Confidentiality of Substance Use Disorder Patient Records, 80626-80632 [2020-25810]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of the Secretary

[Federal Register Volume 85, Number 240 (Monday, December 14, 2020)]
[Rules and Regulations]
[Pages 80626-80632]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-25810]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

42 CFR Part 2

[SAMHSA-4162-20]
RIN 0930-AA30


Confidentiality of Substance Use Disorder Patient Records

AGENCY: Substance Abuse and Mental Health Services Administration 
(SAMHSA), U.S. Department of Health and Human Services (HHS).

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This final rule amends the Substance Abuse and Mental Health 
Services Administration's (SAMHSA) regulation governing the 
Confidentiality of Substance Use Disorder Patient Records, to clarify 
one of the conditions under which a court may authorize disclosure of 
confidential communications made by a patient to a part 2 program as 
defined in this regulation. This change to the regulation is intended 
to clarify that a court has the authority to permit disclosure of 
confidential communications when the

[[Page 80627]]

disclosure is necessary in connection with investigation or prosecution 
of an extremely serious crime, such as one that directly threatens loss 
of life or serious bodily injury, where the extremely serious crime was 
allegedly committed by either a patient or an individual other than the 
patient.

DATES:  Effective Date: This final rule is effective January 13, 2021.

FOR FURTHER INFORMATION CONTACT: Deepa Avula: (240) 276-2542. 
[email protected].

Table of Contents

I. Legal Authority
II. Background and Summary
III. Final Rule: Discussion of Public Comments
IV. Regulatory Impact Analysis

I. Legal Authority

    HHS is finalizing this rule under the authority of 42 U.S.C. 290dd-
2.

II. Background and Summary

    On January 18, 2017, HHS published a final rule (82 FR 6052) (2017 
final rule) that made certain changes to the regulations governing the 
confidentiality of substance use disorder patient records at 42 CFR 
part 2 (part 2). The part 2 regulations apply to part 2 programs, 
defined by HHS as federally assisted programs (federally assisted as 
defined in Sec.  2.12(b) and program as defined in Sec.  2.11), as well 
as other lawful holders who have obtained part 2 information in 
accordance with the part 2 authorizing statute and implementing 
regulations. See Sec.  2.12(e)(1) for examples.\1\
---------------------------------------------------------------------------

    \1\ See 82 FR 6052, 6061 (January 18, 2017).
---------------------------------------------------------------------------

    HHS did not intend in the 2017 final rule to substantively revise 
the provision of part 2 governing confidential communications that 
appears in Sec.  2.63. However, the phrase ``allegedly committed by the 
patient'' was erroneously added to Sec.  2.63(a)(2) in the 2017 final 
rule. The fact that the preamble of the 2017 final rule did not address 
that change, or explain its intended reasoning, indicates that no 
substantive change was intended.
    In addition, since the publishing of the 2017 final rule, then-
Acting Secretary of HHS Eric D. Hargan declared the opioid crisis a 
public health emergency, pursuant to section 319 of the Public Health 
Service Act, 42 U.S.C. 247d, and Secretary Alex M. Azar II renewed the 
declaration, most recently as of the date of this publication, on July 
6, 2020. According to the Centers for Disease Control and Prevention, 
more than 750,000 people died from a drug overdose between 1999 and 
2018.\2\ A November 2017 report from the President's Council of 
Economic Advisors entitled ``The Underestimated Costs of the Opioid 
Crisis'' estimates that in 2015, the economic cost of the opioid crisis 
was $504 billion, or 2.8 percent of Gross Domestic Product that 
year.\3\ The President's Commission on Combatting Drug Addiction and 
the Opioid Crisis in its 2017 final report identifies the gravity of 
the opioid crisis and notes the importance of a comprehensive effort by 
Federal partners, including the Department of Justice and the Drug 
Enforcement Administration, to address this crisis.\4\
---------------------------------------------------------------------------

    \2\ Centers for Disease Control and Prevention (n.d.). 
Understanding the Epidemic. Retrieved from https://www.cdc.gov/drugoverdose/epidemic/.
    \3\ The Council of Economic Advisers (2017). Retrieved from 
https://www.whitehouse.gov/sites/whitehouse.gov/files/images/The%20Underestimated%20Cost%20of%20the%20Opioid%20Crisis.pdf.
    \4\ Office of National Drug Control Policy (n.d.). Retrieved 
from https://www.whitehouse.gov/ondcp/presidents-commission/.
---------------------------------------------------------------------------

