Medical records of patients are highly sensitive documents, which have to be kept confidential. Entities handling medical records including physicians, hospitals, other healthcare organizations, insurers and medical chart review companies are bound by the HIPAA and other regulations that protect the confidentiality of patients. However, severe restrictions related to sharing patient healthcare information could hamper the timely provision of medical care to patients who need it. It is in this context that the proposed rule issued by the U.S. Department of Health and Human Services (HHS) and the Substance Abuse and Mental Health Services Administration (SAMHSA) on August 26, 2019, becomes relevant. This proposed rule will amend the regulations governing the confidentiality of substance abuse disorder or SUD records (Part 2). It would increase the agencies’ flexibility, especially in the face of the national opioid epidemic, to reduce barriers in the way of care coordination for patients suffering from SUD.
42 CFR Part 2 Regulations Govern Patient Record Privacy
42 CFR Part 2 comprise federal regulations
that govern the privacy of patient records created by federally-assisted
substance use disorder treatment programs. Introduced in the year 1975, it was
intended to protect patients from the prejudice and stigma associated with
substance abuse, which could make patients hesitate to approach physicians. The
requirements set by this regulation restricted the use and disclosure of
patients’ substance use records from programs that need providers to share
health information of patients so that the high-quality treatments patients
need can be co-ordinated. These regulations were updated in 2017 and 2018 to
facilitate information exchange among treating healthcare providers while also
addressing the privacy concerns of patients seeking treatment for SUD. However,
the restrictive nature of the regulations and the difficulties in exchanging
patient information continued to create concerns. As a result, it has led to
significant clinical and safety challenges for providers, especially in the
light of the opioid crisis the nation faces.
What Are the Proposed Changes?
The proposed regulations continue to
prohibit the disclosure of SUD documentation without the consent of the patient
except in situations such as a bona fide medical emergency, for the purposes of
scientific research, with an appropriate court order after showing good cause,
or for the purpose of audit or program evaluation. Here are the major changes
made in the proposed regulations.
- A court may order disclosure of SUD records in connection with the investigation of a serious crime even if the crime was not allegedly committed by the patient. According to existing regulations, it is required that the crime be allegedly attributable to the patient.
- Non-part 2 providers are governed by Part 2 only if the provider has received SUD records from a Part 2 program, and the SUD records are incorporated in the medical records maintained by the non-Part 2 provider.
- Allows non-OPT (Opioid Treatment Program) providers to search a central registry to find out whether a patient is receiving opioid treatment through another registry member program.
- Permits Opioid Treatment Programs to enrol in a state prescription drug monitoring program (PDMP) and report data to the PDMP when prescribing or dispensing medications on Schedules II to PV, subject to patient consent.
- An SUD patient can provide his/her consent to disclosure of his or her Part 2 SUD records to an entity without identifying a particular person as the recipient. This change is expected to allow patients to have greater access to resources and benefits such as social security benefits.
- The proposed regulations relax current regulations to permit primary care physicians to record their patients’ addiction treatment history in the patients’ general medical records; and require the physician to delete only patient texts rather than completely “sanitize” the phone. When a patient sends an incidental message to the personal device of an employee/physician of a part 2 program, the employee/physician can fulfil the part 2 requirement for sanitizing the device by deleting just that message.
- The meaning of the phrase disclosures for the purpose of “payment and healthcare operations” has been clarified by the inclusion of 17 example activities in the text of the regulations. This change is expected to address any confusion under part 2 as regards what activities count as “payment and healthcare operations.”
- The types of situations or activities that fall within the permitted disclosures for “audits and/or program evaluations” have been clarified. Government agencies and third-party payers are permitted to obtain Part 2 records without written patient consent in order to conduct audits or evaluations for purposes such as: improving policies related to the care and outcomes for Part 2 patients; targeting limited resources to improve care for patients; or adjusting Medicaid or other insurance components to facilitate coverage and payment.
- A court may order placement of an undercover agent or informant in a Part 2 program up to twelve months and may extend that period through a court order.
Medical record retrieval and analysis is required for various medical and legal purposes. Whatever the purpose of sharing medical records may be, you need to exercise great caution and have all necessary security measures in place to maintain the confidentiality of patient records. The proposed regulations have been introduced to clarify certain provisions of Part 2 and also to effectively address the increasing opioid crisis. The changes recommended aim to facilitate law enforcement efforts to identify providers and others who are contributing to the crisis, especially in certain situations wherein the patient is not involved in the alleged offence. Keeping in view the consensus that existing regulations posed barriers to effective law enforcement, the proposed regulations are expected to address the challenge of protecting SUD records’ confidentiality while simultaneously easing efforts to resolve the increasing use and illegal sale of opioids. They are expected to bring some relief to non-Part 2 providers who may have been restrained in the past to document SUD-related information. The proposed regulations will provide more clarity to Part 2 providers and other legal holders of patient identifying information regarding permitted uses and other consent requirements. The HHS and SAMHSA have invited interested parties to provide comments on the provisions of the proposed rule. The HHS will consider these comments when issuing the final rule amending the Part 2 regulations. You can submit your comments electronically via the Federal eRulemaking Portal, or by mail to the Substance Abuse and Mental Health Services Administration. The deadline for submitting comments is no later than 5 PM EST on October 24, 2019.
