# Confidentiality of Substance Use Disorder Patient Records > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2017-00719 ## Record - **Collection:** Federal Register - **Document type:** Rule - **Published:** January 18, 2017 - **Citation:** 82 FR 6052 ## Text DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 42 CFR Part 2 [SAMHSA-4162-20] RIN 0930-AA21 Confidentiality of Substance Use Disorder Patient Records AGENCY: Substance Abuse and Mental Health Services Administration, HHS. ACTION: Final rule. SUMMARY: The Department of Health and Human Services (HHS) is issuing this final rule to update and modernize the Confidentiality of Alcohol and Drug Abuse Patient Records regulations and facilitate information exchange within new health care models while addressing the legitimate privacy concerns of patients seeking treatment for a substance use disorder. These modifications also help clarify the regulations and reduce unnecessary burden. DATES: Effective date: This final rule is effective February 17, 2017. FOR FURTHER INFORMATION CONTACT: Danielle Tarino, Telephone number: (240) 276-2857, Email address: PrivacyRegulations@samhsa.hhs.gov . SUPPLEMENTARY INFORMATION: Preamble Table of Contents I. Executive Summary A. Purpose of the Regulatory Action B. Summary of the Major Provisions C. Summary of Impacts II. Background A. Significant Technology Changes B. Statutory and Rulemaking History III. Overview of the Final Rule IV. Effective Date V. Discussion of Public Comments and Final Modifications to 42 CFR part 2 A. General Comments on the Proposed Rule 1. General Feedback on the Proposed Rule a. General Support for the Proposed Rule b. General Opposition to the Proposed Rule 2. The Proposed Rule Did Not Go Far Enough To Facilitate Information Exchange 3. Final Rule Should Balance Patient Protections With Enhanced Information Exchange 4. Part 2 Should Align With the Health Insurance Portability and Accountability Act B. Statutory Authority (§ 2.1) C. Reports of Violations (§  2.4) D. Definitions (§  2.11) 1. New Definitions a. Part 2 Program b. Part 2 Program Director c. Substance Use Disorder d. Treating Provider Relationship e. Withdrawal Management 2. Existing Definitions a. Central Registry b. Disclose or Disclosure c. Maintenance Treatment d. Member Program e. Patient f. Patient Identifying Information g. Person h. Program i. Qualified Service Organization j. Records k. Treatment 3. Terminology Changes 4. Other Comments on Definitions E. Applicability (§  2.12) F. Confidentiality Restrictions and Safeguards (§  2.13) 1. Delayed Implementation of List of Disclosures Provision 2. Responsibilities Under the List of Disclosures Process 3. Technological Challenges and Burden of the List of Disclosures Provision 4. Recommendations to Further Protect Patient Privacy 5. Other Comments and Recommendations on the List of Disclosures Provision G. Security for Records (§  2.16) H. Disposition of Records by Discontinued Programs (§  2.19) I. Notice to Patients of Federal Confidentiality Requirements (§  2.22) J. Consent Requirements (§  2.31) 1. General Comments on Consent Requirements a. General b. Consent Form Validity Period c. Technical Challenges to Proposed Consent Requirements d. Requests for Exemptions and Exceptions e. Commenter Recommendations 2. To Whom a. General b. Determination of Treating Provider Relationship c. Requests for Clarification d. Commenter Recommendations e. Proposed Alternative Approach for “To Whom” Section 3. Amount and Kind a. General b. Impact of the Amount and Kind Requirement on Providers and Patients c. Required Substance Use Disorder Information on Consent Forms d. Requests for Clarification 4. From Whom 5. New Requirements K. Prohibition on Re-Disclosure (§  2.32) 1. General 2. Impact of Re-Disclosure Prohibition on Patient Privacy and Patient Choice 3. Disclosure of Information that May Indicate a Substance Use Disorder 4. Technical Challenges in Preventing Unauthorized Re-Disclosure 5. Requests for Clarification of the Re-Disclosure Prohibition 6. Recommendations to Improve the Prohibition on Re-Disclosure L. Disclosures to Prevent Multiple Enrollments (§  2.34) M. Medical Emergencies (§  2.51) 1. General 2. Definition of “Bona Fide Medical Emergency” 3. Documentation of Medical Emergency 4. Other Comments on Medical Emergency N. Research (§  2.52) 1. General 2. Suggestions for Improvement of the Research Provisions 3. HIPAA and HHS Common Rule Requirements 4. Data Linkages 5. Multi-Payer Claims Database O. Audit and Evaluation (§  2.53) P. Other Public Comments on the Proposed Rule 1. Requests to Extend the Public Comment Period 2. Rulemaking Process 3. Implementation Timeline and Other Barriers to Implementation 4. Educational Opportunities 5. Increased Enforcement 6. Other Miscellaneous Comments on the Proposed Rule VI. Rulemaking Analyses A. Paperwork Reduction Act B. Regulatory Impact Analysis C. Regulatory Flexibility Act D. Unfunded Mandates Reform Act E. Federalism (Executive Order 13132) Acronyms ACO Accountable Care Organization ABAM American Board of Addiction Medicine ADAMHA