Confidentiality of Alcohol and Drug Abuse Patient Records, 26929-26932 [2014-10913]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Substance Abuse and Mental Health Services Administration

[Federal Register Volume 79, Number 91 (Monday, May 12, 2014)]
[Proposed Rules]
[Pages 26929-26932]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2014-10913]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Substance Abuse and Mental Health Services Administration

42 CFR Part 2


Confidentiality of Alcohol and Drug Abuse Patient Records

AGENCY: Substance Abuse and Mental Health Services Administration, HHS.

ACTION: Notice of Public Listening Session.

-----------------------------------------------------------------------

SUMMARY: The Substance Abuse and Mental Health Services Administration 
(SAMHSA) announces that it will hold a public listening session on 
Wednesday, June 11, 2014, to solicit information concerning the 
Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 
42 CFR Part 2. This session will be held in Rockville, MD, to obtain 
direct input from stakeholders on updating the regulations. The 
scheduled listening session provides an opportunity for SAMHSA to seek 
public input on potential changes to the regulations.

[[Page 26930]]


DATES: The listening session will be held on Wednesday, June 11, 2014, 
from 9:30 a.m. to 4:30 p.m.

ADDRESSES: Participation: The listening session will be held at the 
Substance Abuse and Mental Health Services Administration at 1 Choke 
Cherry Road, Rockville, MD 20857, Lobby-level Sugarloaf Conference 
Room.
    SAMHSA will post the agenda and logistical information on how to 
participate via the phone or internet on the SAMHSA Web site at https://www.samhsa.gov/healthprivacy in advance of the listening session.
    The session is open to the public and the entire day's proceedings 
will be webcast, recorded, and made publicly available. Interested 
parties may participate in person or via webcast. Capacity is limited 
and registration is required. To register, go to https://42cfrpart2-listeningsession.eventbrite.com. Registration will be open until we 
meet maximum capacity. In addition to attending the session in person 
and joining via webinar, the Agency offers several ways to provide 
comments, as enumerated below. The forum will begin with opening 
remarks from the SAMHSA official charged with moderating the session. 
The session location is accessible to persons with disabilities.
    You may submit comments using any of the following methods:
     Mail: The Substance Abuse and Mental Health Services 
Administration, 1 Choke Cherry Road, Rockville, MD 20857, Room 5-1011.
     Hand Delivery or Courier: 1 Choke Cherry Road, Rockville, 
MD 20857, Room 5-1011 between 9 a.m. and 5 p.m., ET, Monday through 
Friday, except federal holidays.
     Email: PrivacyRegulations@SAMHSA.hhs.gov.
     Fax: 1-240-276-2900.
    Each submission must include the Agency name and the docket number 
for this notice. Comments must be received by 5:00 p.m. ET on Wednesday 
June 25, 2014.

FOR FURTHER INFORMATION CONTACT: For information concerning the 
listening session or the live webcast, please contact Kate Tipping, 
Public Health Advisor, SAMHSA, 1 Choke Cherry Road, Rockville, MD 
20857, Room 5-1011, (240) 276-1652 or email 
PrivacyRegulations@SAMHSA.hhs.gov.

SUPPLEMENTARY INFORMATION: 

