Federal Government Issues New Rule on SUD Records

Over a year since proposing changes to the rule that regulates the confidentiality of substance use disorder (SUD) records, the Department of Health and Human Services (HHS) released its final rule, which better aligns the rule with the Health Insurance Portability and Accountability Act (HIPAA).

The final rule—known as 42 CFR Part 2 and commonly referred to as Part 2—was released by HHS through the Office of Civil Rights and in coordination with the Substance Abuse and Mental Health Services Administration (SAMHSA). While HIPAA is intended to protect patient health information broadly, Part 2 pertains specifically to the confidentiality of patient records that are maintained in relation to SUD prevention, training, education, treatment, rehabilitation, or research.

Previously, there were key differences between Part 2 and HIPAA that could impede care coordination, explained Smita Das, M.D., Ph.D., M.P.H., chair of APA’s Council on Addiction Psychiatry. “For example, under HIPAA, health information could be shared without consent, with certain limitations, for the purposes of TPO—or treatment, payment, and healthcare operations—while Part 2 required patient consent for each disclosure,” Das explained. “[W]hile intended to protect confidentiality, this was often a barrier for Part 2 providers attempting to bill or coordinate care.”

The new rule includes several provisions for which APA advocated that would both improve care coordination for patients with SUDs and help eliminate the stigma and discrimination that these patients often experience. Some of the new rule’s provisions include the following:

• Part 2 now allows patients to sign a single consent form for all future uses and disclosures for SUD treatment, payment, and other health care operations. APA supported this provision to help with care coordination, and it may reduce patients’ paperwork burden as well, Das pointed out.

• The new rule allows HIPAA-covered entities and business associates that receive records under this single consent to redisclose the records in accordance with the HIPAA regulations without requiring patients to re-consent.

• The new rule expands prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, or legislative proceedings conducted against a patient unless the patient provides consent or a court order is issued. APA advocated for this provision to help eliminate stigma against seeking care.

• When agencies investigate or prosecute Part 2 programs or individuals providing care under Part 2, they may unknowingly receive confidential, protected records before obtaining a court order. The updated rule creates new, stronger diligence steps that investigational agencies must follow before they are eligible for a safe harbor (a protection from civil or criminal liability) under Part 2. Investigational agencies must look for a health professional in SAMHSA’s online treatment facility locator and check a professional’s patient notice or HIPAA notice of privacy practices to determine whether the health professional is subject to Part 2.

• Previously, health professionals were required to track and segregate records that are subject to Part 2 from those that are subject to HIPAA. For example, if a clinic provided general medical services along with services on a unit specializing in SUD treatment, the clinic had to segregate its SUD records and medical records for the same patient. Now, if consent is provided, SUD records that are shared with other general medicine units do not have to be segregated once received.

• The new rule creates a new definition for an SUD clinician’s notes that are analogous to HIPAA’s protections for psychotherapy notes. Notes analyzing conversations during SUD counseling sessions that the clinician voluntarily maintains separately from the rest of the patient’s SUD treatment and medical records cannot be used or disclosed based on a broad treatment, payment, and health care operations consent. Instead, the patient must provide additional consent before these notes can be disclosed.

• Records can be disclosed without patient consent to public health authorities, provided that the records are de-identified according to the standards of HIPAA’s privacy rule.

In terms of enhancing patient collaboration, the final rule represents a step in the right direction, Das said. “People with SUDs are unfortunately subject to increased stigma and discrimination from many systems, including the health care, legal, and financial systems,” she said, adding that these burdens are worse for marginalized and vulnerable populations.

“We have evidence-based treatments for SUDs that are often underutilized out of fear of lack of confidentiality,” she continued. “Ensuring protections for our communities while enhancing the effectiveness of care—through care coordination, for example—will result in more people accessing care and will lead to better outcomes.” ■