    As demand for treatment increases and new entities become part 2 
programs, HHS believes that the need to prevent drug trafficking and 
patient exploitation at or by part 2 programs makes it imperative to 
correct the error in Sec.  2.63(a)(2). If left in its current form, the 
rule would hamper law enforcement efforts, in situations where an 
individual other than the patient committed an extremely serious crime, 
such as one which directly threatens loss of life or serious bodily 
injury, and in which access to substance use disorder (SUD) treatment 
records is necessary in connection with the investigation or 
prosecution of that extremely serious crime.
    In addition to fixing the error from the 2017 final rule, HHS 
believes reverting to the previous language for this section is 
necessary to help reduce and deter drug trafficking at or from part 2 
programs, and thereby to prevent the occurrence of extremely serious 
crimes from interfering with the delivery, by part 2 programs, of high 
quality, medically necessary treatment to patients with substance use 
disorders.
    Accordingly, HHS will amend the text of Sec.  2.63(a)(2) to remove 
the phrase ``allegedly committed by the patient.''

III. Final Rule: Discussion of Public Comments

    On August 26, 2019, HHS published a Notice of Proposed Rulemaking 
(NPRM) (84 FR 44566) to amend Sec.  2.63(a)(2) by deleting the phrase 
``allegedly committed by the patient'' that was erroneously added in 
the 2017 final rule.
    HHS received 427 public comments, ranging from general support or 
opposition to comments specific to the proposed correction. Some 
comments were outside the scope of our proposal, or HHS's legal 
authority regarding the confidentiality of substance use disorder 
patient records. Consequentially, HHS does not discuss these comments 
in the final rule.
    Comment: Several commenters expressed support for the proposed 
rule, with some noting that the proposed change would enhance the 
ability to address opioid-related crime; would make the regulation less 
cumbersome to read; and would strike a balance between confidentiality 
and justice.
    Response: We thank commenters for their support.
    Comment: Many commenters argued that the addition of ``allegedly 
committed by the patient'' was not a technical error when it first 
appeared in the final rule in 2017. Several commenters asserted that 
removal of the phrase ``allegedly committed by the patient'' would 
constitute a substantive change to the rule, rather than a technical 
correction. Commenters stated that the final 2017 rule was published 
after following the standard rulemaking process under the 
Administrative Procedure Act, and that the text of the final 2017 rule 
would have been extensively reviewed by both SAMHSA and HHS prior to 
publication, leading them to believe the addition was not an error. One 
commenter noted that they could not determine with any clarity whether 
the addition of ``allegedly committed by the patient'' was consistent 
with well-accepted understanding of the pre-2017 language, and that 
commenter therefore requested that HHS provide future certainty and 
clarity as to the intended scope of the rule. Finally, another 
commenter asserted that the current language ``allegedly committed by 
the patient'' reflects a delicate balance of competing interests in 
privacy and public safety, such that the proposed change would go 
beyond merely correcting a technical error.
    Response: The error in the 2017 final rule that occurred by adding 
``allegedly committed by the patient'' traces back to the 2016 proposed 
rule. The 2016 proposed rule enumerated every section of part 2 for 
which a revision was then being proposed and described each revision 
and the reasoning behind it. Notably, the 2016 proposed rule did not 
include any proposal to revise section 2.63. In the 2017 final rule, 
there was no summary of public comment on adding

[[Page 80628]]

