Confidentiality of Substance Use Disorder Patient Records, 5485-5490 [2017-00742]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of the Secretary

[Federal Register Volume 82, Number 11 (Wednesday, January 18, 2017)]
[Proposed Rules]
[Pages 5485-5490]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2017-00742]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

42 CFR Part 2

[SAMHSA-4162-20]
RIN 0930-ZA07


Confidentiality of Substance Use Disorder Patient Records

AGENCY: Substance Abuse and Mental Health Services Administration, HHS.

ACTION: Supplemental notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: On Feb. 9, 2016, the Substance Abuse and Mental Health 
Services Administration (SAMHSA) published a Notice of Proposed 
Rulemaking (NPRM) that proposed policy changes to update and modernize 
the Confidentiality of Alcohol and Drug Abuse Patient Records (42 CFR 
part 2). SAMHSA explained in the NPRM that these changes were intended 
to better align the regulations with advances in the U.S. health care 
delivery system while retaining important privacy protections for 
individuals seeking treatment for substance use disorders. The last 
substantive update to these regulations was in 1987. SAMHSA is issuing 
this Supplemental Notice of Proposed Rulemaking (SNPRM) to propose 
additional clarifications to the part 2 regulations as amended by the 
concurrently issued final rule. As noted in the final rule, 42 CFR part 
2 Confidentiality of Substance Use Disorder Patient Records, questions 
raised by commenters highlighted varying interpretations of the 1987 
rule's restrictions on lawful holders and their contractors and 
subcontractors' use and disclosure of part 2-covered data for purposes 
of carrying out payment, health care operations, and other health care 
related activities. In consideration of this feedback and given the 
critical role that third-party payers, other lawful holders, and their 
contractors, subcontractors, and legal representatives play in the 
provision of health care services, SAMHSA is issuing this SNPRM to seek 
further comments on our proposals to address and help clarify these 
matters before establishing any appropriate restrictions on disclosures 
to contractors, subcontractors and legal representatives.

DATES: To be assured consideration, comments must be received at one of 
the addresses provided below, no later than 5 p.m. on February 17, 
2017.

ADDRESSES: You may submit comments, identified by Regulatory 
Information Number (RIN) 0930-AA21, by any of the following methods:
    Electronically: Federal eRulemaking Portal: Go to https://www.regulations.gov and follow the instructions for submitting 
comments.
    Regular, Express or Overnight Mail, or Hand Delivery or Courier: 
Written comments sent by hand delivery, or mailed by regular, express, 
or overnight mail must be sent to the following address ONLY: The 
Substance Abuse and Mental Health Services Administration, Department 
of Health and Human Services, Attn: Danielle Tarino, SAMHSA, 5600 
Fishers Lane, Room 13E89A, Rockville, Maryland 20857.
    Please allow sufficient time for mailed comments to be received 
before the close of the comment period.
    Instructions: To avoid duplication, please submit only one copy of 
your comments by only one method. All submissions received must include 
the agency name and docket number or RIN for this rulemaking. All 
comments received will become a matter of public record and will be 
posted without change to https://www.regulations.gov, including any 
personal information provided. For detailed instructions on submitting 
comments and additional information on the rulemaking process and 
viewing public comments, see the ``Request for Public Comments'' 
heading of the SUPPLEMENTARY INFORMATION section of this document.
    Docket: For access to the docket to read background documents or 
comments received, go to https://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT: Danielle Tarino, SAMHSA, 5600 Fishers 
Lane, Room 13E89A, Rockville, Maryland 20857, 240-276-2857, Email 
address: Danielle.Tarino@samhsa.hhs.gov

SUPPLEMENTARY INFORMATION:

Background

    On February 9, 2016, SAMHSA published an NPRM in the Federal 
Register (81 FR 6987) proposing updates to regulations for the 
Confidentiality of Alcohol and Drug Abuse Patient Records (42 CFR part 
2). These regulations implement title 42, section

[[Page 5486]]

