Modifications to Confidentiality of Substance Use Disorder Patient Records
The U.S. Department of Health & Human Services (HHS), through its Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA), recently released a final rule titled “Confidentiality of Substance Use Disorder (SUD) Patient Records,” which modified regulations at 42 CFR Part 2 (“Part 2”) to better align with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Breach Notification, and Enforcement Rules. The final rule will strengthen confidentiality protections for patients, increase coordination among providers, and improve the integration of behavioral health information with medical health records.
Simplifying the Part 2 Consent and Redisclosure Process
The regulations now permit a single patient consent for all future uses and disclosures of Part 2 records for Treatment, Payment, and Healthcare operations (TPO). This allows a Part 2 Program, covered entity, or business associate to use and disclose Part 2 records for TPO as permitted by the HIPAA regulations until the patient revokes such consent in writing. The final rule requires that each disclosure made with a patient’s consent include a copy of the consent or a clear explanation of the scope of the consent. Further, a covered entity or business associate that receives Part 2 records pursuant to a TPO written consent may redisclose those records in accordance with the HIPAA regulations, except for uses and disclosures for civil, criminal, administrative, and legislative proceedings against the patient.
HHS also modified the requirements of the Part 2 consent to align more closely with the HIPAA Authorization. However, the final rule notes that the scope and effect of these documents continue to differ, and the HIPAA authorization does not have all the required elements of a Part 2 consent. An example is that Part 2 consent is required for the uses and disclosures of Part 2 records for TPO, but a HIPAA Authorization is not. In addition, a Part 2 consent form for TPO requires a statement that the patient’s records may be redisclosed, with exceptions, and the regulations contain special consent instructions for disclosures through an intermediary. Covered entities that are also a Part 2 program have the flexibility to use a single form that meets the applicable requirements of Part 2 consent and HIPAA authorization.
Further, separate consent is needed for Part 2 records for the use and disclosure of SUD counseling notes that are maintained separately from the rest of the record and for the use and disclosure of Part 2 records (or testimony relaying information contained in the record) in civil, criminal, administrative, or legislative investigations or proceedings.
Modifying Requirements for Record Segregation
The final rule expressly states that data segmentation and record segregation are not required by Part 2 programs, covered entities, and business associates that have received records based on a single consent for all future TPO; and removes language requiring segmentation of Part 2 data or segregation of records.
However, the Final Rule adds a new definition for “SUD Counseling Notes” and requires that SUD counseling notes be separated from the rest of the patient’s SUD and medical record. SUD counseling notes should not be generally available to anyone other than the treating clinician. SUD counseling notes means “notes recorded (in any medium) by a Part 2 program provider who is a SUD or mental health professional documenting or analyzing the contents of the conversation during a private SUD counseling session or group, joint, or family SUD counseling session that are separated from the rest of the patient’s SUD and medical record.” SUD counseling notes do not include medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.
Other Changes in the Part 2 Regulations
The final rule also provides new rights for patients under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as allowed under the HIPAA Privacy Rule. The regulations will continue to require that for Part 2, patients’ SUD treatment records not be used to investigate or prosecute the patient without written patient consent or a court order. In addition, records obtained in an audit or evaluation of a Part 2 program cannot be used to investigate or prosecute patients, absent written consent of the patients or a court order that meets Part 2 requirements. Further, the final rule applies breach notification requirements to Part 2 Records and provides HHS enforcement authority, including the possibility of civil money penalties for violations of Part 2.
This guest blog was from Lisa Shuman, MPA, CHC, CHPC, CHRC. For more information on this topic, contact her at lshum[email protected].
You can keep up-to-date with Strategic Management Services by following us on LinkedIn.
