HHS updates substance abuse confidentiality regulations, hints at future HIPAA alignment

The Department of Health and Human Services (HHS) has issued several updates to a patient privacy regulation known as Part 2, which limits sharing of substance abuse data.

The finalized rule, posted (PDF) to the Federal Register on Tuesday, builds on changes to 42 CFR Part 2 released last year that allowed patients to provide a general disclosure for substance abuse information, rather than limiting authorization to a specific provider. At that time, the agency also issued several proposals related to additional disclosures and solicited input from the industry.  

The finalized regulation falls short of broad changes that industry advocates have called for to improve information sharing for patients with substance abuse disorders, including the White House Opioid Commission which recommended changing the regulation to align with HIPAA. Responding to the request for information, commentators illustrated a deep divide between those who want more data sharing to improve care coordination and concerns about the potentially devastating consequences of releasing sensitive substance abuse information.

RELATED: Trump's opioid commission releases final report to combat drug addiction, abuse

Throughout the notice, the Substance Abuse and Mental Health Services Administration (SAMHSA) repeatedly addressed calls for HHS to align Part 2 with HIPAA regulations so that patient information pertaining to substance abuse can be easily shared among providers. Although SAMHSA said that it has tried to align the updates to HIPAA “to the extent feasible,” the agency noted that the Part 2 regulation is “separate and distinct” from other patient privacy laws and provides more stringent protections in order to prevent individuals from discrimination.

“SAMHSA is seeking a balance between protecting the confidentiality of substance use disorder patient records and ensuring that the regulations do not pose a barrier to patients with substance use disorders who wish to participate in, and could benefit from, emerging healthcare models that promote integrated care and patient safety,” the notice stated. “Unauthorized disclosure of substance use disorder patient records can lead to a host of negative consequences, including loss of employment, loss of housing, loss of child custody, discrimination by medical professionals and insurers, arrest, prosecution, and incarceration.”

The agency added that it "plans to explore additional alignment with HIPAA, and may consider additional rulemaking," but the regulation ultimately must conform to a governing statute that only Congress can change.

RELATED: New HIPAA guidance clarifies data sharing for mental health and substance abuse patients

For now, the updates offer some flexibility when it comes to transmitting substance abuse data electronically. For example, the new rule allows providers to use an abbreviated notice prohibiting re-disclosure of substance abuse information that fits the 80-character limit in the free text space of EHRs.

The rule also clarifies the circumstances in which providers can disclose of patient information to contractors and subcontractors for payment and healthcare operations. Notably, SAMHSA decided not to include a proposed list of 17 specific payment and operations activities in the regulatory text, alleviating concerns that “rapid changes occurring in the healthcare payment and delivery system could render any list of activities included in the regulatory text outdated.”

However, information sharing under Part 2 is still limited to information “necessary to carry out the purpose of that disclosure.” The final regulation also noted that organizations that disclose patient identifying information must include in their agreement that the contractor is bound by the provisions of Part 2.

Although the changes simplify the regulation to some extent, Lucia Savage, chief privacy and regulatory officer at Omada Health and the former chief privacy officer at the Office of the National Coordinator for Health IT, says compliance with the regulation remains complicated and confusing. 

"In everyday life, folks often confuse the Part 2 rules with state rules about mental health (not just substance abuse)," she said in an email to FierceHealthcare. "And people are often confused about how to handle information about substance abuse in an emergency room."

Matthew Fisher, a partner with Mirick O’Connell who specializes in privacy law, says that although the finalized rule addresses some general concerns, SAMHSA is “mostly tinkering around the edges.”

“There can only be so much alignment because Part 2 as a whole is designed to put stricter privacy protections into place,” he wrote in an email. “Without a change to the statute, more alignment will be quite hampered.”