Rule Governing Confidentiality of Substance Use Data Updated

Federal regulations regarding the confidentiality of patient records regarding treatment for alcohol and other substance use disorders have been updated to account for the evolution of integrated care and other changes.

The update appears in the form of a final rule that was published January 18 in the Federal Register. The rule will go into effect on March 21; an executive order by President Donald Trump mandates that implementation of all new regulations issued by federal agencies must be delayed for 60 days while the White House reviews the rule.

The previous regulations governing the confidentiality of substance use disorder (SUD) records (referred to as “42 CFR Part 2”) were promulgated in 1975 to protect the confidentiality of patients receiving services for alcohol and other substance use disorders through programs that receive federal assistance. The updated regulations are intended to reflect changes in the health care delivery system—especially the development of integrated care networks that depend on shared information—and permit appropriate research and exchange of data across entities.

Under the final rule, the Substance Abuse and Mental Health Services Administration (SAMHSA) will allow any lawful holder of patient-identifying information to disclose that information to qualified personnel to conduct scientific research, providing the researcher meets certain regulatory requirements. SAMHSA will also permit researchers to link to datasets from qualified repositories holding Part 2 data.

The rule applies to the clinicians or units that provide SUD treatment and referral within a general medical facility that receives federal assistance. It does not apply to the medical facility itself, such as hospitals, trauma centers, Federally Qualified Health Centers, or community mental health centers.

The rule is less clear about buprenorphine prescribers, saying the applicability of the regulations to those prescribers will be “fact specific”—meaning it will depend upon the nature of the prescriber’s practice. For example, the prescriber will be governed by the rule if he or she is solely and exclusively providing SUD treatment and receives federal assistance.

When the final rule was published, Kana Enomoto, deputy assistant secretary of the Department of Health and Human Services who oversees SAMHSA, said in a statement that it will “further enhance health services research, integrated treatment, quality assurance, and health information exchange activities while at the same time safeguarding the essential privacy rights of people seeking treatment for substance use disorders.”

Among the most potentially problematic aspects of the final rule is a provision that allows a patient to use a general designation—such as “my treating providers”—to indicate individuals or entities with whom patient information can be shared. This change is intended to allow patients to benefit from integrated health care systems while retaining patient choice, confidentiality, and privacy; patients do not have to agree to such disclosures.

The rule also includes a requirement allowing patients who have agreed to the general disclosure designation the option of receiving a list of entities to whom their information has been disclosed. However, APA staff are concerned that current technology may not digitally identify data as related to substance use treatment once it is uploaded into an electronic health record system. Misidentified data may then be transmitted in countless ways, making it nearly impossible to track how different electronic health record systems store, retrieve, and transmit the information. APA is working with a coalition to promote legislation that will harmonize the updated rule with HIPAA regulations.

Psychiatric News will provide further updates on implementation of the final rule. ■