Proposed Rule on Confidentiality of Substance Use Information Released

On February 9th, 2016, Health and Human Services Department released long-awaited proposed rules on 42 CFR Part 2, the federal regulation that governs how federally-funded substance use disorder (SUD) programs may share health information; public comments are due on April 11th. The proposed changes to 42 CFR Part 2 would, among other things, make it easier for individuals to provide broad consent to release SUD information – both to treating providers and to state health information exchanges (HIEs).

Prevention, detection, and treatment of substance use disorders are timely and critical issues for state health policy makers. According to a recent study by the Government Accountability Office, nearly 20 percent of the top 5 percent of Medicaid’s highest-cost beneficiaries have an SUD, often along with other chronic physical and/or mental health conditions. States are also grappling with skyrocketing use of (and overdoses from) prescription opiates and heroin.

In response to the pressing needs of Medicaid beneficiaries with multiple complex conditions such as SUD, state policymakers have been working to transform how care is delivered and paid for: through a myriad of state health reform initiatives such as the State Innovation Model, Delivery System Reform Incentive Payment waivers, and Health Homes, state policymakers seek to reduce cost by improving the coordination and integration of care for individuals with chronic, comorbid conditions.  Critical to these initiatives is the ability to access and share comprehensive health care data across providers and systems. Using health information exchanges (HIEs), data registries, Admission, Discharge, and Transfer (ADT) alerts, and other health information technology tools and strategies, sharing health data is central to the success and transformative impact of these efforts.

In this context, 42 CFR Part 2 is frequently cited as a significant barrier. The rule’s higher-than-HIPAA consent standards have no exception for information shared for treatment, payment or operations– a critical feature of HIPAA that allows treating providers to readily share pertinent health information, coordinate care, and access electronic health data. With its more stringent consent requirements as well as real, and sometimes perceived, risks for sharing SUD information, 42 CFR Part 2 is often noted as one of the drivers of siloed systems of care, lack of integration, and barriers to delivery system and payment reform when SUD services and systems are involved.

SAMHSA’s proposed regulations may provide new opportunities for data sharing while protecting consumers. Among the proposed changes, the new rule would:

  • Enable individuals receiving services from SUD programs to provide a general consent to release information – including release to an HIE and the individual’s treating providers;
  • Exclude “general medical practices” from the general definition of programs covered by the regulations;
  • Include “population health management” as one of the functions of “Qualified Services Organizations,” permitting disclosure without consent to certain organizations that provide these and other functions for SUD providers as long as specific written agreements are in place.

That said, the proposed rule does preserve different standards for release of SUD information than those found under HIPAA for most other types of health information. While maintaining enhanced protections for SUD information, some have voiced concern that these different standards may also perpetuate current barriers that inhibit the flow of information that can improve treatment and coordination of care for people with these disorders.

To better understand how these changes may impact state policy initiatives, NASHP is hosting a webinar on March 17th at 4:00 PM EST that will feature Attorney Karla Lopez, a privacy and confidentiality expert from the Legal Action Center. The webinar will provide an overview of the proposed rule and thoughts from Dr. Joe Parks, Director of MO Healthnet, Missouri’s Medicaid agency, and other leading state health policymakers on how the new rule may help or hinder their states’ reform initiatives. To register for the webinar, go to: