This document is scheduled to be published in the Federal Register on 01/18/2017 and available online at https://federalregister.gov/d/2017-00719, and on FDsys.gov DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 42 CFR Part 2 [SAMHSA-4162-20] RIN 0930-AA21 Confidentiality of Substance Use Disorder Patient Records AGENCY: Substance Abuse and Mental Health Services Administration, HHS. ACTION: Final rule. SUMMARY: The Department of Health and Human Services (HHS) is issuing this final rule to update and modernize the Confidentiality of Alcohol and Drug Abuse Patient Records regulations and facilitate information exchange within new health care models while addressing the legitimate privacy concerns of patients seeking treatment for a substance use disorder. These modifications also help clarify the regulations and reduce unnecessary burden. DATES: Effective date: This final rule is effective [INSERT DATE 30 DAYS AFTER DATE OF PUBLICATION IN THE FEDERAL REGISTER]. FOR FURTHER INFORMATION CONTACT: Danielle Tarino, Telephone number: (240) 276-2857, Email address: [email protected]. SUPPLEMENTARY INFORMATION: Preamble Table of Contents I. Executive Summary A. Purpose of the Regulatory Action B. Summary of the Major Provisions C. Summary of Impacts II. Background A. Significant Technology Changes B. Statutory and Rulemaking History III. Overview of the Final Rule IV. Effective Date V. Discussion of Public Comments and Final Modifications to 42 CFR part 2 A. General Comments on the Proposed Rule 1. General Feedback on the Proposed Rule a. General Support for the Proposed Rule b. General Opposition to the Proposed Rule 2. The Proposed Rule Did Not Go Far Enough to Facilitate Information Exchange 3. Final Rule Should Balance Patient Protections with Enhanced Information Exchange 4. Part 2 Should Align with the Health Insurance Portability and Accountability Act B. Statutory Authority (§ 2.1) C. Reports of Violations (§ 2.4) D. Definitions (§ 2.11) 1. New Definitions a. Part 2 Program b. Part 2 Program Director c. Substance Use Disorder d. Treating Provider Relationship e. Withdrawal Management 2. Existing Definitions a. Central Registry b. Disclose or Disclosure c. Maintenance Treatment d. Member Program e. Patient f. Patient Identifying Information g. Person h. Program i. Qualified Service Organization j. Records k. Treatment 3. Terminology Changes 4. Other Comments on Definitions E. Applicability (§ 2.12) F. Confidentiality Restrictions and Safeguards (§ 2.13) 1. Delayed Implementation of List of Disclosures Provision 2. Responsibilities under the List of Disclosures Process 3. Technological Challenges and Burden of the List of Disclosures Provision 4. Recommendations to Further Protect Patient Privacy 5. Other Comments and Recommendations on the List of Disclosures Provision G. Security for Records (§ 2.16) H. Disposition of Records by Discontinued Programs (§ 2.19) I. Notice to Patients of Federal Confidentiality Requirements (§ 2.22) J. Consent Requirements (§ 2.31) 1. General Comments on Consent Requirements 2 a. General b. Consent Form Validity Period c. Technical Challenges to Proposed Consent Requirements d. Requests for Exemptions and Exceptions e. Commenter Recommendations 2. To Whom a. General b. Determination of Treating Provider Relationship c. Requests for Clarification d. Commenter Recommendations e. Proposed Alternative Approach for “To Whom” Section 3. Amount and Kind a. General b. Impact of the Amount and Kind Requirement on Providers and Patients c. Required Substance Use Disorder Information on Consent Forms d. Requests for Clarification 4. From Whom 5. New Requirements K. Prohibition on Re-disclosure (§ 2.32) 1. General 2. Impact of Re-Disclosure Prohibition on Patient Privacy and Patient Choice 3. Disclosure of Information that May Indicate a Substance Use Disorder 4. Technical Challenges in Preventing Unauthorized Re-disclosure 5. Requests for Clarification of the Re-Disclosure Prohibition 6. Recommendations to Improve the Prohibition on Re-Disclosure L. Disclosures to Prevent Multiple Enrollments (§ 2.34) M. Medical Emergencies (§ 2.51) 1. General 2. Definition of “Bona Fide Medical Emergency” 3. Documentation of Medical Emergency 4. Other Comments on Medical Emergency N. Research (§ 2.52) 1. General 2. Suggestions for Improvement of the Research Provisions 3. HIPAA and HHS Common Rule Requirements 4. Data Linkages 5. Multi-Payer Claims Database O. Audit and Evaluation (§ 2.53) P. Other Public Comments on the Proposed Rule 1. Requests to Extend the Public Comment Period 2. Rulemaking Process 3. Implementation Timeline and Other Barriers to Implementation 4. Educational Opportunities 5. Increased Enforcement 6. Other Miscellaneous Comments on the Proposed Rule VI. Rulemaking Analyses 3 A. Paperwork Reduction Act B. Regulatory Impact Analysis C. Regulatory Flexibility Act D. Unfunded Mandates Reform Act E. Federalism (Executive Order 13132) Acronyms ACO Accountable Care Organization ABAM American Board of Addiction Medicine ADAMHA Alcohol, Drug Abuse and Mental Health Administration APCD All Payer Claims Database ARRA American Recovery and Reinvestment Act of 2009 (Pub. L. 111-5) ASAM American