Alcohol, Drug Abuse and Mental Health Administration APCD All Payer Claims Database ARRA American Recovery and Reinvestment Act of 2009 (Pub. L. 111-5) ASAM American Society of Addiction Medicine ATR Access to Recovery C-CDA Consolidated-Clinical Document Architecture CCD Continuity of Care Document CCLF Claim and Claim Line Feed CCO Coordinated Care Organization CFR Code of Federal Regulations CHIP Children's Health Insurance Program CMS Centers for Medicare & Medicaid Services CPCMH Certified Patient-Centered Medical Home DS4P Data Segmentation for Privacy EHR Electronic Health Record EQRO External Quality Review Organization FAQ Frequently Asked Question FAX Facsimile FDA Food and Drug Administration FR Federal Register HHS Department of Health and Human Services HIE Health Information Exchange HIO Health Information Organization HIPAA Health Insurance Portability and Accountability Act of 1996 (Pub. L. 104-191) HITECH Health Information Technology for Economic and Clinical Health Act of 2009 (Pub. L. 111-5, title XIII of division A and title IV of division B) HITPC Health Information Technology Privacy Committee IG Implementation Guide IRB Institutional Review Board IT Information Technology MCO Managed Care Organization MPCD Multi-Payer Claims Database NCQA National Committee for Quality Assurance NPRM Notice of Proposed Rulemaking N-SSATS National Survey of Substance Abuse Treatment Services OHRP Office for Human Research Protections OMB Office of Management and Budget ONC Office of the National Coordinator for Health Information Technology PDMP Prescription Drug Monitoring Program PPS Performing Provider System QE Qualified Entity QSO Qualified Service Organization QSOA Qualified Service Organization Agreement RFA Regulatory Flexibility Act RHIO Regional Health Information Organization SAMHSA Substance Abuse and Mental Health Services Administration SBIRT Screening, Brief Intervention, and Referrals for Treatment S&I Standards and Interoperability TEDS Treatment Episode Data Set U.S.C. United States Code USAO United States Attorney's Office VA Department of Veterans Affairs I. Executive Summary A. Purpose of the Regulatory Action The laws and regulations governing the confidentiality of substance use disorder records were written out of great concern about the potential use of substance use disorder information against individuals, causing individuals with substance use disorders not to seek needed treatment. The disclosure of records of individuals with substance use disorders has the potential to lead to a host of negative consequences, including: Loss of employment, loss of housing, loss of child custody, discrimination by medical professionals and insurers, arrest, prosecution, and incarceration. The purpose of the regulations at title 42 of the Code of Federal Regulations (CFR) part 2 (42 CFR part 2) is to ensure that a patient receiving treatment for a substance use disorder in a part 2 program is not made more vulnerable by reason of the availability of their patient record than an individual with a substance use disorder who does not seek treatment. Now, more than 29 years since the part 2 regulations were last substantively amended, this final rule makes policy changes to the regulations to better align them with advances in the U.S. health care delivery system while retaining important privacy protections. Need for Regulatory Action The last substantive update to these regulations was in 1987. Over the last 29 years, significant changes have occurred within the U.S. health care system that were not envisioned by the current (1987) regulations, including new models of integrated care that are built on a foundation of information sharing to support coordination of patient care, the development of an electronic infrastructure for managing and exchanging patient information, and a new focus on performance measurement within the health care system. SAMHSA wants to ensure that patients with substance use disorders have the ability to participate in, and benefit from health system delivery improvements, including from new integrated health care models while providing appropriate privacy safeguards. These new integrated models are foundational to HHS's delivery system reform goals of better care, smarter spending, and healthier people. Legal Authority for Regulatory Action This final rule revises 42 CFR part 2, Confidentiality of Alcohol and Drug Abuse Patient Records regulations. The authorizing statute, Title 42, United States Code (U.S.C.) 290dd-2, protects the confidentiality of the records containing the identity, diagnosis, prognosis, or treatment of any patient that are maintained in connection with the performance of any federally assisted program or activity relating to substance abuse (now referred to as substance use disorder) education, prevention, training, treatment, rehabilitation, or research. Title 42 of the CFR part 2 was first promulgated in 1975 (40 FR 27802) and last substantively updated in 1987 (52 FR 21796). B. Summary of the Major Provisions Proposed modifications to 42 CFR part 2 were