the phrase ``allegedly committed by the patient'' to section 2.63, 
because no change had been proposed to section 2.63, so the public was 
never invited to comment on that provision or otherwise notified that 
the provision would be amended. The only place where the phrase 
``allegedly committed by the patient'' appeared was in the restatement 
of the part 2 regulation, which appeared at the end of the 2017 final 
rule. Thus, the phrase ``allegedly committed by the patient'' was added 
in error to the regulatory text of section 2.63. Furthermore, as 
discussed above, this error could hamper or impede federal law 
enforcement efforts in situations where an individual other than the 
patient committed an extremely serious crime, such as one which 
directly threatens loss of life or serious bodily injury, and access to 
SUD treatment records is necessary in connection with the investigation 
or prosecution of that extremely serious crime.
    We believe that correcting this error is necessary both to address 
the opioid epidemic and to protect patients.
    Comment: One commenter said that HHS should use the opportunity of 
the current comment period to ameliorate any procedural error in 2017, 
so that the phrase ``allegedly committed by the patient'' remains in 
the part 2 regulations at section 2.63(a)(2).
    Response: As stated above, the addition of the phrase ``allegedly 
committed by the patient'' was not a logical outgrowth of the 2016 NPRM 
proposals, or of comments received thereon, and it was added in error 
to the regulatory text of section 2.63. The change that we are 
finalizing would restore section 2.63 to its pre-2017 state, consistent 
with thirty years of rulemaking history since the adoption of section 
2.63 in the 1987 final rule. Furthermore, as stated previously, it has 
come to our attention that the erroneous addition of the phrase 
``allegedly committed by the patient'' may hinder Federal law 
enforcement efforts, which is a separate substantive reason for SAMSHA 
to delete the inadvertently added phrase and restore the provision to 
the previous regulatory text.
    Comment: A few commenters expressed concern that the proposal would 
substantially change or broaden the definition of ``extremely serious 
crime,'' either by including drug-trafficking, or offenses not 
committed by the patient, or both within that definition. Commenters 
asserted that the 1987 rule specifically excluded drug-related offenses 
from the definition of an ``extremely serious crime.'' One commenter 
asserted that the 1987 rule authorized a court to find that a drug-
related offense might constitute an ``extremely serious crime,'' but 
only in the context of offenses committed by the patient who is being 
investigated or prosecuted. Another commenter noted that the definition 
of a serious crime may not capture a prescriber who acts as a rogue 
doctor because that action may not ``directly threaten(s) loss of life 
or serious bodily injury.'' Many commenters expressed concern about 
expanding the definition of serious crimes to include drug trafficking. 
Further, several commenters believed that removal of the phrase 
``allegedly committed by the patient'' would reach too broadly to 
implicate individuals other than the patient or the prescriber in drug 
trafficking.
    Response: The 1987 final rule did not restrict the disclosure of 
SUD treatment records under section 2.63 only to the investigation of 
extremely serious crimes ``allegedly committed by the patient.'' We 
believe that the commenters are referring to the discussion in the 1987 
final rule of section 2.65, which narrowly did address court orders for 
the disclosure of SUD treatment records to investigate a patient for an 
extremely serious crime. We do not believe the change that is being 
finalized will affect the meaning of an ``extremely serious crime.'' 
Pursuant to the current regulation at section 2.63(a)(2), the term 
``extremely serious crime'' includes those crimes that ``directly 
threaten. . .loss of life or serious bodily injury.'' Thus, where drugs 
are being trafficked through an SUD treatment clinic in a way that 
directly threatens loss of life or serious bodily injury, that activity 
would qualify as an ``extremely serious crime.''
    Comment: A few commenters argued that the proposed change would 
broaden the scope of law enforcement ability to investigate part 2 
programs while criminalizing treatment, with some stating that this 
proposal permits Federal law enforcement to conduct fishing expeditions 
and broadly search part 2 patient records for criminal activity. 
Several commenters feared that the proposed provision could be misused 
or abused by law enforcement officials. Specifically, commenters 
expressed concern that law enforcement officials may subject patients 
to harassment, bullying, or misguided and dangerous tactics, including 
operating outside the boundaries of a part 2 facility to gather 
information (such as parking outside of treatment programs to identify 
patients who might have outstanding warrants). A few commenters 
suggested that patients on medication might be subjected to Driving 
While Intoxicated tests. A few commenters emphasized that this high-
risk population is fearful and distrustful of law enforcement due to 
past mistreatment of those with SUD or previous fabrication of cases. 
The commenters asserted that many people with mental health challenges 
are part of minority groups or marginalized communities whose 
interactions with law enforcement are problematic (even lethal) or that 
that agencies may not be properly trained to handle substance use 
treatment and addiction issues.
    Response: The change to section 2.63 (removing the words 
``allegedly committed by the patient'') that is being finalized would 
restore the regulatory text to what it was for 30 years prior to the 
2017 final rule. The change in the 2017 final rule was made in error. 
The authorizing statute (42 U.S.C. 290dd-2) and the regulations 
promulgated thereunder (42 CFR part 2) contain various safeguards 
against misuse of SUD treatment records. And the regulations 
specifically provide that ``[t]he patient records subject to the 
regulations in this part may be disclosed or used only as permitted by 
the regulations in this part and may not otherwise be disclosed or used 
in any civil, criminal, administrative, or legislative proceedings 
conducted by any Federal, state, or local authority. Any disclosure 
made under the regulations in this part must be limited to that 
information which is necessary to carry out the purpose of the 
disclosure.'' 42 CFR 2.13(a). Further, disclosure under this section is 
subject to the careful review of a court that would presumably consider 
the impact on patients and other factors before making a decision on 
whether to issue an order authorizing the disclosure.
    Comment: Several commenters stated that the proposed change would 
violate the language or the purpose of the enabling statute. A few 
commenters believed that the proposal is outside of the authority of 
the agency.
    Response: Under 42 U.S.C. 290dd-2(b)(2)(C), the content of an SUD 
treatment record may be disclosed without patient consent if authorized 
by the order of a court of competent jurisdiction for good cause; thus, 
we believe that this change does not violate the language of the 
enabling statute, nor do we believe that the change would broaden the 
scope of law enforcement beyond what is authorized in the statute. The 
change would merely restore the regulatory text to what it was for 30 
years prior to the 2017 final rule.
    Comment: Many commenters stated that the proposed rule offered 
insufficient evidence to support the

[[Page 80629]]

claim that the phrase ``allegedly committed by the patient'' hindered 
Federal law enforcement efforts targeted at rogue doctors and pill 
mills. A few commenters specifically requested examples to demonstrate 
this language has been used by law enforcement prior to 2017 for the 
investigation or prosecution of crimes committed by the patient, the 
program, or the patient's providers. Other commenters requested that 
HHS first utilize existing information obtained through the DEA 
registration process to target rogue doctors and pill mills as opposed 
to expanding law enforcement access to part 2 patient records for 
similar information. Several commenters believed the existing law 
enforcement levers were sufficient for addressing law enforcement 
concerns, with some suggesting that the DEA take a more active role in 
identifying and addressing pill mills and rogue doctors.
    Response: The change to section 2.63 (removing the words 
``allegedly committed by the patient'') that is being finalized would 
restore the regulatory text to what it was prior to the 2017 final 
rule. The change in the 2017 final rule was made in error. If left in 
its current form, the rule would hamper or impede Federal law 
enforcement efforts in situations where an individual other than the 
patient committed an extremely serious crime, such as one which 
directly threatens loss of life or serious bodily injury, and access to 
SUD treatment records is necessary in connection with the investigation 
or prosecution of that extremely serious crime. Detailed examples of 
pre-2017 instances of law enforcement using section 2.63 would be 
difficult to provide, in part because disclosure of patient records in 
these situations is typically done under seal. Regardless, we do not 
believe that a change to section 2.63 that was made in error two years 
ago should change the law enforcement practices of thirty years of 
prior precedent. The use of DEA's legal authority or records is outside 
of the scope of this final rule.
    Comment: A few commenters expressed concern that the proposed 
change would impact prescriber willingness to appropriately prescribe 
opioids. Several commenters expressed concern that the proposal will 
deter clinicians from taking on perceived risks associated with 
providing SUD care. Likewise, several commenters expressed concern that 
opioid prescription volume might be used to inappropriately implicate 
prescribers in diversion activities, noting that prescription volumes 
were not reliable indicators of diversion for non-medical use. 
Similarly, several commenters believed it inappropriate to seek 
information on prescriber behavior (e.g., rogue doctors, pill mills) by 
searching patient records.
    Response: We understand that opioid prescribing volume is not the 
only indicator of diversion for non-medical use of opioids, and we do 
not believe that the change to section 2.63 that we are finalizing 
would indicate otherwise.
    Comment: One commenter suggested several alternatives to the 
current proposal, including requiring independent, office-based 
buprenorphine practitioners to be regulated and licensed by Single 
State Authorities, requiring compliance with best practices including 
addiction treatment counseling, and requiring the elimination of cash 
payments. Another commenter suggested the addition of explicit language 
to address ``serious crime allegedly committed by either (a) the 
patient; (b) the part 2 program holding the records containing the 
confidential communications, or (c) employees or agents of that part 2 
program.'' Yet another commenter cited examples from state law that 
requires manufacturers of Schedule II or III controlled substances, 
including opioids, to participate in a drug stewardship program to 
collect, secure, transport and safely dispose of unwanted drugs to 
deter trafficking. A few commenters believed that there are evidence-
based public health solutions available to address the opioid epidemic 
and law enforcement is not one of these solutions. One commenter 
recommended that instead of investigating providers for drug-related 
crimes, providers could proactively participate in voluntary 
certification processes formed through Joint Commission, American 
Society of Addiction Medicine, California Society of Addiction Medicine 
or HHS.
    Response: There are many potential actions to curb illegal 
prescribing activity that contributes to the proliferation of pill 
mills. We believe the correction to section 2.63 is one of the many 
necessary steps that may help reduce and deter drug trafficking at or 
from part 2 programs because it would allow law enforcement to request 
a court order to obtain confidential communications that could support 
claims of drug trafficking and patient exploitation within a part 2 
program. We will continue to explore additional interventions and 
alternatives for curbing the opioid crisis within our legal authority.
    Comment: Many commenters expressed broad concern about the proposal 
eroding or undermining patient privacy rights or the confidentiality of 
records. Likewise, many commenters asserted that their privacy would be 
violated by the proposal, and therefore requested that SAMHSA reject 
the proposal. Several commenters noted in context that the loss of 
privacy associated with the proposal would lead to other ill effects 
either for the commenters themselves, or for patients more broadly, in 
the form of loss of trust in care providers, diminished willingness to 
enter or remain in treatment, or increased potential for social stigma 
and discrimination. A few commenters also stated that the proposal 
could have negative effects not just on privacy, but also on SUD care 
or the opioid epidemic in the aggregate. One commenter suggested that 
the proposal is out of keeping with physicians' confidentiality duty to 
patients under common law.
    Response: While the 2017 error may appear to change the basic 
privacy protections, there are existing statutory and regulatory 
provisions related to criminal investigations that protect patient 
privacy and have not changed. The authorizing statute for part 2 (at 42 
U.S.C. 290dd-2(c)) prohibits the use of patient records to initiate or 
substantiate any criminal charges against a patient, or to conduct any 
investigation of a patient, except as authorized by a court order 
granted under subsection (b)(2)(c) of the statute. Subsection (b)(2)(c) 
of the statute specifies that using patient records to investigate or 
prosecute a patient requires an order from a court of competent 
jurisdiction, granted after an application showing good cause, 
including the need to avert a substantial risk of death or serious 
bodily harm. The change in the 2017 final rule was made in error, and 
it does not represent a departure from the basic privacy protections 
that SUD patients have held under part 2 since 1987.
    Comment: Many commenters expressed concern with the 30-day public 
comment period, stating that the 30 days was not enough time for 
citizens to analyze, discuss, and respond to the proposal or for HHS to 
sufficiently collect public feedback. Several commenters believed more 
time for public comment was warranted given the number of people and 
organizations that will be affected. Several commenters suggested or 
stated that the 30-day comment period violated the Administrative 
Procedure Act. A few commenters said the comment period deprived 
patients of their procedural rights or the right to participate in 
commenting. A few commenters also noted that a related NPRM was 
published on the same day

