SAMHSA Proposes First Substantive Revisions to 42 C.F.R. Part 2 Since 1987

The year was 1987. Ronald Reagan was President. "The Princess Bride" and "Planes, Trains, and Automobiles" were hot at the box office. "Walk Like an Egyptian" was the No. 1 song. It was also the last time the regulations governing federally assisted alcohol and drug abuse treatment programs found at 42 C.F.R. Part 2 were substantively updated. Recognizing that a few things have changed since then, the Substance Abuse and Mental Health Services Administration (SAMHSA) released proposed revisions to 42 C.F.R. Part 2 on Friday.¹

SAMHSA stated that it believes these proposed revisions will "result in a decrease in the burdens associated with several aspects of" 42 C.F.R. Part 2. SAMHSA also stated these changes would increase the number of individuals with substance use disorders participating in health information exchanges (HIEs) and accountable care organizations (ACOs), leading to "increased efficiency and quality in the provision of health care for this population."

A summary of the major proposed revisions are included below. In summary, although these proposed revisions would update 42 C.F.R Part 2 to take into account the existence of electronic records and developments such as HIEs, many of the proposed revisions will place additional burdens on Part 2 Programs.

Use of Terms/Definitions
The regulations at 42 C.F.R. Part 2 apply to federally assisted programs that hold themselves out as providing, and provide, substance use disorder diagnosis, treatment, or referral for treatment (Part 2 Programs). SAMHSA is proposing to revise the definition of "Program" to clarify that general medical practices are subject to similar requirements as general medical facilities with regard to 42 C.F.R. Part 2's applicability. Specifically, the proposed definition of Program is as follows:

(1) An individual or entity (other than a general medical facility or general medical practice) who holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or

(2) An identified unit within a general medical facility or general medical practice that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or

(3) Medical personnel or other staff in a general medical facility or general medical practice whose primary function is the provision of substance use disorder diagnosis, treatment, or referral for treatment and who are identified as such providers.

The major revision to this definition is that paragraph (1) of the definition would not apply to general medical practices, just as it does not apply to general medical facilities.

In addition, SAMHSA is proposing to revise the definition of "Qualified Service Organization" to include population health management in the list of examples of services a Qualified Service Organization may provide. SAMHSA recognizes that "proactive, preventative, and chronic care is important to achieving desired outcomes" for patients with substance use disorders.

SAMHSA is also proposing to remove references to "alcohol abuse" and "drug abuse" and instead use the phrase "substance use" consistently throughout the regulations.

Consents
SAMHSA is proposing several changes to 42 C.F.R. Part 2's consent requirements:

• "To Whom" field: Currently, the name or title of the recipient of patient information under a consent must be listed on the consent. The proposed revisions would permit any of the following to be listed in the "to whom" field. Most importantly, this revision would allow the consent to permit disclosures to, for example, an HIE and the patient's treating providers with a statement such as "[Name of the HIE] and my treating providers."
  • The name(s) of the individual(s) to whom a disclosure is to be made (e.g., "Dr. Jane Doe, MD"); or
  • The name of the entity, if the entity has a treating provider relationship with the patient whose information is being disclosed (e.g., "ABC Hospital"); or
  • The name of a payor entity, if the payor requires patient information for the purpose of reimbursement for services rendered to the patient by the Part 2 Program (e.g., "Medicare"); or
  • The name of a non-payor entity that does not have a treating provider relationship with the patient, such as an HIE, if one of the following is also included: (A) the names of any individual participants (e.g., "[Name of the HIE] and Dr. Jane Doe, MD"); or (B) the names of entity participants that have a treating provider relationship with the patient whose information is being disclosed (e.g., "[Name of the HIE] and Hospitals A, B, and C"); or (C) a general designation of an individual, or entity participants or class of participants, that must be limited to a participant who has a treating provider relationship with the patient whose information is being disclosed (e.g., "[Name of the HIE] and my treating providers"). This subsection (C) is referred to as a "general designation."
• "From Whom" field: The regulations currently require the specific name or general designation of the program or person permitted to make the disclosure. SAMHSA is proposing to require that this field specifically name the Part 2 Program or other lawful holder of the information permitted to make the disclosure. "Other lawful holder" of the information means persons who have received the information as a result of a patient consent or pursuant to one of the exceptions to 42 C.F.R Part 2's consent requirements. Since the "To Whom" field may be broadened, SAMHSA wants to place greater restrictions to the "From Whom" field.
• "Amount and Kind of Information" field: SAMHSA is proposing to require the consent form to explicitly describe the substance use disorder-related information to be disclosed. SAMHSA clarifies that descriptions such as "all my records" and "only my substance use disorder records my family knows about" are not sufficient descriptors.

SAMHSA is also proposing to require that the consent form contain statements that the patient understands the terms of the consent and that the patient understands his/her right to obtain the accounting information for disclosures pursuant to a general designation, as discussed below.

Accounting of Disclosures
Currently, 42 C.F.R. Part 2 does not include a way for patients to determine to whom their records have been disclosed (i.e., it does not have an accounting requirement like HIPAA). The proposed rules would permit the individual to obtain a list of entities that received their information in the previous two years under a general designation consent. The response would need to include the name of the recipient entity, the date of the disclosure, and a brief description of the information disclosed. Interestingly, the individual would not be entitled to a list of the individuals that received their information, only a list of entities.

Re-Disclosures
SAMHSA proposes to clarify that the 42 C.F.R. Part 2's prohibition on re-disclosure of information by recipients of the information only applies to information that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder. For example, if a recipient also received information about a patient's high blood pressure from a Part 2 Program, that information would not be subject to the re-disclosure prohibition. SAMHSA cautions, however, that conditions or medications that would reveal a patient has a substance use disorder, such as cirrhosis of the liver, would be subject to the re-disclosure prohibition.

Security of Records
Part 2 Programs and other lawful holders of patient information would be required to have formal policies and procedures to ensure protection of patient information, including sanitization of associated media, for both paper and electronic records.

Disposition of Records When Program Closes
Currently, 42 C.F.R. Part 2 requires that when a Part 2 Program closes or its operations are transferred to another program, patient information must be destroyed unless (1) the patient gives written consent for the transfer of the records; or (2) if the records are required by law to be maintained, the records are kept in sealed containers labeled with a disclaimer and destroyed upon the end of the retention period. In the world of electronic records, this regulation was very difficult for Part 2 Programs to comply with.

SAMHSA is proposing to permit electronic records that are required by law to be maintained to be transferred to a portable electronic device that is encrypted and held by a responsible person who must have the ability to decrypt the data. The device must be sealed in a container marked with the required disclaimer statement. The responsible person must sanitize the device upon the end of the retention period, thereby destroying the information.

Research
SAMHSA is proposing to broaden the circumstances under which patient information can be used for research purposes. The proposed revisions would permit patient information to be disclosed to qualified personnel for research purposes if the researcher provides documentation meeting certain requirements relating to other currently existing protections for human research, including if (1) the researcher is a HIPAA covered entity or business associate following HIPAA's requirements; or (2) the researcher is subject to the Common Rule and provides documentation of compliance with the Common Rule. SAMHSA is also proposing to address data linkages to enable researchers holding Part 2 data to link to data sets from federal data repositories.

These proposed rules will be published in the Federal Register on February 9, 2016 and SAMHSA will accept comments until April 9, 2016.