The New Substance Use Disorder Confidentiality Rules: A Work in Progress
The Substance Abuse and Mental Health Services Administration (SAMHSA) recently issued a highly anticipated update to 42 CFR Part 2, the regulation that governs sharing patient information by federally-designated substance use disorder (SUD) providers. The rule is timely: SUD has become a major cost driver, and many state policymakers are focused on the integration of physical and behavioral health services as a way to achieve better outcomes and reduce cost for people with SUD and other complex conditions. However, confidentiality rules regarding SUD, developed to ensure the protection of highly sensitive and often stigmatizing information (and last substantively updated in 1987), have made it difficult for patients and providers to share data to integrate and improve care. This final rule was intended to balance the need to protect sensitive health information with the goal of facilitating health care integration and health information exchange; does it deliver?
The rule includes changes that should make it easier for integrated health providers and systems to share SUD data, such as a general consent provision that streamlines the process for release of patient information. The previous rule required consent forms to specifically identify each provider who could receive information, a higher standard than the Health Information Portability and Accountability Act (HIPAA) and a significant roadblock in coordinating and integrating care across providers and systems. The new rule, while still more restrictive than HIPAA, provides flexibility by giving patients the option to release information to multiple treating providers (e.g., to ‘‘all my current and future treating providers’’), as well as to certain third parties, such as health information exchanges (HIEs). This broader consent should enable providers to more readily share appropriate patient information. It may also enable a smoother flow of information to entities participating in state payment and delivery system reform initiatives, such as accountable care organizations, coordinated care organizations, and HIEs.
The rule also clarifies that population health management, a key component of many states’ integrated care approaches, can be provided by Qualified Service Organizations (QSOs). QSOs are organizations that contract with SUD agencies for things like administrative services; patient consent is not required to release information to these organizations. This clarification may make it easier to include information on SUD in population health tools and data sets, supporting better management of patient populations for the purposes of prevention, chronic care management, and identifying risk.
While these are welcome changes, state policymakers working to support more integrated, coordinated care will still encounter challenges. Notably, the new rule is a long way from aligning the requirements of 42 CFR Part 2 with the privacy provisions of HIPAA (which, along with state laws, cover other sensitive health information such as mental health and HIV). Continuing to treat SUD data differently from other health information will likely perpetuate current information silos. Additional hurdles in the new rule, such as the requirement that organizations receiving information through the general consent provision must provide a list to the patient of all disclosures made if requested, could be costly and onerous to implement. The new rule may also have muddied the waters for All-Payer Claims Databases (APCDs), a critical state policy tool, by not providing more specificity on what constitutes “identifying information.” This has led to some concern that payers may redact more SUD data from their submissions to APCDs in the wake of the new rule, further hampering the ability of states to understand and address critical SUD policy issues, such as the opioid crisis.
In trying to thread the needle between important patient privacy concerns and making it easier for people with SUD to benefit from more integrated, coordinated care, 42 CFR Part 2 may still be a work in progress. SAMHSA plans to develop subregulatory guidance, and per the recently enacted Twenty-First Century Cures Act, the Secretary of Health and Human Services will convene relevant stakeholders to determine the effect of the new rule on patient care, health outcomes, and patient privacy. For now, while expanded consent provisions may help state payment and delivery system reforms by making it somewhat easier to share SUD data, lack of alignment with HIPAA and other provisions of the new rule will continue to create complexity around access to, and use of, this information.