Agency updates privacy rule for substance use disorder records
The Center for Substance Abuse Treatment at the Substance Abuse and Mental Health Services Administration has published a final rule modernizing regulations to reflect the current environment of information sharing through electronic health records.
The new rule aims to protect the identity, diagnosis, prognosis or treatment of patient records maintained in connection with a federally assisted substance abuse treatment program. SAMHSA's modification is an attempt to balance the need for sharing information with the need to protect confidentiality.
Congress in 1975 passed Title 42 of the Code of Federal Regulations Part 2 (42 CFR Part 2) because of concerns about the potentially negative consequences that could come from disclosing the records of individuals with substance use disorders. Much has changed since then the law governing the confidentiality of substance use disorder records went into effect—not the least of which has been the widespread adoption of EHRs by providers, as well as new models of integrated care based on information sharing to support better coordination and performance measures.
“That was back in an era of paper records—we now live in an era of electronic records,” says Kimberly Johnson, SAMHSA's director, who notes that the last substantive update to these regulations was in 1987.
SAMHSA's rule modifying 42 CFR Part 2 is intended to modernize the confidentiality of substance use patient records regulations by facilitating electronic information exchange within new healthcare models while addressing the legitimate privacy concerns of patients seeking treatment for a substance use disorder, contends Johnson.
“The benefits of modernizing the Part 2 regulations is to increase opportunities for individuals with substance use disorders to participate in new and emerging health and healthcare models and health information technology,” states the SAMHSA rule. “The final rule will facilitate the sharing of information within the healthcare system to support new models of integrated healthcare which, among other things, improve patient safety while maintaining or strengthening privacy protections for individuals seeking treatment for substance use disorders.”
Further, the agency believes that patient consent forms for disclosures addressed in the rule will result in “more individuals with substance use disorders participating in organizations that facilitate the exchange of health information (e.g., health information exchanges) and organizations that coordinate care (e.g., ACOs and coordinated care organizations), leading to increased efficiency and quality in the provision of healthcare for this population.”
According to Johnson, SAMHSA was guided by the governing statute in developing its final rule which restricts disclosure without consent other than under a small number of exceptions.
“A patient can sign a release form that would allow for their Part 2 information to be shared with all of their treating providers, so that information could be included in an electronic health record and be used by the treating providers that had access to the EHR,” she adds, noting that the rule also allows for disclosure of information for purposes of conducting scientific research.
When it comes to storing electronic records, Johnson says SAMHSA’s final rule provides flexibility in how to store them. “We made the distinction between electronic devices like a laptop or tablet and electronic media, which might be a CD, DVD, flash drive or some other storage media.” Specifically, the rule enables electronic records to be transferred to a portable electronic device with implemented encryption for data at rest.
The effective date of the final rule was originally slated for February 17. However, it was delayed one month because of a January 20 Office of Management and Budget memorandum that called on heads of executive departments and agencies to postpone most new regulations for review for 60 days. The final rule is now expected to go into effect on March 21, barring any unforeseen additional delays, Johnson says.
“We need to respect the privacy of patients—their problems are not disclosed to the physician so that the world may know,” Johnson adds.
However, Deborah Peel, MD, founder of the organization Patient Privacy Rights and a practicing psychiatrist/psychoanalyst, makes the case that the SAMHSA final rule is actually counterproductive.
“People are now very afraid of sharing sensitive information with doctors due to fears that their electronic medical records don’t keep their data private,” says Peel. “These changes [in SAMHSA’s final rule] are a massive mistake and will drive people away from treatment. The real problem is access to effective treatment, not sharing data, and not research.”
While Johnson acknowledges that “it’s a complicated and difficult equation,” she insists that “the bottom line is we’re trying to ensure that patients get good care.” SAMHSA is “committed to making this rule workable in the current healthcare environment,” Johnson concludes.