290dd-2 of the United States Code pertaining to Confidentiality of 
Records. SAMHSA explained in that NPRM, it proposed to update these 
regulations, last substantively amended in 1987, to reflect development 
of integrated health care models and growing use of electronic means 
for exchanging patient information. At the same time, SAMHSA wished to 
maintain protections for (part 2) patient identifying information, as 
persons with substance use disorders still may encounter significant 
discrimination if their information is improperly disclosed.
    Elsewhere in this issue of the Federal Register SAMHSA published a 
final rule. In response to public comments, the final rule provides for 
greater flexibility in disclosing (part 2) patient identifying 
information within the health care system while continuing to address 
the privacy concerns of patients seeking treatment for a substance use 
disorder. SAMHSA received 376 comments on the NPRM. SAMHSA received a 
number of comments to the NPRM that went beyond what SAMHSA was 
proposing. Some commenters to the NPRM urged SAMHSA to clarify the 
scope of permitted disclosures of (part 2) patient identifying 
information by third-party payers. Some commenters asked that the 
current and proposed Qualified Service Organization (QSO) (part 2) 
patient identifying information disclosure provisions be applied to 
disclosures by third-party payers and other lawful holders of (part 2) 
patient identifying information to support health care operations and 
payment. Some commenters suggested doing this through the expansion of 
the definition of QSO. For instance, one commenter suggested that the 
definition of qualified service organization include ``lawful holders 
of [p]art 2 patient identifying information,'' stating that ACOs often 
engage analytics companies to provide support in identifying those 
high-risk patients who would benefit from care management and other 
services. Another commenter suggested expanding provisions concerning 
audits and evaluations to permit CMS to disclose (part 2) patient 
identifying information to ACOs and bundled payment participating 
entities for program audit and evaluation purposes. Others noted that 
QSOs themselves, as well as state Medicaid programs often use software 
vendors and other contractors, subcontractors, and legal 
representatives to carry out administrative and claims processing 
functions. A commenter further urged that the tasks that could be 
carried out under the QSO policies not only be broadened to include 
population health management activities but also ``clinical 
professional support services (e.g., quality improvement initiatives, 
utilization review and management services); third-party liability and 
coordination of benefit support services; activities related to 
preventing fraud, waste and abuse; and other activities and functions 
typically performed by contractors for or on behalf of third-party 
payers.''
    In developing the final rule, SAMHSA responded directly to several 
of these public comments about the NPRM. For instance, the ``To Whom'' 
discussion in the preamble to the final rule provides that: ``[f]or 
purposes of payment-related activities, to the extent that federal or 
state law authorizes or requires that the Medicaid or Medicare agency 
or program share data or enter into a contractual arrangement or other 
formal agreements to do so, written consent to disclose patient 
identifying information to the agencies or programs (as a third-party 
payer) under section 2.31(a)(4)(iii)(A) is considered to extend to the 
contractors, subcontractors, and legal representatives of the agencies 
or programs.'' SAMHSA discussed in the final rule preamble that a 
``lawful holder'' of (part 2) patient identifying information is an 
individual or entity who has received such information as the result of 
a part 2-compliant patient consent (with a prohibition on re-disclosure 
notice) or as permitted under the part 2 statute, regulations, or 
guidance and, therefore, is bound by 42 CFR part 2.
    One commenter indicated that state Medicaid agencies hire 
contractors for a wide array of ``administrative functions''; and that 
those contractors and vendors accessed (part 2) patient identifying 
information to carry out these activities. Other comments noted the 
role of third-parties in Medicaid program claims processing. Another 
commenter suggested that, given the role of MCOs, state Medicaid 
agencies and other programs, whether a patient designated the ``name of 
the state agency, the MCO or simply Medicaid, the rule should consider 
consent to apply to the State and its contracted delivery system.'' 
Another commenter similarly urged that ``In order to ensure that 
Medicaid programs can carry out its operational requirements, consent 
that names the Medicaid agency or the MCO should permit disclosure to 
the entity's contractors, when necessary.''
    With respect to lawful holders, certain commenters requested 
changes to or highlighted the need for additional guidance regarding 
how third-party payers may use and disclose (part 2) patient 
identifying information (as defined in 42 CFR 2.11) as they carry out 
their payment and health care operations. One commenter asked for 
explicit confirmation that Medicaid plans were allowed to process 
claims through a contracted entity (e.g., Medicaid managed care 
organizations (MCOs)). Similarly, another commenter recommended that 
the rule clarify that a patient's naming of the state agency, the MCO, 
or simply Medicaid were all adequate to consent to allowing the 
patient's information to be released to whichever entity actually 
conducted the required functions on behalf of the third-party payer. 
One commenter suggested that such payers should be viewed as 
intermediaries for purposes of sharing substance use disorder 
information with treating providers. Other commenters noted that 
Medicaid agencies and MCOs both require access to (part 2) patient 
identifying information for the purposes of payment. Another commenter 
discussed the history of the part 2 rules and asserted that the 
governing statute, 42 U.S.C. 290dd-2, does not require treating third-
party payers differently than other payers. The commenter further 
asserted that ``[e]ssentially all third-party payers contract with 
third parties to obtain services and perform activities that involve 
specialized expertise, equipment or other resources that the payer does 
not maintain in-house due to the associated administrative and other 
costs.''
    These comments, while not addressing specific changes proposed in 
the NPRM, have prompted SAMHSA to propose additional clarifications and 
modifications to the part 2 rules to clarify the scope of permissible 
disclosures. In an effort to address some of the commenters' requests 
and recommendations for clarity SAMHSA is concurrently issuing this 
SNPRM with the final rule to elicit public comment on these additional 
proposals to further clarify and expound upon these pertinent comments. 
We seek comment on our proposals regarding the following concepts and 
provisions: The payment and health care operations-related disclosures 
that can be made to contractors, subcontractors, and legal 
representatives by lawful holders under the part 2 rule consent 
provisions; and the provisions governing disclosures for purposes of 
carrying out a Medicaid, Medicare or Children's Health Insurance 
Program (CHIP) audit or evaluation. SAMHSA will take any such comments 
under consideration if it engages in further rulemaking in the future.

