HHS proposes overhaul of privacy rules for addiction treatment patient records

The Department of Health and Human Services (HHS) announced much-anticipated proposed changes to privacy restrictions on patients' substance use treatment records.

HHS is proposing revisions to federal regulations governing the confidentiality of patient records created by federally assisted substance use disorder (SUD) treatment programs to support better care coordination and reduce provider burden while maintaining privacy safeguards for patients, HHS officials said.

The proposed rule will not alter the basic framework for confidentiality protection of SUD patient records created by federally funded treatment programs, HHS officials said.

The changes HHS is proposing will not harmonize the confidentiality statute—known as 42 CFR Part 2 (Part 2)—with the Health Insurance Portability and Accountability Act (HIPAA) privacy protections, which some healthcare stakeholders have advocated for.

During a call with reporters Thursday afternoon, HHS Secretary Alex Azar said such a change would require congressional action.

RELATED: Healthcare groups urge Congress to address patient privacy regulations in final opioid package

In April, two bills were reintroduced in Congress to renew the push to align Part 2 with HIPAA. Reps. Earl Blumenauer, D-Oregon, and Markwayne Mullin, R-Oklahoma, introduced the Overdose Prevention and Patient Safety Act in the House of Representatives, and Sens. Shelley Moore Capito, R-West Virginia, and Joe Manchin, D-West Virginia, introduced the Protecting Jessica Grubb's Legacy Act in the Senate.

Many healthcare provider groups and health IT associations say current Part 2 regulations can hinder care coordination and patient access. 

Initially promoted in 1975, Part 2 predates HIPAA and was designed to protect patients from the stigma associated with substance abuse, which can deter patients from entering treatment.

Outdated regulations have often stood in the way of delivering high-quality, coordinated care, Azar said.

“These changes also reflect the high priority that the Trump Administration places on improving the quality and availability of behavioral healthcare, especially as we combat our nation’s crisis of opioid addiction and substance abuse.”

The emergence of the opioid crisis has created significant clinical and safety challenges for providers, he said.

"Today, doctors considering prescribing opioids or a drug that can interact with opioids, such as a drug for anxiety, cannot query a central database to see whether a patient is enrolled in an opioid treatment program or receiving medications as part of SUD treatment," Azar said. That information gap can be deadly for patients, he added.

The current regulations and onerous legal requirements often discourage primary care providers from caring for SUD patients or recording SUD information, Azar said. Physicians have complained that complying with current Part 2 regulations can mean filling out 11 different kinds of paperwork, HHS Deputy Secretary Eric Hargan said during the call with reporters.

“The lack of critical substance use history in a patient’s medical record can lead to potentially damaging consequences for a person with a substance use disorder and can further stigmatize these conditions,” Assistant Secretary Elinore McCance-Katz said in a statement. “This rule aims to ease the sharing of information, reduce the burden for providers, and increase access to care for individuals while at the same time maintaining important privacy controls.”

RELATED: Provider, health IT groups praise proposed bills to change patient privacy regulations

The proposed changes will make it easier for people struggling with substance use disorders to discuss these issues with their doctors and receive treatment while still ensuring patients' privacy, HHS officials said.

The proposed rule modifies several sections of Part 2 including updating the definition of what constitutes a Part 2 record and its applicability. Treatment records created by non-Part 2 providers based on their own patient encounters will not be covered by Part 2 but will be covered by HIPAA.

The rule also clarifies that personal devices not used by a Part 2 program in the regular course of business do not have to be sanitized (i.e., record deletion) because a SUD patient sends an incidental message to their physician’s personal device.

Non-Part 2 providers under this rule will now have access to central registries to determine whether a patient is enrolled in an opioid treatment program and receiving medications as part of treatment to ensure at-risk patients are not accidentally overprescribed or given prescriptions for which they are seeking treatment.  

Further, Part 2 will continue to prohibit law enforcement use of SUD patient records in criminal prosecution against the patient and will also continue to restrict the disclosure of SUD treatment records without patient consent unless an exception applies.

Hargan said the proposed changes to Part 2 are just the beginning of a "comprehensive agenda" for reforming regulations that govern the delivery and financing of American healthcare, with the ultimate goal of better care, and better health, at a lower cost.