published as a Notice of Proposed Rulemaking (NPRM) on February 9, 2016 (81 FR 6988). After consideration of the public comments received in response to the NPRM, SAMHSA is issuing this final rule amending 14 major provisions of 42 CFR part 2, as follows: Statutory authority for confidentiality of substance use disorder patient records (§ 2.1) combines old §  2.1 (Statutory authority for confidentiality of drug abuse patient records), and §  2.2 (Statutory authority for confidentiality of alcohol abuse patient records) and deleting references to 42 U.S.C. 290ee-3 and 42 U.S.C. 290dd-3, as these U.S.C. sections were omitted by Public Law 102-321 and combined and renamed into Section 290dd-2, Confidentiality of records. Because SAMHSA combined former §§  2.1 and 2.2 into § 2.1, we redesignated §§  2.2 through 2.5 accordingly. Reports of violations (§  2.4) revises the requirement for reporting violations of these regulations by methadone programs (now referred to as opioid treatment programs) to the Food and Drug Administration (FDA) because the authority over these programs was transferred from the FDA to the Substance Abuse and Mental Health Services Administration (SAMHSA) in 2001. Definitions (§  2.11) revises some existing definitions, adds new definitions of key terms that apply to 42 CFR part 2, and consolidates all but one of the definitions that are currently in other sections into §  2.11 ( e.g., the definition of “Minor” previously found in § 2.14(a)). We revised the definitions of “Central registry,” “Disclose or disclosure,” “Maintenance treatment,” “Member program,” “Patient,” “Patient identifying information,” “Person,” “Program,” “Qualified service organization (QSO),” “Records,” and “Treatment.” We also added definitions of “Part 2 program,” “Part 2 program director,” “Substance use disorder,” “Treating provider relationship,” and “Withdrawal management,” some of which replaced existing definitions. In addition, SAMHSA revised the regulatory text to use terminology in a consistent manner. The following definitions were not revised substantively: “Diagnosis,” “Informant,” “Minor,” “Third-party payer,” and “Undercover agent.” Applicability (§  2.12) continues to apply the 42 CFR part 2 regulations to a program that is federally assisted and holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment. Most changes to the applicability of the part 2 regulations result from SAMHSA's decision not to finalize one of its proposed changes to the definition of “Program” ( see § 2.11, Definitions). Whereas the NPRM definition of “Program” included, under certain conditions, “general medical practices” in addition to “general medical facilities,” the definition in this final rule is limited to “general medical facilities.” However, consistent with the NPRM, the definition of “Program” continues to use the term “general medical facility” rather than both “general medical facility” and “general medical care facility” that were used interchangeably in the 1987 final rule definition of “Program.” For example, an identified unit within a general medical facility is subject to part 2 if it holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment. In addition, if the primary function of medical personnel or other staff in a general medical facility is the provision of such services and they are identified as providing such services, they are considered a “Program” and, thus, subject to part 2. This final rule revises §  2.12(d)(2)(i)(C) so that restrictions on disclosures also apply to individuals or entities who receive patient records from other lawful holders of patient identifying information, such that patient records subject to the part 2 regulations include substance use disorder records maintained by part 2 programs, as well as those records in the possession of “other lawful holders of patient identifying information.” Confidentiality restrictions and safeguards (§  2.13) adds a requirement that, upon request, patients who have included a general designation in the “To Whom” section of their consent form ( see §  2.31) must be provided a list of entities (referred to as a List of Disclosures) to which their information has been disclosed pursuant to the general designation. Security for records (§  2.16) clarifies that this section requires both part 2 programs and other lawful holders of patient identifying information to have in place formal policies and procedures addressing security, including sanitization of associated media, for both paper and electronic records. Disposition of records by discontinued programs (§  2.19) addresses both paper and electronic records. SAMHSA also added requirements for sanitizing associated media. In Section I., Notice to Patients of Federal Confidentiality Requirements (§  2.22), SAMHSA clarifies that the written summary of federal law and regulations may be provided to patients in either paper or electronic format. SAMHSA also revised § 2.22 to require the statement regarding the reporting of violations include contact information for the appropriate authorities. Consent