[[Page 5487]]

    SAMHSA will consider the public comments on this SNPRM, any 
relevant comments already received on these subjects in response to the 
February 9, 2016, NPRM and relevant comments made at the June 11, 2014 
listening session on part 2 (see 79 FR 26929) before issuing a final 
rule.

Proposed Provisions

    SAMHSA seeks comment on proposals in this SNPRM to retain the 
notice found in Sec.  2.32 but consider whether an abbreviated notice 
would be appropriate and in which circumstances, further revise Sec.  
2.33 (Disclosures permitted with written consent) define and limit the 
circumstances in which certain disclosures for the purposes of payment 
and health care operations can be made; and similarly to further revise 
Sec.  2.53 (Audit and Evaluation) to expressly address further 
disclosures by contractors, subcontractors, and legal representatives 
for purposes of carrying out a Medicaid, Medicare, or CHIP audit or 
evaluation. SAMHSA also seeks comment on its proposals regarding the 
establishment of appropriate restrictions and safeguards on lawful 
holders and their contractors, subcontractors, and legal 
representatives' use and disclosure of (part 2) patient identifying 
information for the purposes discussed in this SNPRM. SAMHSA is not 
soliciting comments on any other issues relating to the final rule and 
will not consider comments at this time that address changes to part 2 
other than those contemplated in this SNPRM.

Section 2.32 Prohibition on Re-Disclosure

    SAMHSA does not propose to substantively modify the existing notice 
at 2.32, but seeks comment on whether it should add a shorter 
abbreviated statement in subsection (a) Notice to accompany re-
disclosure to be used in certain circumstances (e.g., for particular 
types of disclosures or technical systems) where a shorter notice may 
be warranted. An abbreviated statement could read, for example, ``Data 
is subject to 42 CFR part 2. Use/disclose in conformance with part 2.''