Society of Addiction Medicine ATR Access to Recovery C-CDA Consolidated-Clinical Document Architecture CCD Continuity of Care Document CCLF Claim and Claim Line Feed CCO Coordinated Care Organization CFR Code of Federal Regulations CHIP Children's Health Insurance Program CMS Centers for Medicare & Medicaid Services CPCMH Certified Patient-Centered Medical Home DS4P Data Segmentation for Privacy EHR Electronic Health Record EQRO External Quality Review Organization FAQ Frequently Asked Question 4 FAX Facsimile FDA Food and Drug Administration FR Federal Register HHS Department of Health and Human Services HIE Health Information Exchange HIO Health Information Organization HIPAA Health Insurance Portability and Accountability Act of 1996 (Pub. L. 104-191) HITECH Health Information Technology for Economic and Clinical Health Act of 2009 (Pub. L. 111-5, title XIII of division A and title IV of division B) HITPC Health Information Technology Privacy Committee IG Implementation Guide IRB Institutional Review Board IT Information Technology MCO Managed Care Organization MPCD Multi-Payer Claims Database NCQA National Committee for Quality Assurance NPRM Notice of Proposed Rulemaking N-SSATS National Survey of Substance Abuse Treatment Services OHRP Office for Human Research Protections OMB Office of Management and Budget ONC Office of the National Coordinator for Health Information Technology PDMP Prescription Drug Monitoring Program PPS Performing Provider System 5 QE Qualified Entity QSO Qualified Service Organization QSOA Qualified Service Organization Agreement RFA Regulatory Flexibility Act RHIO Regional Health Information Organization SAMHSA Substance Abuse and Mental Health Services Administration SBIRT Screening, Brief Intervention, and Referrals for Treatment S&I Standards and Interoperability TEDS Treatment Episode Data Set U.S.C. United States Code USAO United States Attorney’s Office VA Department of Veterans Affairs I. Executive Summary A. Purpose of the Regulatory Action The laws and regulations governing the confidentiality of substance use disorder records were written out of great concern about the potential use of substance use disorder information against individuals, causing individuals with substance use disorders not to seek needed treatment. The disclosure of records of individuals with substance use disorders has the potential to lead to a host of negative consequences, including: loss of employment, loss of housing, loss of child custody, discrimination by medical professionals and insurers, arrest, prosecution, and incarceration. The purpose of the regulations at title 42 of the Code of Federal Regulations (CFR) part 2 (42 CFR part 2) is to ensure that a patient receiving treatment for a substance use disorder in a part 2 program is not made more vulnerable by reason of the availability of their 6 patient record than an individual with a substance use disorder who does not seek treatment. Now, more than 29 years since the part 2 regulations were last substantively amended, this final rule makes policy changes to the regulations to better align them with advances in the U.S. health care delivery system while retaining important privacy protections. Need for Regulatory Action The last substantive update to these regulations was in 1987. Over the last 29 years, significant changes have occurred within the U.S. health care system that were not envisioned by the current (1987) regulations, including new models of integrated care that are built on a foundation of information sharing to support coordination of patient care, the development of an electronic infrastructure for managing and exchanging patient information, and a new focus on performance measurement within the health care system. SAMHSA wants to ensure that patients with substance use disorders have the ability to participate in, and benefit from health system delivery improvements, including from new integrated health care models while providing appropriate privacy safeguards. These new integrated models are foundational to HHS’s delivery system reform goals of better care, smarter spending, and healthier people. Legal Authority for Regulatory Action This final rule revises 42 CFR part 2, Confidentiality of Alcohol and Drug Abuse Patient Records regulations. The authorizing statute, Title 42, United States Code (U.S.C.) 290dd-2, protects the confidentiality of the records containing the identity, diagnosis, prognosis, or treatment of any patient that are maintained in connection with the performance of any federally assisted program or activity relating to substance abuse (now referred to as substance use disorder) education, prevention, training, treatment, rehabilitation, or research. Title 42 of the 7 CFR part 2 was first promulgated in 1975 (40 FR 27802) and last substantively updated in 1987 (52 FR 21796). B. Summary of the Major Provisions Proposed modifications to 42 CFR part 2 were published as a Notice of Proposed Rulemaking (NPRM) on February 9, 2016 (81 FR 6988). After consideration of the public comments received in response to the NPRM, SAMHSA is issuing this final rule amending 14 major provisions of 42 CFR part 2, as