requirements (§  2.31) permits, in certain circumstances, a patient to include a general designation in the “To Whom” section of the consent form, in conjunction with requirements that the consent form include an explicit description of the amount and kind of substance use disorder treatment information that may be disclosed. SAMHSA decided not to finalize its proposed changes to the “From Whom” section, but did make minor updates to the terminology in the text. SAMHSA also revised § 2.31 to require the part 2 program or other lawful holder of patient identifying information to include a statement on the consent form when using a general designation in the “To Whom” section of the consent form that patients have a right to obtain, upon request, a list of entities to which their information has been disclosed pursuant to the general designation ( see §  2.13). In addition, SAMHSA revised § 2.31 to permit electronic signatures to the extent that they are not prohibited by any applicable law. In Section K., Prohibition on Re-disclosure (§  2.32), SAMHSA clarifies that the prohibition on re-disclosure only applies to information that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder, such as indicated through standard medical codes, descriptive language, or both, and allows other health-related information shared by the part 2 program to be re-disclosed, if permissible under other applicable laws. Disclosures to prevent multiple enrollments (§  2.34) modernizes the terminology and definitions and moves the definitions to §  2.11 (Definitions). Medical emergencies (§  2.51) revises the medical emergency exception to make it consistent with the statutory language and to give providers more discretion to determine when a “bona fide medical emergency” exists. Research (§  2.52) revises the research exception to permit data protected by 42 CFR part 2 to be disclosed to qualified personnel for the purpose of conducting scientific research by a part 2 program or any other individual or entity that is in lawful possession of part 2 data if the researcher provides documentation of meeting certain requirements related to other existing protections for human research. SAMHSA also revised § 2.52 to address data linkages to enable researchers holding part 2 data to obtain linkages to other datasets, provided that appropriate safeguards are in place as outlined in section 2.52. Audit and evaluation (§  2.53) modernizes the requirements to include provisions governing both paper and electronic patient records. SAMHSA also revised § 2.53 to permit an audit or evaluation necessary to meet the requirements of a Centers for Medicare & Medicaid Services (CMS)-regulated accountable care organization (CMS-regulated ACO) or similar CMS-regulated organization (including a CMS-regulated Qualified Entity (QE)), under certain conditions. The other sections in 42 CFR part 2 that are not referenced above are not addressed in this final rule nor were they discussed in the NPRM because SAMHSA is maintaining their content substantively unchanged from the 1987 final rule. C. Summary of Impacts In the first year that the final rule is in effect, we estimate that the total costs associated with updates to 42 CFR part 2 will be roughly $70,691,000. In year two we estimate that costs will be $17,680,000, and increase annually as a larger share of entities implement List of Disclosures requirements and respond to disclosure requests. Over the 10-year period of 2016-2025, the total undiscounted cost of the part 2 changes will be about $241 million in 2016 dollars. When future costs are discounted at 3 percent or 7 percent per year, the total costs become approximately $217,586,000 or $193,098,000, respectively. These costs are presented in the tables below. Costs associated with the 42 CFR part 2 final rule, include: updates to health IT system costs, costs for staff training and updates to training curricula, costs to update patient consent forms, costs associated with providing patients a list of entities to which their information has been disclosed pursuant to a general designation on the consent form ( i.e., the List of Disclosures requirement), and implementation costs associated with the List of Disclosures requirements. We assumed that costs associated with modifications to existing health IT systems, staff training costs associated with updating staff training materials, and costs to update consent forms will be one-time costs the first year the final rule is in effect and will not carry forward into future years. Staff training costs other than those associated with updating training materials are assumed to be ongoing annual costs to part 2 programs, also beginning in the first year that the final rule is in effect. The List of Disclosures costs are assumed to be ongoing annual costs to entities named on a consent form that disclose patient identifying information to their participants under the general designation. Costs associated with the List of Disclosures provision are limited to implementation costs for entities that chose to upgrade their