Substance abuse privacy rules to be revamped

Register now

Federal rules for protecting the confidentiality of substance abuse treatment records will get their first update in almost 30 years. A proposed rule from the Substance Abuse and Mental Health Services Administration aims to realign regulations from 1987 with the healthcare system that exists today.

The confidentiality rules were developed in the mid-1980s to give individuals confidence to get substance abuse treatment without fearing disclosure of the treatment. Under the current rules, identifiable information can be released only with the affected individual’s consent.

Also See: You’ve been hacked: How to recover from the nightmare

The proposed rule would expand the scope of confidentiality protection beyond substance abuse treatment facilities to units of “general medical facilities” and “general medical practices” that offer substance abuse services, among other changes.

“Significant changes have occurred within the U.S. healthcare system that were not envisioned by the current regulations, including new models of integrated care that are built on a foundation of information sharing to support coordination of patient care, the development of an electronic infrastructure for managing and exchanging patient information, and a new focus on performance measurement within the healthcare systems,” according to the rule.

Other changes proposed for the new rule would include:

  • Expanding access for patients to get a list of entities to which their information has been disclosed under a general designation in the “To Whom” section of their consent form;
  • Letting patients know the name of the program or lawful holder of their information permitted to make disclosures;
  • Requiring holders of patient identifying information to have formal policies and procedures addressing security, “including sanitation of associated media for both paper and electronic records;
  • Establishing new policies for disposition of records from discontinued programs
  • Updating the summary of federal confidentiality requirements given to patients and making it available in paper or electronic form, and including contact information to report violations to appropriate authorities
  • Under a section covering medical emergencies, giving providers more discretion to determine when a bona fide medical emergency exists; and
  • Permitting an audit or evaluation of an organization for meeting requirements of a Centers for Medicare and Medicaid Services-regulated accountable care organization.

These changes, among others in the rule, will not come cheap; the lowest estimate of cost over 10 years is more than $200 million. If finalized, the changes would be effective six months after publication of the final rule. “However, signed consent forms in place prior to the effective date of the final rule would be valid until they expire,” according to the 144-page rule, available here.

For reprint and licensing requests for this article, click here.