[[Page 80630]]

with a 60-day comment period and indicated that it may be difficult for 
patients to respond to both rules in the allotted timeframe. Another 
commenter suggested the 30-day comment period indicates that HHS is not 
truly interested in what the public has to say. Many commenters 
requested that HHS extend the comment period, with some expressly 
requesting 60 days, stating that the proposal represented a 
significant, fundamental or sweeping change to the current regulation.
    Response: As noted above, the change to section 2.63 (removing the 
words ``allegedly committed by the patient'') that is being finalized 
would restore the regulatory text to its pre-2017 language. We believe 
that a 30-day comment period for correction of an inadvertent error is 
consistent with section 553 of the Administrative Procedure Act, and we 
believe that the 30-days comment period was a sufficient amount of time 
for commenters to submit their written data, views, or arguments on a 
straightforward proposal.
    Comment: A few commenters raised concerns that public comments 
submitted for the rule were not posted until almost the end of the 
comment period. A few commenters also remarked that the website for 
submitting comments did not work properly during the comment period.
    Response: Regulations.gov is provided as a public service to 
increase participation in the government's regulatory activities by 
offering a central point for submitting comments on regulations. The 
agency reviews all comments for their appropriateness before posting, 
which sometimes may lead to a delay in posting. Although we regret that 
technical issues at times may have prevented individuals from 
submitting a comment on Regulations.gov, the Proposed Rule provided a 
physical mailing address where comments could be mailed. We believe 
that any technical issues with the website that individuals may have 
experienced were promptly resolved.
    Comment: Many commenters asserted that the proposal would deter 
patients from entering and/or staying in SUD treatment and that this 
deterrence would more broadly negatively impact society, potentially 
making the opioid epidemic worse, causing overdoses and opioid-related 
mortality to increase, increasing crime rates and/or recidivism, or 
increasing communicable diseases. Several commenters also suggested 
that the deterrence of SUD treatment would exacerbate disparities in 
access to care for low-income communities. Other commenters expressed 
concern that the proposal would deter people from seeking or staying in 
SUD treatment. Several commenters suggested that if the proposal is 
finalized, then the only rational SUD treatment options would become 
``off the grid'' self-help settings; one commenter stated that SUD 
patients had communicated the intent to stockpile MAT medications in 
case the proposal goes through, so as to be able withdraw from 
treatment in that case.
    Response: As noted above, while the 2017 error may appear to change 
basic privacy protections, there are existing statutory and regulatory 
provisions related to criminal investigations that protect patient 
privacy and have not changed. The authorizing statute for part 2 (at 42 
U.S.C. 290dd-2(c)) prohibits the use of patient records to initiate or 
substantiate any criminal charges against a patient, or to conduct any 
investigation of a patient, except as authorized by a court order 
granted under subsection (b)(2)(c) of the statute. Subsection (b)(2)(c) 
specifies that using patient records to investigate or prosecute a 
patient requires an order from a court of competent jurisdiction, 
granted after an application showing good cause, including the need to 
avert a substantial risk of death or serious bodily harm. Thus, we do 
not believe that an error made two years ago should alter the privacy 
and clinical practices of thirty years of prior precedent, nor should 
this reversion deter patients from treatment because of these concerns. 
Furthermore, part 2 regulations contain various safeguards to assure 
patients that their confidentiality and privacy will be protected and 
that such confidentiality and privacy will not be abrogated absent just 
and sufficient cause.
    Comment: A few commenters expressed concern that the proposal may 
enable housing, legal, educational, employment, and insurance 
discrimination or may help to discriminate against those seeking social 
services. Other commenters stated that the proposal could impact child 
custody agreements and could put patients at risk in civil proceedings 
including divorce and child custody proceedings.
    Response: As noted above, the change to section 2.63 that is being 
finalized would restore the regulatory text to what it was prior to the 
2017 final rule. The change in the 2017 final rule was made in error, 
and correcting the error does not represent a departure from the basic 
privacy protections that SUD patients have held under Part 2 since 
1987. Moreover, the authorizing statute (42 U.S.C. 290dd-2) and the 
regulations promulgated thereunder (42 CFR part 2) contain various 
safeguards against misuse of SUD treatment records. And the regulations 
specifically provide that ``[t]he patient records subject to the 
regulations in this part may be disclosed or used only as permitted by 
the regulations in this part and may not otherwise be disclosed or used 
in any civil, criminal, administrative, or legislative proceedings 
conducted by any Federal, state, or local authority. Any disclosure 
made under the regulations in this part must be limited to that 
information which is necessary to carry out the purpose of the 
disclosure.'' 42 CFR 2.13(a). Thus, we do not believe that a change 
that was inadvertently made two years ago would alter the privacy and 
clinical practices of thirty years of precedent, nor should it deter 
patients from treatment because of these concerns.
    Comment: A few commenters suggested specific training on substance 
use disorders for both law enforcement and medical professionals as a 
way to combat stigma. One commenter recommended that SAMHSA provide 
education for providers, health systems, and law enforcement to clarify 
the regulations.
    Response: HHS appreciates this suggestion and will consider 
training opportunities for law enforcement and medical professionals on 
SUD records and the applicability of the part 2 regulations.
    Comment: Many commenters objected to the proposed change because 
they believe it will allow personal or sensitive health information to 
be used for criminal justice purposes. More specifically, commenters 
said the proposal would enable information to be used to investigate, 
implicate or prosecute patients or their families, friends, or 
associates, as well as prospective patients, people in recovery, and/or 
treatment programs/providers. A few commenters said that treatment 
itself would become a tool of law enforcement. A few commenters said 
there was no reason to use substance use disorder information against 
patients, or to share it for the purposes of prosecuting people who 
want to turn their lives around. A few commenters believed the proposal 
could lead to self-incrimination by patients, especially among those 
who are legally ordered to obtain treatment or pregnant women in states 
that criminalize substance use during pregnancy. One commenter inquired 
as to what would prevent prosecution of a person who inadvertently 
confesses to a crime or knowledge of a crime. Another inquired as to 
which parts of a medical record would be excluded, and how information 
from an alcohol- or

[[Page 80631]]