health IT systems in order to comply with the List of Disclosures requirements. Several provisions in the final rule reference other lawful holders of patient identifying information in combination with part 2 programs. These other lawful holders must comply with part 2 requirements with respect to information they maintain that is covered by part 2 regulations. However, because this group is not clearly defined with respect to the range of organizations it may include, we are unable to include estimates regarding the number and type of these organizations and are only including part 2 programs in this analysis. The benefits of modernizing the part 2 regulations is to increase opportunities for individuals with substance use disorders to participate in new and emerging health and health care models and health information technology (IT). The final rule will facilitate the sharing of information within the health care system to support new models of integrated health care which, among other things, improve patient safety while maintaining or strengthening privacy protections for individuals seeking treatment for substance use disorders. Moreover, as patients are allowed, in certain circumstances, to include a general designation in the “To Whom” section of the consent form, we anticipate there will be more individuals with substance use disorders participating in organizations that facilitate the exchange of health information ( e.g., health information exchanges (HIEs)) and organizations that coordinate care ( e.g., ACOs and coordinated care organizations (CCOs)), leading to increased efficiency and quality in the provision of health care for this population. In addition, the revisions to the research provision (§ 2.52) will allow additional scientific research to be conducted that will facilitate continual quality improvement of part 2 programs and the important services they offer. II. Background A. Significant Technology Changes Since the promulgation of 42 CFR part 2, significant technology changes have impacted the delivery of health care. The Office of the National Coordinator for Health Information Technology (ONC) was established as an office within HHS under Executive Order 13335 on April 27, 2004. Subsequently, on February 17, 2009, the Health Information Technology for Economic and Clinical Health Act (HITECH Act) of the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-5) expanded the Department's health IT work, including the expansion of ONC's authority and the provision of federal funds for ONC's activities consistent with the development of a nationwide health IT infrastructure. This work included the certification of health IT; the authorization of CMS' Electronic Health Record (EHR) Incentive Program, including payments to eligible providers for the adoption and meaningful use of certified EHR technology; and numerous other federal agencies' programs—all of which served the objective of ensuring patient health information is secure, private, accurate, and available where and when needed. SAMHSA's role in encouraging the use of health IT by behavioral health (substance use disorder and mental health) providers, included: (1) Collaborating with ONC to develop two sets of Frequently Asked Questions (FAQs) and convening a number of stakeholder meetings to provide guidance on the application of 42 CFR part 2 to HIE models; (2) a one-year pilot project with five state HIEs to support the exchange of health information among behavioral health and physical health providers; and (3) the Data Segmentation for Privacy (DS4P) initiative within ONC's Standards and Interoperability (S&I) Framework facilitated: • The development of standards to improve the interoperability of EHRs containing sensitive information that must be protected to a greater degree than other health information due to 42 CFR part 2 and similar state laws, • six DS4P Implementation Guide (IG) use case pilot projects including the Department of Veterans Affairs (VA)/SAMHSA Pilot that implemented all the DS4P use cases and passed all conformance tests, and • the development of the application branded Consent2Share, an open-source health IT solution based on DS4P which assists in consent management and data segmentation. Consent2Share is currently being used by the Prince Georges County (Maryland) Health Department to manage patient consent directives while sharing substance use disorder information with an HIE. Despite SAMHSA's efforts, some stakeholders continued to request modernization of 42 CFR part 2 out of concern that part 2, as written in the current (1987) regulation, continues to be a barrier to the integration of substance use disorder treatment and physical health care. As noted below, SAMHSA plans to release shortly an updated version of Consent2Share with improved functionality and ability to meet List of Disclosures requirements. B. Statutory and Rulemaking History The Confidentiality of Alcohol and Drug Abuse Patient Records regulations, 42 CFR part 2, implement Section 543 of the Public Health Service Act, 42 U.S.C. 290dd-2, as