On January 18, 2017, the U.S. Department of Health and Human Services (HHS) published a final rule amending the Confidentiality of Substance Use Disorder Patient Records rule at 42 C.F.R. Part 2. Yesterday, HHS delayed the effective date of the rule from February 17 to March 21. While the rule adds some much needed flexibility that will improve the ability to share alcohol and drug abuse treatment records (“part 2 records”) with treating providers through health information exchange, the rule inexplicably makes it tougher to share part 2 records with other entities, such as social service providers, children and family services, criminal justice agencies, or personal health record vendors. Entities that create or receive part 2 records should consider commenting to the new Secretary of HHS and the Office of Management and Budget, if they would like to be able share the Part 2 records with more than treating providers, by requesting that the new administration reopen the new rule to address these issues.
First, the good news. Under current law, it is virtually impossible to disclose part 2 records through an electronic health information exchange network (“HIE”) because a patient must specify each recipient organization by name. This means that, if an HIE includes ten participating health care providers, the patient consent must specify each of the ten health care providers by name. If an eleventh health care provider joins, a patient’s part 2 records may not be shared with the new health care provider (except for in emergency circumstances) unless the patient signs a new consent naming the eleventh health care provider. Because obtaining a new consent from each patient each time a new provider joins the HIE is an extreme administrative burden, the result is that part 2 programs are largely excluded from the HIE. The good news is that the final rule changes this by permitting patient consent to allow disclosure to a specific HIE and generally to all HIE participants with a treating provider relationship with the individual. This part of the final rule should remain. We have published a separate advisory providing additional detail about this and other provisions of the new rule.
But the final rule makes two other changes to consents that could be very problematic. The first is that, under current law, patient consent must include “the name or title of the individual or the organization to which disclosure is to be made.” Accordingly, a patient can specify an entity to receive part 2 records. The final rule that is currently scheduled to take effect on March 21st would change this, requiring a consent to specify an individual, rather than an entity, except for consents to disclose to treating providers, third party payers, and intermediaries (such as HIE organizations or research institutions) who will further disclose to treating providers. As a result, it will be far more difficult to disclose to anyone who is not a treating provider or third party payer. At best, you would need to name each individual within an organization who can receive the information, and obtain new consent each time there is staff turnover. At worst, you would not be able to authorize disclosure of information to, for example, a personal health record vendor because you are unlikely to be able to name specific individuals within the vendor.
As a more detailed example, the Final Rule will have a substantial impact on law enforcement assisted diversion (LEAD) programs. The LEAD model enables law enforcement, prosecutors, public defenders, and substance use disorder treatment programs to reduce recidivism by referring low-level drug offenders to treatment instead of arresting these individuals. To ensure that the LEAD model is effective, treatment providers need to share information with law enforcement, prosecutors, and public defenders regarding an individual’s engagement in services. While treatment providers can readily obtain a written consent from an individual that lists the agencies that will receive the individual’s information as part of LEAD, it is not manageable to list every single police officer, prosecutor, paralegal, public defender, investigator, and administrative assistant who may encounter the individual’s information as part of the diversion process. Accordingly, the new final rule could jeopardize such programs, resulting in individuals getting arrested rather than receiving needed treatment.
The second issue is that the current law provides that a consent must specify “how much and what kind of information is to be disclosed.” The new final rule instead requires the consent to include “how much and what kind of information is to be disclosed, including an explicit description of the substance use disorder information that may be disclosed.” The preamble commentary includes the following explanation:
Nothing in the rule would prevent the development and use of broad categories of the substance use disorder-related information on the Amount and Kind section of the consent form. The types of information that might be requested include diagnostic information, medications and dosages, lab tests, allergies, substance use history summaries, trauma history summary, elements of a medical record such as clinical notes and discharge summary, employment information, living situation and social supports, and claims/encounter data. If options are provided, it is also permissible to provide check boxes next to each option.
In practice, this means long, cumbersome consent forms and significant implementation challenges. Each holder of part 2 records would need to be able to subdivide part 2 records and ensure that only a limited portion of the record is disclosed. HIE networks may not be able to support such granular disclosures, putting us back in the position that part 2 records are effectively excluded from HIE.
While the above two changes will add significant burden to part 2 record holders and significantly impede the flow of part 2 records, it is not clear that these changes will produce significant corresponding benefits to patients. The current law has one of the strictest consent requirements of any law. Have patients been complaining that the current law is not protective enough, and that consents need to be more detailed? The 2016 proposed rule does not suggest that there has been any patient demand for these changes.
The change of the administration may offer an opportunity to correct course on these issues. Part 2 programs and record holders should consider writing to Secretary Price, the new HHS Secretary, SAMHSA, and the Office of Management and Budget requesting the reopening of this final rule and the removal of these changes if they believe their operations are negatively impacted by these changes. Specifically a part 2 program could suggest that:
-
HHS revise § 2.31(a)(4)(i) to permit the consent to include “the name or title of the individual or the name of the organization to which disclosure is to be made.”
-
HHS revise § 2.31(a)(4)(iii)(B)(i) to permit the consent to identify “the name(s) or title(s) of individual participants or the name(s) of an entity participant(s).”
-
HHS revise § 2.31(a)(3) to require the consent to include only “how much and what kind of information is to be disclosed, such as a general description that ‘substance use disorder information’ may be disclosed.”