Section 2.33 Disclosures Permitted With Written Consent

    SAMHSA understands that contractors, subcontractors, and legal 
representatives play an integral role in the management, delivery, and 
payment of health care services, but believes that limits should be 
placed on disclosures of (part 2) patient identifying information to 
such entities to carry out these activities. As such, SAMHSA seeks 
public comment on its proposal to explicitly list and limit under Sec.  
2.33(b), specific types of activities for which any lawful holder of 
(part 2) patient identifying information would be allowed to further 
disclose the minimal information necessary for specific payment and 
health care operations activities described below. While lawful holders 
may disclose (part 2) patient identifying information to contractors, 
subcontractors, and legal representatives for these purposes, this 
proposal makes clear the scope and requirements for those permitted 
disclosures. To the extent that a written consent permits the use of 
part 2 patient identifying information for payment or healthcare 
operations, this provision at Sec.  2.33(b) specifies that the further 
disclosures specified below can be made. SAMHSA notes that this list of 
activities related to payment and health care operation is similar to 
the HIPAA Privacy Rule's definition of the terms ``payment'' and 
``health care operations,'' although SAMHSA is not adopting those 
definitions in their entirety. The payment and health care operation 
activities listed in this section does not include activities that 
SAMHSA considers to be related to the patient's diagnosis, treatment, 
or referral for treatment. SAMHSA believes it is important to maintain 
patient choice in disclosing information to health care providers with 
whom they will have direct contact. For these reasons, this provision 
will not cover care coordination or case management and the proposal 
provides that disclosures to contractors, subcontractors, and legal 
representatives to carry out other purposes are not permitted under 
this section. SAMHSA will consider certain payment or health care 
operations-related activities permissible for lawful holders to 
disclose to contractors, subcontractors, or legal representatives as 
long as the activities fit within the overall purpose of the written 
consent. See paragraphs (b)(1) through (17) of Sec.  2.33
    SAMHSA also solicits comment on whether the proposed listing of 
explicitly permitted activities is adequate and appropriate to ensure 
the health care industry's ability to conduct necessary payment and the 
described health care operational functions, while still affording 
adequate privacy protections for the individuals who were diagnosed, 
treated, or referred for treatment. We note that contractors, 
subcontractors, and legal representatives that would receive data under 
this provision would become lawful holders upon receipt of such data, 
and, as such, would themselves be subject to the part 2 requirements. 
Moreover, consent would still be required and disclosures must be made 
in accordance with section 2.13(a), Confidentiality restrictions and 
safeguards, which states that ``[a]ny disclosure made under these 
regulations must be limited to that information which is necessary to 
carry out the purpose of the disclosure.'' Consequently, the stated 
purpose of a written consent limits the scope of the disclosures with 
respect to the (part 2) patient identifying information disclosed. In 
addition, lawful holders that disclose (part 2) patient identifying 
information to contractors, subcontractors, and legal representatives 
for payment and the described health care operations may only disclose 
(part 2) patient identifying information to contractors, 
subcontractors, and legal representatives that perform a function that 
is consistent with the stated purpose of the consent and only to 
perform that function. SAMHSA seeks comments on the proper mechanisms 
to convey the scope of the consent to lawful holders, contractors, 
subcontractors, and legal representatives, including those who are 
downstream recipients of (part 2) patient identifying information given 
current electronic data exchange technical designs.
    SAMHSA also believes that it is critical that contractors, 
subcontractors, and legal representatives understand their obligations 
with respect to (part 2) patient identifying information. Accordingly, 
SAMHSA proposes new regulatory text under Sec.  2.33(c) requiring that 
lawful holders that engage contractors and subcontractors to carry out 
payment and the described health care operations that will entail using 
or disclosing (part 2) patient identifying information include specific 
contract and subcontract provisions requiring contractors and 
subcontractors to comply with the provisions of part 2. An appropriate 
comparable instrument will suffice in cases where there is otherwise no 
contract between the lawful holder and a legal representative who is 
retained voluntarily (as opposed to one who is required to represent 
the lawful holder by law, in which case the requirement for a contract 
or comparable instrument in 2.33(c) shall not apply). SAMHSA proposes 
to amend subsection (b) and add a new subsection (c) to the disclosure 
permitted with written consent provisions at Sec.  2.33. SAMHSA seeks 
comment on the proposal to revise

[[Page 5488]]

disclosures permitted with written consent provision in Sec.  2.33.