I. Background

    The federal statute (United States Code, Title 42, section 290dd-2) 
governing the confidentiality of substance abuse treatment information 
guarantees the confidentiality of information for persons receiving 
substance abuse treatment services from federally assisted programs. 
Under the statute, a federally assisted substance abuse program 
generally may only release identifiable information related to 
substance abuse treatment services with the individual's express 
consent. The federal regulations that implement this law--Title 42 of 
the Code of Federal Regulations Part 2 (42 CFR Part 2)--were last 
updated in 1987. Over the last 25 years, significant changes have 
occurred within the U.S. health care system that were not envisioned by 
these regulations, including new models of integrated care that are 
built on a foundation of information sharing to support coordination of 
patient care, the development of an electronic infrastructure for 
managing and exchanging patient data, the development of prescription 
drug monitoring programs and a new focus on performance measurement 
within the health care system. When the regulations were written, 
substance abuse treatment was primarily conducted by specialty 
treatment providers, and as a result, the impact on coordination of 
care was not raised as a core issue.
    SAMHSA has heard from stakeholders that some of the current consent 
requirements make it difficult for these new health care organizations 
including health information exchange organizations (HIEs), Accountable 
Care Organizations (ACOs), and others to share substance abuse 
treatment information. A number of organizations across the country are 
excluding substance abuse treatment data due to the difficulty and 
expense of implementing the functionality and workflow changes 
necessary to comply with current regulations. In these instances, 
patients are prevented from fully participating in integrated care 
efforts even if they are willing to provide consent.
    Behavioral health is essential to overall health and the costs of 
untreated substance abuse disorders, both personal and societal, are 
enormous. However, treatment for substance abuse disorders is still 
associated with discrimination. In addition, there may be potential 
serious civil and criminal consequences for the disclosure of this 
information beyond the health care context. There continues to be a 
need for confidentiality protections that encourage patients to seek 
treatment without fear of compromising their privacy. SAMHSA strives to 
facilitate information exchange while respecting the legitimate privacy 
concerns of patients due to the potential for discrimination and legal 
consequences. We hope to clarify the requirements associated with 
information exchange in these new models and reduce burdens associated 
with specific consent requirements that do not serve to protect patient 
privacy.
    In consideration of the concerns raised regarding the application 
of 42 CFR Part 2 to new health care models and the continued need for 
confidentiality protections, the Agency will conduct a public listening 
session to provide all interested parties the opportunity to share 
their views on the subject prior to the initiation of rulemaking. 
Members of the public are invited to attend and view the proceedings, 
with space available on a first-come, first-served basis (based on 
registration). Written comments may also be submitted at the session or 
through the process described above.
    SAMHSA asks listening session participants to consider the 
following questions in preparing to make comments at the listening 
session. Listening session attendees will also be provided with a list 
of these questions at the forum site:

a. Applicability of 42 CFR Part 2

    42 CFR Part 2 currently applies to federally funded individuals or 
entities that ``hold themselves out as providing, and provide, alcohol 
or drug abuse diagnosis, treatment or treatment referral'' including 
units within a general medical facility that hold themselves out as 
providing diagnosis, treatment or treatment referral (Sec.  2.11 
Definitions, Program). The U.S. health care system is changing and more 
substance abuse treatment is occurring in general health care and 
integrated care settings which are typically not covered under the 
current regulations. It has also posed difficulties for identifying 
which providers are covered by Part 2; whether a provider or 
organization is covered by Part 2 can change depending on whether they 
advertise their substance abuse treatment services (i.e. `hold 
themselves out'), which can change over time.
    SAMHSA is considering options for defining what information is 
covered under 42 CFR Part 2. Covered information could be defined based 
on what substance abuse treatment services are provided instead of 
being defined by the type of facility providing the services. For 
example, the regulations could be applied to any federally assisted 
health care provider that provides a patient with specialty substance 
abuse treatment services. In

[[Page 26931]]

this scenario, providers would not be covered if they provided only 
substance abuse screening, brief intervention, or other similar pre-
treatment substance abuse services.
     How would redefining the applicability of 42 CFR Part 2 
impact patients, health care provider organizations, HIEs, CCOs, HIT 
vendors, etc.?
     Would this change address stakeholder concerns?
     Would this change raise any new concerns?