follows: Statutory authority for confidentiality of substance use disorder patient records (§ 2.1) combines old § 2.1 (Statutory authority for confidentiality of drug abuse patient records), and § 2.2 (Statutory authority for confidentiality of alcohol abuse patient records) and deleting references to 42 U.S.C. 290ee-3 and 42 U.S.C. 290dd-3, as these U.S.C. sections were omitted by Public Law 102-321 and combined and renamed into Section 290dd-2, Confidentiality of records. Because SAMHSA combined former §§ 2.1 and 2.2 into § 2.1, we redesignated §§ 2.2 through 2.5 accordingly. Reports of violations (§ 2.4) revises the requirement for reporting violations of these regulations by methadone programs (now referred to as opioid treatment programs) to the Food and Drug Administration (FDA) because the authority over these programs was transferred from the FDA to the Substance Abuse and Mental Health Services Administration (SAMHSA) in 2001. Definitions (§ 2.11) revises some existing definitions, adds new definitions of key terms that apply to 42 CFR part 2, and consolidates all but one of the definitions that are currently in other sections into § 2.11 (e.g., the definition of “Minor” previously found in § 2.14(a)). We revised the definitions of “Central registry,” “Disclose or disclosure,” “Maintenance treatment,” 8 “Member program,” “Patient,” “Patient identifying information,” “Person,” “Program,” “Qualified service organization (QSO),” “Records,” and “Treatment.” We also added definitions of “Part 2 program,” “Part 2 program director,” “Substance use disorder,” “Treating provider relationship,” and “Withdrawal management,” some of which replaced existing definitions. In addition, SAMHSA revised the regulatory text to use terminology in a consistent manner. The following definitions were not revised substantively: “Diagnosis,” “Informant,” “Minor,” “Third-party payer,” and “Undercover agent.” Applicability (§ 2.12) continues to apply the 42 CFR part 2 regulations to a program that is federally assisted and holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment. Most changes to the applicability of the part 2 regulations result from SAMHSA’s decision not to finalize one of its proposed changes to the definition of “Program” (see § 2.11, Definitions). Whereas the NPRM definition of “Program” included, under certain conditions, “general medical practices” in addition to “general medical facilities,” the definition in this final rule is limited to “general medical facilities.” However, consistent with the NPRM, the definition of “Program” continues to use the term “general medical facility” rather than both “general medical facility” and “general medical care facility” that were used interchangeably in the 1987 final rule definition of “Program.” For example, an identified unit within a general medical facility is subject to part 2 if it holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment. In addition, if the primary function of medical personnel or other staff in a general medical facility is the provision of such services and they are identified as providing such services, they are considered a “Program” and, thus, subject to part 2. This final rule revises § 2.12(d)(2)(i)(C) so that restrictions on disclosures also apply to individuals or entities who receive patient records 9 from other lawful holders of patient identifying information, such that patient records subject to the part 2 regulations include substance use disorder records maintained by part 2 programs, as well as those records in the possession of “other lawful holders of patient identifying information.” Confidentiality restrictions and safeguards (§ 2.13) adds a requirement that, upon request, patients who have included a general designation in the “To Whom” section of their consent form (see § 2.31) must be provided a list of entities (referred to as a List of Disclosures) to which their information has been disclosed pursuant to the general designation. Security for records (§ 2.16) clarifies that this section requires both part 2 programs and other lawful holders of patient identifying information to have in place formal policies and procedures addressing security, including sanitization of associated media, for both paper and electronic records. Disposition of records by discontinued programs (§ 2.19) addresses both paper and electronic records. SAMHSA also added requirements for sanitizing associated media. In Section I., Notice to Patients of Federal Confidentiality Requirements (§ 2.22), SAMHSA clarifies that the written summary of federal law and regulations may be provided to patients in either paper or electronic format. SAMHSA also revised § 2.22 to require the statement regarding the reporting of violations include contact information for the appropriate authorities. Consent requirements (§ 2.31) permits, in certain circumstances, a patient to include a general designation in the “To Whom” section of the consent form, in conjunction with requirements that the consent form include an explicit description of the amount and kind of substance use disorder treatment information that may be disclosed. SAMHSA decided not to 10