Section 2.53 Audit and Evaluation

    SAMHSA recognized in the final rule the critical importance of 
audits and evaluations. Accordingly, SAMHSA made clear that disclosures 
of patient identifying information to ACO's and similar CMS-regulated 
entities to carry out Medicare, Medicaid and Children's Health 
Insurance Program (CHIP) audit and evaluation activities are permitted.
    However, public comments requested further specification regarding 
the permitted disclosures of (part 2) patient identifying information 
for audit and evaluation purposes. Public commenters noted that, as 
with other payment and health care operations, contractors, 
subcontractors, and legal representatives may be tasked with conducting 
audit and evaluation activities. Such entities may not be CMS-
regulated, and may be conducted for private payers as well as Medicare 
and Medicaid programs. In addition, commenters noted that audits and 
evaluations may include quality improvement activities, as well as 
efforts related to reimbursement and financing. As such, SAMHSA 
proposes further amendment as set out in the regulatory text of section 
2.53.

Request for Public Comments

    SAMHSA believes that the new proposals and clarifications discussed 
above will provide the desired solutions and understanding sought by 
commenters to the NPRM, while also offering patient protections 
appropriate to the current health care environment.
    In making these proposals, SAMHSA notes that such payment and the 
described health care operations and audit and evaluation functions 
will still be governed by other applicable laws and regulations, such 
as the HIPAA Privacy and Security Rules, in addition to 42 CFR part 2.
    SAMHSA notes that the fact that lawful holders and part 2 programs 
are permitted to disclose data in no way obviates the overarching 
purpose of part 2: to protect (part 2) patient identifying information 
for patients seeking diagnosis, treatment, or referral for treatment 
for substance use disorders. Lawful holders and part 2 programs have 
responsibility to exercise due diligence with respect to their 
contractors, subcontractors, or legal representatives to whom they 
disclose or with whom they exchange (part 2) patient identifying 
information. Should the changes in this SNPRM be adopted, SAMHSA 
anticipates issuing further guidance about these topics.
    SAMHSA seeks specific comment on the implications of these proposed 
changes on the privacy and confidentiality of records concerning 
substance use disorder diagnosis, prognosis and treatment, and referral 
for treatment and overall goals of the part 2 rules, and the regulatory 
and financial impact, if any, of these proposals.
    SAMHSA also seeks comments on the following for its consideration 
in future rulemaking and guidance:
    (1) Additional purposes for which lawful holders should be able to 
disclose (part 2) patient identifying information,
    (2) Further subregulatory guidance that SAMHSA and other agencies 
could provide to help facilitate implementation of 42 CFR part 2 in the 
current healthcare environment.

Regulatory Impact Analysis (RIA)

