HHS' Substance Abuse and Mental Health Services Administration (SAMHSA) on Tuesday published a final rule on medical record confidentiality for patients with substance use disorders that largely maintains restrictions on exchanging such records among providers using alternative payment models.
Background: HHS proposes changes to privacy regulations
Parts of the federal regulations, known as 42 CFR Part 2, prohibit providers from sharing an individual's substance use disorder treatment information even if the patient grants access. The Part 2 rules differ from HIPAA, which allows providers to share records with a patient's consent.
Providers and hospitals that commented on the proposed rule in 2016 said HHS should better align the rules with HIPAA and make it easier for providers participating in alternative payment models to share records to improve care coordination. However, some experts raised privacy concerns.
HHS in the final rule declined to ease the sharing regulation, saying the rule was not intended to cover care coordination. The final rule also stated that "payment and health care operations … are not intended to encompass substance use disorder patient diagnosis, treatment, or referral for treatment."
HHS said it attempted to align the final rule with HIPAA "to the extent feasible," but "Part 2 provides more stringent federal protections than other health privacy laws … and seeks to protect individuals with substance use disorders who could be subject to discrimination and legal consequences in the event that their information is improperly used or disclosed." The agency said it "plans to explore additional alignment with HIPAA, and may consider additional rulemaking."
The final rule does provide some flexibility to providers transmitting substance use disorder data electronically. For instance, the final rule permits providers to use an abbreviated notice to prohibit the re-disclosure of such information. The notice fits in the available text space of electronic health records. In addition, the final rule allows providers and payers to share such information with third parties by using a single consent form. However, the final rule continues to restrict such information sharing to the data "necessary to carry out the purpose of that disclosure."
Lucia Savage, chief privacy and regulatory officer at Omada Health and the former chief privacy officer at HHS' Office of the National Coordinator for Health IT, said the final rule simplifies compliance with Part 2, but overall the rules remain complicated and confusing. "In everyday life, folks often confuse the Part 2 rules with state rules about mental health (not just substance abuse)."
Matthew Fisher, a partner at Mirick O'Connell, said the final rule addresses some general concerns, but "mostly tinkering around the edges." Fisher said, "There can only be so much alignment [with HIPAA] because Part 2 as a whole is designed to put stricter privacy protections into place." He added, "Without a change to the statute, more alignment will be quite hampered" (Davis, Healthcare IT News, 1/2; Diamond, "Pulse," Politico, 1/3; Sweeney, FierceHealthcare, 1/2; Dickson, Modern Healthcare, 1/2).
Here's your cheat sheet for understanding health care's legal landscape
With MACRA, HIPAA, the ACA, and countless others, the health care landscape has become an alphabet soup of legislation. To help you keep up, we've created a series of cheat sheets for some of the most important—and complicated—legal landmarks.
Check them out now for everything you need to know about the Affordable Care Act, antitrust laws, fraud and abuse prevention measures, HIPAA, MACRA, and the two-midnight rule.