amended by Section 131 of the Alcohol, Drug Abuse and Mental Health Administration Reorganization Act (ADAMHA Reorganization Act), Public Law 102-321 (July 10, 1992). The regulations were promulgated as a final rule on July 1, 1975 (40 FR 27802). In 1980, the Department invited public comment on 15 substantive issues arising out of its experience interpreting and implementing the regulations (45 FR 53). More than 450 public responses to that invitation were received and taken into consideration in the preparation of a 1983 NPRM (48 FR 38758). Approximately 150 comments were received in response to the NPRM and were taken into consideration in the preparation of the final rule released on June 9, 1987 (52 FR 21798). The Department published an NPRM again in the Federal Register (FR) on August 18, 1994 (59 FR 42561), which proposed a clarification of the definition of “Program” in the regulations. Specifically, the Department proposed to clarify that, as to general medical care facilities, these regulations cover only specialized individuals or units in such facilities that hold themselves out as providing and provide alcohol or drug abuse (now referred to as substance use disorder) diagnosis, treatment, or referral for treatment and which are federally assisted, directly or indirectly. On May 5, 1995, the final rule was released (60 FR 22296). SAMHSA posted a document in the FR on May 12, 2014, (79 FR 26929) announcing a public Listening Session planned for June 11, 2014, to solicit feedback on the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, 42 CFR part 2. SAMHSA accepted written comments until June 25, 2014. The Listening Session comments are posted on the SAMHSA Web site at http://www.samhsa.gov/about-us/who-we-are/laws-regulations/public-comments-confidentiality-regulations . Prompted by the need to update and modernize the Confidentiality of Alcohol and Drug Abuse Patient Records regulations at 42 CFR part 2, on February 9, 2016, SAMHSA published an NPRM that proposed revisions to the part 2 regulations and requested public input on the proposed changes during a 60-day public comment period (81 FR 6988). Although raised in the Listening Session public comments, SAMHSA decided not to address issues pertaining to e-prescribing and Prescription Drug Monitoring Programs (PDMPs) in the NPRM because they were not ripe for rulemaking at the time due to the state of technology and because the majority of part 2 programs are not prescribing controlled substances electronically. As noted in the NPRM, SAMHSA intends to monitor developments in this area to see whether further action may be warranted in the future. SAMHSA received 376 public comment submissions on the part 2 NPRM. The comments received were detailed, thoughtful, and reflective of the complex issues addressed and balanced in the part 2 regulations. This final rule reflects SAMHSA's thorough consideration of all substantive issues raised in the public comments in response to its proposals in the NPRM. III. Overview of the Final Rule In this final rule, the Department finalizes the modifications to the Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR part 2, including renaming it “Confidentiality of Substance Use Disorder Patient Records.” The modifications modernize the rule by facilitating electronic exchange of substance use disorder information for treatment and other legitimate health care purposes while ensuring appropriate confidentiality protections for records that might identify an individual, directly or indirectly, as having or having had a substance use disorder. Overview of Public Comments We received 376 public comments from medical health care providers; behavioral health care providers; combined medical/behavioral health care providers; HIEs, ACOs, CCOs, and certified patient-centered medical homes (CPCMHs), sometimes called health homes; third-party payers; privacy/consumer advocates; medical health care provider associations; behavioral health care provider associations; accrediting organizations; researchers; individuals (with no stated affiliation); attorneys (with no stated affiliation); HIT vendors; and state/local governments. The comments ranged from general support or opposition to the proposed provisions to very specific questions or comments regarding the proposed rules. Some comments were outside the scope of or inconsistent with SAMHSA's legal authority regarding the confidentiality of substance use disorder patient records. Likewise, other comments did not pertain to specific proposals made by SAMHSA in the NPRM. In some instances, commenters raised policy or operational issues that are best addressed through subregulatory guidance that SAMHSA will consider issuing subsequent to this final rule. Consequently, SAMHSA did not address these comments in this final rule. Commenters have also provided SAMHSA with informative feedback on how lawful holders, including third-party payers and others within the healthcare industry, use health data or hire others to use health data on their behalf to provide operational services