    In this SNPRM, SAMHSA proposes clarifications and revisions of the 
following: The disclosures permitted with written consent (Sec.  2.33), 
the payment and health care operations activities for which lawful 
holders may disclose (part 2) patient identifying information to their 
contractors, subcontractors, and legal representatives; and the audit 
and evaluation provision that permit certain disclosures for purposes 
of carrying out a Medicaid, Medicare or CHIP audit and evaluation 
(Sec.  2.53).
    SAMHSA has analyzed the costs of complying with the proposed 
regulations in this supplemental NPRM. SAMHSA does not believe these 
revisions, if ultimately adopted, will result in any additional costs 
to Part 2 programs. Based on public comments, SAMHSA anticipates that 
these modifications will enhance efficiency of such payment and health 
care operations as claims processing, business management, training and 
customer service. The proposal specifies that lawful holders who 
receive part 2 records under the terms of a patient's written consent 
are permitted to further disclose those records to their contractors, 
subcontractors, and legal representatives to carry out payment and 
certain health care operations described in the SNPRM. When information 
is shared with contractors, subcontractors, and legal representatives, 
contract and subcontract provisions (or provisions in an appropriate 
comparable instrument in the case of certain legal representatives) 
must be included requiring these entities to comply with the provisions 
of part 2. Changes proposed to the audit and evaluation provisions will 
make clear that the individual or entity receiving (part 2) patient 
identifying information for audit and evaluation or quality improvement 
purposes is permitted to further disclose this information to 
contractor(s) or subcontractor(s) to complete these activities. Should 
these proposals ultimately be adopted, SAMHSA does not anticipate 
entities will incur any additional costs beyond those analyzed in the 
Final Rule. Nonetheless, SAMHSA seeks comments on costs and benefits of 
this change for part 2 programs and any burdens these proposed changes 
may impose on regulated entities.
    Under the Paperwork Reduction Act of 1995 (PRA), agencies are 
required to provide a 60-day notice in the Federal Register and solicit 
public comment before a collection of information requirement is 
submitted to the Office of Management and Budget (OMB) for review and 
approval. PRA issues are discussed in the final rule. SAMHSA 
anticipates no substantive changes in PRA requirements should changes 
proposed in the SNPRM be adopted. SAMHSA seeks and will consider public 
comment on our assumptions as they relate to the PRA requirements.
    SAMHSA has examined the impact of this proposed rule under 
Executive Order 12866 on Regulatory Planning and Review (September 30, 
1993), Executive Order 13563 on Improving Regulation and Regulatory 
Review (January 18, 2011), the Regulatory Flexibility Act of 1980 (Pub. 
L. 96-354, September 19, 1980), the Unfunded Mandates Reform Act of 
1995 (Pub. L. 104-4, March 22, 1995), and Executive Order 13132 on 
Federalism (August 4, 1999).
    Executive Order 12866 directs agencies to assess all costs and 
benefits of available regulatory alternatives and, if regulation is 
necessary, to select regulatory approaches that maximize net benefits 
(including potential economic, environmental, public health, and safety 
effects; distributive impacts; and equity). Executive Order 13563 is 
supplemental to and reaffirms the principles, structures, and 
definitions governing regulatory review as established in Executive 
Order 12866. SAMHSA expects that the changes proposed in this SNPRM, if 
adopted, will not have an annual effect on the economy of $100 million 
or more in at least 1 year. Therefore, this rule will not be an 
economically significant regulatory action as defined by Executive 
Order 12866.
    The Regulatory Flexibility Act (RFA) requires agencies that issue a 
regulation to analyze options for regulatory relief of small businesses 
if a rule has a

[[Page 5489]]

significant impact on a substantial number of small entities. The RFA 
generally defines a ``small entity'' as (1) a proprietary firm meeting 
the size standards of the Small Business Administration; (2) a 
nonprofit organization that is not dominant in its field; or (3) a 
small government jurisdiction with a population of less than 50,000 
(States and individuals are not included in the definition of ``small 
entity''). For similar rules, HHS considers a rule to have a 
significant economic impact on a substantial number of small entities 
if at least 5 percent of small entities experience an impact of more 
than 3 percent of revenue. SAMHSA anticipates that the proposals in 
this SNPRM, if adopted, will not have a significant economic impact on 
a substantial number of small entities.
    Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires 
that agencies prepare a written statement, which includes an assessment 
of anticipated costs and benefits, before proposing ``any rule that 
includes any Federal mandate that may result in the expenditure by 
State, local, and tribal governments, in the aggregate, or by the 
private sector, of $100,000,000 or more (adjusted annually for 
inflation) in any one year.'' The current threshold after adjustment 
for inflation is $146 million, using the most current (2015) implicit 
price deflator for the gross domestic product. The proposals in this 
SNPRM, if adopted, would not trigger the Unfunded Mandate Reform Act 
because it will not result in expenditures of this magnitude by states 
or other government entities.

