Possible Changes to Confidentiality of SUD Treatment Records

By Puneet Leekha, JD


The healthcare delivery system in the U.S. is in the midst of massive transformation. Strides are being made at the federal and state levels toward more patient-centered, coordinated care; additional sharing of health information; and greater parity in the treatment of physical and behavioral health conditions. These changes are designed to ensure higher quality of care, improved population health, and lower costs. Underscoring this shift is the significant effort to integrate physical and behavioral health services.

Employee assistance programs (EAPs) are a part of the evolving healthcare environment. As direct or indirect providers of substance use disorder (SUD) treatment, perhaps one of the most confusing areas of this regulatory shift for EAPs is the application of the Federal Confidentiality of Alcohol and Drug Abuse Patient Records law and attendant regulations at 42 C.F.R. Part 2. Last updated in 1987, Part 2 is a set of well-intentioned, but outdated, regulations that provides enhanced protection of SUD treatment records. On February 9, 2016, the Substance Abuse and Mental Health Services Administration (SAMHSA) published a Proposed Rule to update and modernize Part 2 in response to the evolving healthcare environment.

Does Part 2 Apply to EAPs?
Before examining how the Proposed Rule might affect EAPs, it is prudent to revisit the question: Does Part 2 even apply to EAPs? Although there are differing schools of thought, a widely accepted view is that EAPs are subject to the many restrictions on SUD treatment as prescribed by Part 2. It specifically states that EAPs that hold themselves out as providing alcohol or drug abuse diagnosis, treatment, or referral for treatment, are covered by Part 2.

Overview of Changes to Part 2
The following sections offer an overview of key changes to Part 2 set forth in the Proposed Rule. 

* Consent requirements. In the spirit of removing obstacles to a patient’s participation in an integrated care setting, SAMHSA proposes the following changes to the written consent required to disclose SUD treatment information:

“From Whom”. Under current Part 2, a patient can consent to disclosure by a category of facilities or by a single specified program. The Proposed Rule would require a patient to specifically name the Part 2 program(s) or other lawful holder(s) of patient identifying information that is permitted to make a disclosure; general designations would be discouraged.
 
“To Whom”. Currently, a patient must identify the name or title of an individual or specific organization to whom he wants his information disclosed.  SAMHSA proposes to allow a general designation when there is a provider relationship, such as “my treating providers”. Further, the Proposed Rule would allow an individual to designate third party payors by entity name, such as “Medicare”. SAMHSA also proposes to allow a patient to list entities with which there is no treating provider relationship, such as a health information exchange, with certain conditions.

“Amount and Kind”. Part 2 states that a patient must describe how much and what kind of information may be disclosed. SAMHSA proposes that the amount and kind of SUD treatment information be explicitly described, so that a patient is aware of the information he is consenting to be disclosed.

New Consent Fields. SAMHSA proposes to add two fields to the consent form. The first would allow a patient to indicate they understand the terms of the consent. The second would allow a patient who uses a general designation in the “to whom” section to acknowledge his understanding of his right to request and obtain a list of entities to which his information has been disclosed.

* Prohibition on re-disclosure. Part 2 prohibits re-disclosure of SUD treatment information that is received pursuant to a consent form.  The Proposed Rule would clarify that this prohibition only applies to information that would directly or indirectly identify an individual as having been diagnosed, treated, or referred for SUD treatment. Re-disclosure of other health-related information, such as high blood pressure, would not be prohibited, as long as the information does not identify the patient as having or having had a SUD. 

* Qualified service organizations. Part 2 permits disclosure of SUD treatment information without consent to qualified service organizations (QSOs), provided that the Part 2 program and the QSO enter into a Qualified Service Organization Agreement (QSOA). QSOs are individuals or entities that provide services to a Part 2 program, such as data processing, laboratory analyses, or professional services. SAMHSA proposes to include population health management as an example of a service that a QSO can provide under a QSOA. 

* Medical emergencies. Currently, Part 2 permits the disclosure of patient identifying information without consent to medical personnel who have a need for information about a patient to treat a condition that poses an immediate threat to the health of an individual, provided that procedures are followed after disclosure. SAMHSA proposes to revise this medical emergency exception so that information may be disclosed to medical personnel to the extent necessary to meet a bona fide medical emergency in which the patient’s prior consent cannot be obtained. This would afford providers greater discretion in determining when a bona fide medical emergency exists.

* Research. Part 2 also permits the disclosure of patient identifying information without consent for conducting scientific research, subject to certain conditions. The Proposed Rule would relax the restrictions on research activities by allowing the disclosure of SUD treatment information for scientific research, as long as an authorized person ensures certain HIPAA requirements and/or human subjects research regulations are met. Further, researchers would be fully bound by Part 2 and resist in judicial proceedings any efforts to obtain access to patient records except as permitted by Part 2.

* Records. The Proposed Rule would modernize provisions concerning the maintenance, disclosure, access to, and use of written records by applying them to electronic records. SAMHSA would also require Part 2 programs and other lawful holders of patient identifying information to have policies and procedures in place for the security of those records.

Summary
Clearly, EAPs are not immune to health reform and would need to make organizational changes if the final rule is similar to the Proposed Rule. Rest assured, these changes would not be insurmountable. At a minimum, EAPs would need to:
* Update their consent forms for the release of SUD treatment information;
* Revise policies and procedures for releasing SUD treatment information in a medical emergency;
* Review documentation of research relationships involving SUD treatment information; and possibly
* Modify their policies and procedures for ensuring the security of paper and electronic SUD patient records.  

The comment period for the Proposed Rule ended on April 11, 2016, and a final rule is expected in the coming months. Watch the Federal Register (www.federalregister.gov) for more information as it becomes available.

Puneet Leekha, JD, is General Counsel of Chestnut Health Systems and Chestnut Global Partners based in Bloomington, Illinois. 

DISCLAIMER. The information provided in this article is not legal advice, but general educational information. It is not a substitute for the advice of legal counsel.