chemically impaired individual would be used.
    Response: HHS understands the concerns expressed by commenters. The 
authorizing statute for Part 2 (at 42 U.S.C. 290dd-2(c)) prohibits the 
use of patient records to initiate or substantiate any criminal charges 
against a patient, or to conduct any investigation of a patient, except 
as authorized by a court order granted under subsection (b)(2)(c) of 
the statute. Subsection (b)(2)(c) of the statute specifies that using 
patient records to investigate or prosecute a patient requires an order 
from a court of competent jurisdiction, granted after an application 
showing good cause, including the need to avert a substantial risk of 
death or serious bodily harm. However, part 2 does not serve as an 
absolute shield for a patient's criminal activity. For example, part 2 
regulations expressly permit disclosures related to crimes committed on 
program premises. As stated elsewhere in this final rule, HHS is 
reverting back to the pre-2017 language for this section, in order to 
remove wording that may hinder the ability of law enforcement to target 
rogue doctors and pill mills, for example, that are contributing to the 
opioid epidemic.
    Comment: Many commenters expressed blanket opposition to the 
proposal. Several commenters indicated that they would be opposed to 
any changes to 42 CFR part 2 overall. A few commenters noted that while 
they are open to updates to 42 CFR part 2, they are opposed to the 
updates in this proposal.
    Response: As described previously, HHS believes reverting to the 
previous language for this section will correct an inadvertent error in 
the 2017 final rule, by restoring the section to what it was for thirty 
years following the 1987 final rule. Moreover, correcting the erroneous 
addition of the phrase ``allegedly committed by the patient'' may 
remove a stumbling block to future law enforcement efforts targeting 
extremely serious crimes, which is a separate substantive reason for 
the correction.
    Comment: A few commenters requested additional clarification about 
the proposal. One commenter inquired whether patients would be notified 
if their records were disclosed. One commenter requested additional 
information regarding the use of records, specifically whether patients 
can opt out, in what context their records can be used, how often the 
records can be accessed, and how long the records are available for law 
enforcement use.
    Response: Although a patient cannot opt out of disclosure under 
Sec.  2.63, the authorizing statute (42 U.S.C. 290dd-2) and the 
regulations promulgated thereunder (42 CFR part 2) contain various 
safeguards regarding the use and disclosure of SUD treatment records 
for law enforcement purposes. The regulations specifically provide that 
``[t]he patient records subject to the regulations in this part may be 
disclosed or used only as permitted by the regulations in this part and 
may not otherwise be disclosed or used in any civil, criminal, 
administrative, or legislative proceedings conducted by any Federal, 
state, or local authority. Any disclosure made under the regulations in 
this part must be limited to that information which is necessary to 
carry out the purpose of the disclosure.'' 42 CFR 2.13(a).
    Comment: A few commenters expressed concern about the proposal's 
impact on psychotherapy notes and requested further guidance to 
determine how requirements for psychotherapy notes will or will not 
interact with this proposal. Specifically, these commenters noted that 
it is unclear if law enforcement authorities will have access to 
patients' psychotherapy notes that are written by behavioral health 
providers who treat SUD patients in part 2 programs, in addition to the 
patients' mental health and SUD records, as HIPAA requirements 
recognize that psychotherapy notes are usually separated from the 
patient's health record.
    Response: Law enforcement may only access psychotherapy notes if 
all applicable requirements under part 2 and, if applicable, the HIPAA 
Privacy Rule are met. This final rule will not weaken the privacy 
protection for psychotherapy notes held by part 2 programs, if portions 
of those notes are subject to part 2. Part 2 requires that a court 
order be accompanied by a subpoena to compel disclosure, while the 
HIPAA Privacy Rule permits a covered entity to disclose records when 
required by law or with a court order or a subpoena unaccompanied by a 
court order, when certain conditions are met (See 45 CFR 164.512(a) and 
(e)). To the extent that a portion of a patient's part 2 record is also 
considered protected health information under the HIPAA Privacy Rule, a 
disclosure would need to meet the requirements of both rules.

IV. Regulatory Impact Analysis

    HHS has examined the impacts of this final rule as required by 
Executive Order 12866 on Regulatory Planning and Review (September 30, 
1993), Executive Order 13563 on Improving Regulation and Regulatory 
Review (January 18, 2011), the Regulatory Flexibility Act (Pub. L. 96-
354), the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4), 
Executive Order 13132 on Federalism (August 4, 1999), and Executive 
Order 13771 on Reducing Regulation and Controlling Regulatory Costs 
(January 30, 2017). HHS does not believe the change constitutes an 
unfunded mandate, additional regulatory activity or imposes a cost or 
economic burden on part 2 programs.

Executive Orders 12866, 13563, 13132, and 13771.