List of Subjects in 42 CFR Part 2

    Alcohol abuse, Alcoholism, Drug abuse, Grant programs--health, 
Health records, Privacy, Reporting, and Recordkeeping requirements.
    For the reasons stated in the preamble, SAMHSA proposes to amend 42 
CFR part 2 as follows:

PART 2--CONFIDENTIALITY OF SUBSTANCE USE DISORDER PATIENT RECORDS

0
1. The authority citation for part 2 continues to read as follows:

    Authority: Sec. 408 of Pub. L. 92-255, 86 Stat. 79, as amended 
by sec. 303(a), (b) of Pub L. 93-282, 83 Stat. 137, 138; sec. 
4(c)(5)(A) of Pub. L. 94-237, 90 Stat. 244; sec. 111(c)(3) of Pub. 
L. 94-581, 90 Stat. 2852; sec. 509 of Pub. L. 96-88, 93 Stat. 695; 
sec. 973(d) of Pub. L. 97-35, 95 Stat. 598; and transferred to sec. 
527 of the Public Health Service Act by sec. 2(b)(16)(B) of Pub. L. 
98-24, 97 Stat. 182 and as amended by sec. 106 of Pub. L. 99-401, 
100 Stat. 907 (42 U.S.C. 290ee-3) and sec. 333 of Pub. L. 91-616, 84 
Stat. 1853, as amended by sec. 122(a) of Pub. L. 93-282, 88 Stat. 
131; and sec. 111(c)(4) of Pub. L. 94-581, 90 Stat. 2852 and 
transferred to sec. 523 of the Public Health Service Act by sec. 
2(b)(13) of Pub. L. 98-24, 97 Stat. 181 and as amended by sec. 106 
of Pub. L. 99-401, 100 Stat. 907 (42 U.S.C. 290dd-3), as amended by 
sec. 131 of Pub. L. 102-321, 106 Stat. 368, (42 U.S.C. 290dd-2).

Subpart B--General Provisions

0
2. Revise Sec.  2.33 to read as follows:


Sec.  2.33  Disclosures permitted with written consent.

    (a) If a patient consents to a disclosure of their records under 
Sec.  2.31, a program may disclose those records in accordance with 
that consent to any person or category of persons identified or general 
designated in the consent, except that disclosures to central 
registries and in connection with criminal justice referrals must meet 
the requirements of Sec. Sec.  2.34 and 2.35, respectively.
    (b) If a patient consents to a disclosure of their records under 
Sec.  2.31 for payment and/or health care operations activities, a 
lawful holder who receives such records under the terms of the written 
consent may further disclose those records as may be necessary for its 
contractors, subcontractors, or legal representatives to carry out 
payment and/or the following health care operations on behalf of such 
lawful holder. Disclosures to contractors, subcontractors, and legal 
representatives to carry out other purposes are not permitted under 
this section. In accordance with Sec.  2.13(a), disclosures under this 
section must be limited to that information which is necessary to carry 
out the stated purpose of the disclosure.
    (1) Billing, claims management, collections activities, obtaining 
payment under a contract for reinsurance, claims filing and related 
health care data processing;
    (2) Clinical professional support services (e.g., quality 
assessment and improvement; initiatives, utilization review and 
management services);
    (3) Patient safety activities;
    (4) Activities pertaining to:
    (i) The training of student trainees and health care professionals;
    (ii) The assessment of practitioner competencies; and
    (iii) The assessment of provider and/or health plan performance;
    (iv) Training of non-health care professionals;
    (5) Accreditation, certification, licensing, or credentialing 
activities;
    (6) Underwriting, enrollment, premium rating, and other activities 
related to the creation, renewal, or replacement of a contract of 
health insurance or health benefits, and ceding, securing, or placing a 
contract for reinsurance of risk relating to claims for health care;
    (7) Third-party liability coverage;
    (8) Activities related to addressing fraud, waste and abuse;
    (9) Conducting or arranging for medical review, legal services, and 
auditing functions;
    (10) Business planning and development, such as conducting cost-
management and planning-related analyses related to managing and 
operating, including formulary development and administration, 
development or improvement of methods of payment or coverage policies;
    (11) Business management and general administrative activities, 
including, but not limited to, management activities relating to 
implementation of and compliance with the requirements of this or other 
statutes or regulations;
    (12) Customer services, including the provision of data analyses 
for policy holders, plan sponsors, or other customers;
    (13) Resolution of internal grievances;
    (14) The sale, transfer, merger, consolidation, or dissolution of 
an organization;
    (15) Determinations of eligibility or coverage (e.g. coordination 
of benefit services or the determination of cost sharing amounts), and 
adjudication or subrogation of health benefit claims;
    (16) Risk adjusting amounts due based on enrollee health status and 
demographic characteristics;
    (17) Review of health care services with respect to medical 
necessity, coverage under a health plan, appropriateness of care, or 
justification of charges.
    (c) Lawful holders who wish to disclose patient identifying 
information pursuant to subsection (b) of this section must enter into 
a written contract with the contractor (or appropriate comparable 
instrument in the case of a legal representative retained voluntarily 
by the lawful holder), which provides that the contractor and any 
subcontractor or legal representative are or will be fully bound by the 
provisions of part 2 upon receipt of the patient identifying data, and, 
as such that each disclosure shall be accompanied by the notice 
required under Sec.  2.32. In making such disclosure, the lawful holder 
should specify permitted uses of patient identifying information 
consistent with the written consent, by the contractor and any 
subcontractors or legal