b. Consent Requirements

    SAMHSA has heard a number of concerns from individuals and 
stakeholders regarding the current consent requirements of 42 CFR Part 
2. 42 CFR 2.31 requires the written consent to include the name or 
title of the individual or the name of the organization to which the 
disclosure is to be made. This is commonly referred to as the ``To 
Whom'' consent requirement. Some stakeholders have reported that this 
requirement makes it difficult to include programs covered by 42 CFR 
Part 2 in HIEs, health homes, ACOs and CCOs. These organizations have a 
large and growing number of member providers and they generally do not 
have sophisticated consent management capabilities. Currently, a Part 2 
compliant consent cannot include future un-named providers which 
requires the collection of updated consent forms whenever new providers 
join these organizations. As a result, many of these organizations are 
currently not including substance abuse treatment information in their 
systems.
    While technical solutions for managing consent collection are 
possible, SAMHSA is examining the consent requirements in Sec.  2.31 to 
explore options for facilitating the flow of information within the 
health care context while ensuring the patient is fully informed and 
the necessary protections are in place. Specifically, we are analyzing 
the current requirements and considering the impact of adapting them 
to:
    1. Allow the consent to include a more general description of the 
individual, organization, or health care entity to which disclosure is 
to be made.
    2. Require the patient be provided with a list of providers or 
organizations that may access their information, and be notified 
regularly of changes to the list.
    3. Require the consent to name the individual or health care entity 
permitted to make the disclosure.
    4. Require that if the health care entity permitted to make the 
disclosure is made up of multiple independent units or organizations 
that the unit, organization, or provider releasing substance abuse 
related information be specifically named.
    5. Require that the consent form explicitly describe the substance 
abuse treatment information that may be disclosed.
    SAMHSA welcomes comments on patient privacy concerns as well as the 
anticipated impact of the consent requirements on integration of 
substance abuse treatment data into HIEs, health homes, ACOs, and CCOs.
     Would these changes maintain the privacy protections for 
patients?
     Would these changes address the concerns of HIEs, health 
homes, ACOs, and CCOs?
     Would these changes raise any new concerns?

c. Redisclosure

    SAMHSA has also heard numerous concerns regarding the prohibition 
on redisclosure (Sec.  2.32). Currently most EHRs don't support data 
segmentation. Without this functionality, EHR systems must either keep 
alcohol and drug abuse patient records separate from the rest of the 
patient's medical record or apply the 42 CFR Part 2 protections to the 
patient's entire medical record if such record contains information 
that is subject to 42 CFR Part 2.
    SAMHSA is considering revising the redisclosure provision to 
clarify that the prohibition on redisclosure only applies to 
information that would identify an individual as a substance abuser, 
and allows other health-related information shared by the Part 2 
program to be redisclosed, if legally permissible. This would allow HIT 
systems to more easily identify information that is subject to the 
prohibition on redisclosure enabling them to utilize other 
technological approaches to manage redisclosure. If data are associated 
with information about where the data were collected (data provenance) 
which reveals that the data were collected by a practice that 
exclusively treats addiction, the data would still be protected under 
the proposed change.
     Would this type of change facilitate technical solutions 
for complying with 42 CFR Part 2 in an EHR or HIE environment?
     Would these changes maintain the privacy protections for 
patients?

d. Medical Emergency

    SAMHSA has heard concerns regarding the medical emergency exception 
of 42 CFR Part 2 (Sec.  2.51). The current regulations state that 
information may be disclosed without consent ``for the purpose of 
treating a condition which poses an immediate threat to the health of 
any individual and which requires immediate medical intervention.'' The 
statute, however, states that records may be disclosed to medical 
personnel to the extent necessary to meet a bona fide medical 
emergency. SAMHSA is considering adapting the medical emergency 
exception to make it more in-line with the statutory language and to 
give providers more discretion as to when a bona fide emergency exists. 
For example, amending this standard to allow providers to use the 
medical emergency provision to prevent emergencies or to share 
information with a detoxification center when a patient is unable to 
provide informed consent due to their level of intoxication.
     What factors should providers take into consideration in 
determining whether a medical emergency exists?
     Are there specific use cases SAMHSA should take into 
consideration?
     Are there patient concerns about the impact of this change 
on their privacy?

e. Qualified Service Organization (QSO)

    SAMHSA has also heard concerns from payers and health management 
organizations related to disclosing information that is subject to 42 
CFR Part 2 to health care entities (ACOs/CCOs) for the purpose of care 
coordination and population health management; helping them to identify 
patients with chronic conditions in need of more intensive outreach. 
Under the current regulations, substance abuse information may not be 
shared for these purposes without consent.
    SAMHSA is analyzing the regulations to identify options for 
allowing Part 2 data to flow to health care entities for the purpose of 
care coordination and population management while maintaining patient 
protections. One potential solution includes expanding the definition 
of a qualified service organization (QSO; Sec.  2.11) to explicitly 
include care coordination services and to allow a QSO Agreement (QSOA) 
to be executed between an entity that stores Part 2 information, such 
as a payer or an ACO that is not itself a Part 2 program, and a service 
provider.
     Are there other use cases we should be taking into 
consideration?
     Are there specific patient concerns about the impact of 
this change on their privacy?