    Executive Order 12866 directs agencies to assess all costs and 
benefits of available regulatory alternatives and, if regulation is 
necessary, to select regulatory approaches that maximize net benefits 
(including potential economic, environmental, public health, and safety 
effects; distributive impacts; and equity). Executive Order 13563 is 
supplemental to, and reaffirms the principles, structures, and 
definitions governing regulatory review, as established in Executive 
Order 12866. The change that is being finalized in this final rule will 
not have an annual effect on the economy of $100 million or more in at 
least one year. HHS notes that this change does not constitute a 
significant regulatory action under Executive Order 12866. The minor 
change to section 2.63(a)(2) that is being finalized will have no 
discernible economic impact, will not alter program budgets or 
obligations of grant or loan recipients, and raises no novel legal or 
policy questions. Indeed, as explained, this final rule reverts to the 
pre-2017 language for this section, which had remained unchanged for 
more than 30 years.
    Executive Order 13132 establishes certain requirements that an 
agency must meet when it promulgates a proposed rule (and subsequent 
final rule) that imposes substantial direct requirement costs on state 
and local governments, preempts state law, or otherwise has Federalism 
implications. This final rule does not impose any costs on state or 
local governments or preempt state law; therefore, the requirements of 
Executive Order 13132 are not applicable.
    Executive Order 13771 directs Agencies to identify at least two 
existing regulations to repeal for every new regulation unless 
prohibited by law. The total incremental cost of all regulations issued 
in a given fiscal year must have costs within the amount of incremental 
costs allowed by the Director of the Office of Management and Budget, 
unless otherwise required by law or approved in writing by the Director 
of the Office of Management and Budget.

[[Page 80632]]

This rule is not expected to lead to the promulgation of a rule 
constituting a ``regulatory action'' under Executive Order 13771 
because the final rule is fixing a procedural error from a prior 
rulemaking and does not impose burden on regulated entities. The 
addition of the phrase ``allegedly committed by the patient'' was not a 
logical outgrowth of the 2016 NPRM proposals, or of comments received 
thereon, and it was added in error to the regulatory text of section 
2.63.

Regulatory Flexibility Act

    The Regulatory Flexibility Act (RFA) requires agencies that issue a 
regulation to analyze options for regulatory relief of small businesses 
if a rule has a significant impact on a substantial number of small 
entities. The RFA generally defines a ``small entity'' as (1) a 
proprietary firm meeting the size standards of the Small Business 
Administration; (2) a nonprofit organization that is not dominant in 
its field; or (3) a small government jurisdiction with a population of 
less than 50,000. (States and individuals are not included in the 
definition of ``small entity''). HHS considers a rule to have a 
significant economic impact on a substantial number of small entities 
if at least five percent of small entities experience an impact of more 
than three percent of revenue. HHS determines that this rule does not 
have a significant economic impact on a substantial number of small 
entities. The rule would merely correct an erroneous change made in 
2017 to, and restore the pre-2017 language to, the longstanding 
provision in 42 CFR 2.63, in order to avoid a possible interpretation 
that could hamper or impede Federal enforcement efforts in the fight to 
address the opioid crisis, including investigations that involve 
disclosures of Part 2 program records authorized by court orders. As 
such, this final rule will have a de minimis, if any, impact on small 
entities.

Unfunded Mandates Reform Act

    Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires 
that agencies prepare a written statement, which includes an assessment 
of anticipated costs and benefits, before proposing ``any rule that 
includes any Federal mandate that may result in the expenditure by 
State, local, and tribal governments, in the aggregate, or by the 
private sector, of $100,000,000 or more (adjusted annually for 
inflation) in any one year.'' In 2019 that threshold level is 
approximately $154 million. HHS does not expect the rule to exceed the 
threshold.

Paperwork Reduction Act

    Under the Paperwork Reduction Act of 1995 (PRA), agencies are 
required to provide a 60-day notice in the Federal Register and solicit 
public comment before a collection of information requirement is 
submitted to the Office of Management and Budget (OMB) for review and 
approval. The change in this rulemaking would result in no new 
reporting burdens.

Congressional Review Act

    Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), 
the Office of Information and Regulatory Affairs designated this rule 
as not a major rule, as defined by 5 U.S.C. 804(2).

List of Subjects in 42 CFR Part 2

    Alcohol abuse, Alcoholism, Drug abuse, Grant programs--health, 
Health records, Privacy, Reporting and recordkeeping requirements.

    For the reasons stated in the preamble, HHS amends 42 CFR part 2 as 
follows:

PART 2--CONFIDENTIALITY OF SUBSTANCE USE DISORDER PATIENT RECORDS

0
1. The authority citation for Part 2 continues to read follows:

    Authority:  42 U.S.C. 290dd-2.

Subpart E--Court Orders Authorizing Disclosure and Use


Sec.  2.63   [Amended]

0
2. Amend Sec.  2.63(a)(2) by removing the phrase ``allegedly committed 
by the patient''.
* * * * *

    Dated: August 27, 2020.
Elinore F. McCance-Katz,
Assistant Secretary for Mental Health and Substance Use, Substance 
Abuse and Mental Health Services Administration.
    Approved: September 30, 2020.
Alex M. Azar II,
Secretary, Department of Health and Human Services.
[FR Doc. 2020-25810 Filed 12-11-20; 8:45 am]
BILLING CODE P