[[Page 5490]]

representatives to carry out the payment and health care operations 
activities listed in the preceding subparagraph, require such 
recipients to implement appropriate safeguards to prevent unauthorized 
uses and disclosures and require such recipients to report any 
unauthorized uses, disclosures, or breaches of patient identifying 
information to the lawful holder. The lawful holder should only 
disclose information to the contractor or subcontractor or legal 
representative that is necessary for the contractor or subcontractor to 
perform its duties under the contract. Also, the contract does not 
permit a contractor or subcontractor or legal representative to re-
disclose information to a third party unless that third party is a 
contract agent of the contractor or subcontractor, helping them provide 
services described in the contract, and only as long as the agent only 
further discloses the information back to the contractor or lawful 
holder from which the information originated.
0
3. Amend Sec.  2.53 by:
0
a. Revising paragraph (a)(1)(i).
0
b. Revising paragraphs (b)(2)(i) and (ii).
0
c. Revising paragraph (c)(5).
    The revisions and addition read as follows:


Sec.  2.53  Audit and evaluation.

    (a) * * *
    (1) * * *
    (i) Any Federal, State, or local governmental agency which provides 
financial assistance to the program or is authorized by law to regulate 
the activities of the part 2 program or those of the lawful holder;
* * * * *
    (b) * * *
    (2) * * *
    (i) Any federal, state, or local governmental agency which provides 
financial assistance to the program or is authorized by law to regulate 
the activities of the part 2 program or those of the lawful holder; or
    (ii) Any individual or entity which provides financial assistance 
to the part 2 program, which is a third-party payer covering patients 
in the part 2 program, or which is a quality improvement organization 
performing a utilization or quality control review, or such 
individual's or entity's or quality improvement organization's 
contractors, subcontractors, or legal representatives.
* * * * *
    (c) * * *
    (5) If a disclosure to an individual or entity is authorized under 
this section for a Medicare, Medicaid, or CHIP audit or evaluation, 
including a civil investigation or administrative remedy, as those 
terms are used in paragraph (c)(2) of this section, the individual or 
entity may further disclose the patient identifying information that is 
received for such purposes to its contractor(s) or subcontractor(s) to 
carry out the audit or evaluation, and a quality improvement 
organization which obtains such information under paragraph (a) or (b) 
of this section may disclose the information to that individual or 
entity (or, to such individual's or entity's contractors, 
subcontractors, or legal representatives, but only for the purposes of 
this section.
* * * * *

    Dated: January 5, 2017.
Kana Enomoto,
Acting Deputy Assistant Secretary for Mental Health and Substance Use.
    Approved:
Sylvia M. Burwell,
Secretary.
[FR Doc. 2017-00742 Filed 1-13-17; 11:15 am]
 BILLING CODE 4162-20-P