August 23, 2019

Proposed Changes to Federal Substance Use Disorder Privacy Rules Under 42 CFR Part 2

Holland & Knight Healthcare Blog
Miranda A. Franco

The Department of Health and Human Services’ Substance Abuse and Mental Health Services Administration (SAHMSA) released its long-awaited proposal to overhaul privacy restrictions for substance abuse treatment programs found in 42 CFR Part 2. 42 CFR Part 2 are federal regulations governing the confidentiality of patient records created by federally-assisted substance use disorder (SUD) treatment programs. Initially promulgated in 1975, 42 CFR Part 2 was intended to shield patients from bias and stigma associated with substance abuse that can deter patients from receiving treatment. The emergence of the opioid crisis has created significant clinical and safety challenges for providers that have highlighted the need for updates to 42 CFR Part 2.  Many stakeholders note that 42 Part 2 CFR sets requirements limiting the use and disclosure of patients’ substance use records from certain programs that rely on providers’ ability to share health information to coordinate the high-quality treatments patients need.

The proposed rule is the first of four regulations that have been identified in HHS's Regulatory Sprint to Coordinated Care that seeks to promote value-based outcomes for patients by examining federal regulations that impede coordinated care among health providers.

The proposed rule modifies several sections of 42 CFR Part 2 to encourage care coordination among providers, including updating the definition of what constitutes a Part 2 record and its applicability. This is designed to give providers clarity about what is or should be, protected by Part 2 and to ensure non-Part 2 providers are not discouraged from caring for SUD patients or recording SUD information due to onerous legal requirements. 

The rule proposes to allow primary care providers to note substance use treatment disclosed willingly to them by a patient within their medical records. Under 42 CFR Part 2, that information would need to be kept separately from the rest of the medical record if it is shared; the proposed rule would allow providers to keep that information within their medical records covered under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. Any substance use records sent to primary care providers by a 42 CFR Part 2 treatment program will still need to be segmented.

The rule also proposes to simplify how patients can send substance use records to non-medical entities, such as the Social Security Administration. Current regulations make it so patients must give consent for a specific person within an entity to receive their records. Under the proposed rule, patients would not need to specify a specific person when consenting to have records sent to an agency or other entity, but provide consent for the entity as a whole to receive them.

The proposal would also allow disclosures for payment or healthcare operations with the written consent of a patient. Non-opioid treatment program (OTP) providers will become eligible to query a central registry to determine whether their patients are already receiving opioid treatment through a member program. OTPs will be permitted to enroll in a state prescription drug monitoring program (PDMP) and permitted to report data into the PDMP when prescribing or dispensing medications on Schedules II to V, consistent with applicable state law.  Under the proposal, data disclosures would also be permitted by HIPAA covered entities or business associates for research purposes to “individuals and organizations who are neither HIPAA covered entities, nor subject to the Common Rule (federal policy for the protection of human subjects).

Notably, the administration is limited in their authority to fully align the policy with the less-stringent HIPAA and therefore supports congressional action to do so.  Senators Manchin (D-WV) and Capito (D-WV), along with Reps. Blumenauer (D-OR) and Mullin (R-OK), reintroduced legislation that aligns 42 CFR Part 2 with the patient privacy protections currently in place under HIPAA, allowing the medical community to utilize substance use disorder treatment records in the same manner as all other medical records. The legislation also incorporates language to guard against unauthorized invasions of patient privacy, discriminatory activities and authorizes enforcement penalties and breach notification requirements.

While many stakeholders are advocating for reform to 42 Part 2 CFR, some fear the proposed reforms and potential alignment with HIPAA will not protect people with substance use disorders who are misusing substances and fear where their treatment information may go.  As such, it is likely many stakeholders will weigh in on the proposed rule in an effort to inform the final rule. Once posted in the Federal Register, the proposal will be open for public comment for 60 days.

SAMHSA also issued a separate notice of proposed rulemaking that would clarify 42 CFR Part 2 to allow courts to release confidential communications related to substance use disorders if the disclosure is needed to investigate or prosecute a serious crime. This would be the case even if the patient was not the one who allegedly committed the crime. The change is described as a “correction” that would help to address a declared public health emergency regarding the national opioid crisis. Comments on the notice will be due 30 days after publication.

Related Insights