The Substance Abuse and Mental Health Services Administration (SAMHSA), a part of the U.S. Department of Health and Human Services, recently unveiled major revisions to the Substance Abuse Confidentiality Regulations (42 C.F.R. Part 2, or “Part 2”). These revisions are intended to modernize the regulations, which are currently stringent in comparison with other privacy laws, including the Health Insurance Portability and Accountability Act (HIPAA).
The Part 2 regulations strictly regulate federally assisted drug and alcohol treatment programs. The law in fact regulates most substance abuse programs because “federal assistance” is defined broadly under the law. It includes DEA certification for distribution of controlled substances, tax-exempt status for federal income, or the receipt of any federal funds, regardless of whether they directly support treatment services. The rules restrict disclosure of records which could reasonably identify a patient as someone receiving alcohol or drug abuse treatment services.
This is the first major revision to the Part 2 regulations since they were first published in 1987. The revisions generally loosen the previously strict restrictions on patient consent and disclosure. There are many revisions to the existing law, but below are some of the most important changes:
- The definition of programs covered has been clarified and broadened to “substance use disorder,” replacing the older definitions of “alcohol abuse” and “drug abuse.”
- The definition of records has been expanded to include information relating to a patient, regardless of whether it is recorded, and now explicitly includes both paper and electronic records.
- Patients may now designate records recipients more broadly. Previously, patients had to list the specific designee of the information, such as a named provider. The proposed rule allows patients to agree to disclose records to a general designee, such as a payer or a health information exchange. The patient does not need to specify the recipient by name in every case. In some cases, the patient may even specify an entire class of entities receiving information, so long as they have a treatment-provider relationship with the patient, such as “all future treatment providers.” However, the patient has a right of accounting of disclosures in the case of a general designation.
- Patient consent now requires the patient to explicitly specify the type of substance use disorder treatment information that is being disclosed.
- The limitations on redisclosures are clarified to only apply to “information that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder.” Patient information may otherwise be disclosed according to any other applicable laws.
These proposals are now open for comments until April 11, 2016, after which SAHMSA will finalize the new rules. Those interested can comment here. Full text of the proposed revisions to the rules are available here.