[[Page 26932]]

f. Research

    Under the current regulations, the Part 2 ``program director'' has 
to authorize the release of information for scientific research 
purposes. This issue has been brought to SAMHSA's attention from 
organizations that store patient health data, including data that are 
subject to Part 2, which may be used for research (e.g. health 
management organizations). Under the current regulatory framework, 
absent consent, these organizations do not have the authority to 
disclose Part 2 data for scientific research purposes to qualified 
researchers or research organizations. This issue can be addressed by 
expanding the authority for releasing data to qualified researchers/
research organizations to other health care entities that receive and 
store Part 2 data, including third-party payers, HIEs, and care 
coordination organizations for the purposes of research, audit, or 
evaluation.
    SAMHSA is considering expanding the authority for releasing data to 
qualified researchers/research organizations to health care entities 
that receive and store Part 2 data, including third-party payers, 
health management organizations, HIEs, and care coordination 
organizations.
     Are there factors that should be considered related to how 
current health care entities are organized, how they function or how 
legal duties and responsibilities attach to entities that make up an 
umbrella organization?
     Would this change address concerns related to research?
     Are there specific privacy concerns associated with 
expanding the authority or releasing data to qualified researchers/
research organizations in this way?
     Are there additional use cases that should be considered 
in the research context?

g. Addressing Potential Issues With Electronic Prescribing and 
Prescription Drug Monitoring Programs (PDMPs)

    Part 2 protections include a prohibition on the redisclosure of 
information received directly from a Part 2 program. A pharmacy that 
receives electronic prescription information directly from a Part 2 
program must obtain patient consent to send that information to a PDMP, 
and patient consent is also required for the PDMP to redisclose that 
information to those with access to the PDMP. Pharmacy data systems do 
not currently have mechanisms for managing patient consent or 
segregating data that are subject to Part 2 and preventing the data 
from reaching the PDMP. Pharmacy systems also lack the ability to 
identify which providers are subject to Part 2, making it difficult to 
prevent the Part 2 data from reaching the PDMP.
    If a patient does not consent to sharing their data via e-
prescribing, their only option for filling their prescription is to 
bring a paper prescription to the pharmacy. In this instance, since the 
information is given by the patient, it is not protected by 42 CFR Part 
2. They, therefore, cannot prevent the information from reaching the 
PDMP which in some states is accessible by law enforcement and has the 
potential to lead to investigation/arrest and other forms of 
discrimination.
     How do pharmacy information system vendors anticipate 
addressing this issue? Are there specific technology barriers SAMHSA 
should take into consideration?
     Are there other concerns regarding 42 CFR Part 2 and 
PDMPs? Please describe relevant use cases and provide recommendations 
on how to address the concerns.
     Are there patient concerns about the impact of e-
prescribing and PDMPs on their privacy?

Draft Agenda for the June 11, 2014 Public Listening Session

--Welcome and Introductions--9:30 a.m.-9:45 a.m.
--Applicability of 42 CFR Part 2--9:45 a.m.-10:45 a.m.
--Consent requirements--10:45 a.m.-11:45 a.m.
--Redisclosure and Medical emergency provisions--11:45 a.m.-12:45 p.m.
--LUNCH (on your own)--12:45 p.m.-1:15 p.m.
--Quality Service Organization (QSO) provision--1:15 p.m.-1:45 p.m.
--Research--1:45 p.m.-2:45 p.m.
--Electronic prescribing and prescription drug monitoring programs 
(PDMPs)--2:45 p.m.-3:30 p.m.
--Open Comment Period--3:30 p.m.-4:30 p.m.

    The agenda will be strictly followed; participants may attend all 
or part of the listening session as relevant. The updated agenda will 
be posted on the SAMHSA Web site at https://www.samhsa.gov/healthprivacy 
in advance of the listening session.

Cathy J. Friedman,
SAMHSA Public Health Analyst.
[FR Doc. 2014-10913 Filed 5-9-14; 8:45 am]
BILLING CODE 4162-20-P