclose records. [15]  This specificity requirement assures that patients identify, at the point of consent, “exactly who they are authorizing to receive their information.” [16]  For disclosures to treating providers and third-party payors who require information for reimbursement purposes, in addition to naming a specific individual, SAMHSA is proposing to retain the option of naming an entity as the recipient of the information, [17] e.g., “Hospital Name,” or “Medicare.” 

The ability to name an entity for treatment and payment, however, does not address criticism that the current specificity requirement imposes unwieldy consent management burdens on HIEs, CCOs, and ACOs, since new treating provider participants may join these organizations on a rolling basis.  As a result, many of these organizations do not include substance use disorder treatment information in their systems, handicapping care coordination efforts and raising patient safety concerns. 

In response, and in recognition that effective substance use disorder treatment depends on collaboration among mental health, substance use disorder, general health, and other service providers, SAMHSA proposes to allow a general designation for disclosure to treating providers by an entity that does not have a treating provider relationship with the patient, “such as an entity that facilitates the exchange of health information or a research institution.” [18]  Thus, where a patient authorizes disclosure to an HIE, CCO, or research institution, for example, the patient may also designate a disclosure to an individual or entity “participant” of such organization, or generally to a “class of participants,” provided such participant or class of participants has a treating provider relationship with the patient. [19]  As an example, the consent form could designate the HIE and “my treating providers.” [20]  The initial recipient of the patient identifying information must be sufficiently identified, so merely listing a function, such as “HIE,” is not permissible.  Moreover, to assure that patient identifying information is disclosed only to those individuals and entities on the health care team with a need to know, the general designation is limited to individuals and entities with a treating provider relationship. [21]

In creating a distinction between individuals and entities that have a treating provider relationship and those that do not, the revised consent requirements compel the need to define “treating provider relationship.”  SAMHSA’s proposed definition of “treating provider relationship” does not require an actual in-person encounter.  Rather, a “treating provider relationship” is “clearly established” [22] when an individual seeks diagnosis, evaluation, and/or treatment for any condition from an individual or entity, and such individual or entity agrees to undertake to diagnose, evaluate, and/or treat the patient for any condition or to consult with the patient. [23]  Such relationship can be established by a health care provider or another member of a health care team, provided the relationship meets the above definition, and the term “agree” does not imply a formal, written agreement; rather, an agreement may be evidenced by, for example, making an appointment or a telephone consultation. [24]  An entity will have a treating provider relationship if the entity employs or privileges one or more individuals who have a treating provider relationship with the patient. [25]

Designating an entity as a QSO does not provide an avenue to avoid consent requirements for care coordination activities.  In fact, SAMHSA clarifies that, although it is proposing to revise the definition of QSO to include population health management in the list of examples of services a QSO may provide, the QSO Agreement (“QSOA”) is limited to the office or unit responsible for population health management, but not the entire organization or its participants. [26] Thus, within entities such as ACOs, patient-centered medical homes, or managed care organizations, disclosure to participants such as case managers, physicians, addiction counselors, hospitals, and clinics (other than the originating Part 2 Program) would be prohibited without a Part 2-compliant consent. [27]  Similarly, SAMHSA proposes to revise the definition of “medical services” to clarify that it is limited to “medical staffing services,” emphasizing that QSOAs should not be used to avoid obtaining patient consent when otherwise required for treatment purposes. [28]

In light of this new option for a general designation, SAMHSA makes clear that the intermediary entity must have a mechanism in place to determine whether a treating provider relationship exists with the entity receiving patient records pursuant to a general designation. [29]  SAMHSA defers to the entities to implement this requirement, encouraging “innovative solutions.” [30]  The proposed rule also creates a new patient right, called the List of Disclosures provision, to receive from the intermediary entity a list of entities to which the patient’s information has been disclosed.  The List of Disclosures must include the name of the entity to which each disclosure was made, the date of disclosure, and a brief description of the information disclosed.  An entity will not satisfy the disclosure requirement with a list of entities that potentially could receive the patient’s identifying information. [31]  According to SAMHSA, assuring that patients can be informed, upon request, of who received their information pursuant to a general designation will “facilitate patients’ participation in advances in the health care delivery system.” [32]  Recognizing that systems may need to be implemented to comply with the List of Disclosures requirement, SAMHSA proposes to delay implementation for two years from the effective date of the final rule. [33]

Arguably, the language of the proposed rule is broader than its intended purpose, particularly because the term “participant” is not defined, though the general designation disclosure clearly is limited to entities that have a treating provider relationship with the patient. [34]  In its proposed rule, SAMHSA also proposes an alternative approach that would reflect the same policy goal but simplify language in the consent form.  This approach would not change language in the “To Whom” section of the consent form, but would add a definition of “organization,” which would include treating providers, third-party payors, and intermediary entities that are not treating providers but provide patient identifying information to participants that are treating providers.  While this approach may further elucidate the meaning of “participant,” there is still some room for interpretation as to what those terms mean.  SAMHSA is requesting public comments on the advantages and disadvantages of each approach, as well as whether the definition of “organization” should be broader.  SAMHSA specifically requests proposals for alternate or additional required elements of the consent form “that facilitate the sharing of information within the health care context while assuring that the patient is fully informed of the individuals and organizations that potentially could receive” the patient’s information. [35]

Other changes related to the consent requirement include greater specificity regarding the amount and kind of substance use disorder-related information that can be disclosed [36] and a specific identification of the Part 2 Program allowed to make the disclosure. [37]  This latter requirement is actually more restrictive since the current rule, amended in 1987, permits a patient to consent to disclosure from a category of facilities or from a single specified program.  SAMHSA states that this revision “would avoid any unintended consequences of including general designations in both the ‘From Whom’ and ‘To Whom’ sections.” [38]

To read the full alert, click here.

Notes:
[1] Health Insurance Portability and Accountability Act of 1996 and its implementing regulations at 45 C.F.R. parts 160 and 164.

[2] See 45 C.F.R. parts 160 and 164, subparts A and E.