such as independent auditing, legal services, claims processing, plan pricing and other functions that are key to the day-to-day operation of entities subject to this rule. We have previously clarified in responses to particular questions that contracted agents of individuals and/or entities may be treated as the individual/entity. Questions raised by commenters during this rulemaking have, however, highlighted varying interpretations of the current (1987) rule's restrictions on lawful holders and their contractors' and subcontractors' use and disclosure of part 2-covered data for purposes of carrying out payment, health care operations, and other health care related activities. In consideration of this feedback and given the critical role that third-party payers, other lawful holders, and their contractors and subcontractors play in the provision of health care services, SAMHSA is issuing a supplemental notice of proposed rulemaking (SNPRM) to seek further comments and information on this matter. IV. Effective Date In this final rule, SAMHSA has established a single effective date of 30 days after the publication of the final rule, or February 17, 2017. On this date, the revised 42 CFR part 2 will replace the 1987 version of part 2 in the CFR and all part 2 programs and other lawful holders of patient identifying information must comply with all aspects of the regulations. In the NPRM, SAMHSA proposed that, with the exception of §  2.13(d), part 2 programs and other lawful holders of patient identifying information would have to comply with applicable requirements of the revised part 2 regulations beginning 30 days after the publication of the final rule. See Section V.D.3 below for a discussion of “other lawful holders.” We proposed that entities would not have to comply with the List of Disclosures requirements of § 2.13(d) until two-years after the effective date of the final rule. As explained below, because the right to obtain, upon request, a List of Disclosures is only available to patients who use a general designation in the “To Whom” section of the consent form, entities must only have the technical capability to provide the List of Disclosures if they take advantage of the general designation provision. Therefore, SAMHSA has revised the effective date from that proposed to avoid confusion. However, signed consent forms in place prior to the effective date of this final rule will be valid until they expire. Nonetheless, part 2 programs may update signed consent forms consistent with the final rule, prior to the effective date of the final rule if they so choose. Consents obtained after the effective date will need to comply with the final rule, regardless of whether the consents involve patient identifying information obtained prior to or after the effective date of this final rule. Public Comments One commenter urged that the final rule allow for implementation of the research provision (§ 2.52) immediately or shortly after the rule takes effect. Several commenters raised concerns about how to interpret the two-year delayed implementation of List of Disclosures and whether the general designation will be used during that period. SAMHSA Response SAMHSA acknowledges commenters' confusion regarding the proposed two-year delayed compliance date for the List of Disclosures requirements. After considering the public comments received on this point, SAMHSA realized that such a two-year delayed compliance date for the requirements of § 2.13(d) is not helpful. As explained in the “To Whom” section of the part 2-compliant consent requirements ( see Section V.J.2 below), an entity that serves as an intermediary ( e.g., HIE, ACO, CCO) must comply with the List of Disclosures provision in order to disclose information pursuant to a general designation provided on the consent form ( see § 2.31(a)(4)(iii)(B)( 3 )( i )). Therefore, an entity that serves as an intermediary would be prohibited from electing to disclose information pursuant to a general designation without the ability to comply with the List of Disclosures requirement. It would not make sense to implement a two-year delayed compliance date for the List of Disclosures requirements at § 2.13(d) because the only reason an entity that serves as an intermediary would have to comply with the List of Disclosures requirements would be if they wanted to disclose information pursuant to general designations that have been included in the “To Whom” section of the patient consent form, which requires alerting patients to the fact that they have a right to request a list of entities to which their information has been disclosed (per § 2.13(d)). Thus, an entity that serves as an intermediary is prohibited from disclosing information pursuant to a general designation without having the capability to comply with the List of Disclosures requirements. For these reasons, it is not advisable to include a two-year delayed compliance date for the List of Disclosures provision. Some entities that serve as intermediaries as described by §  2.31(a)(4)(iii)(B) may elect never to disclose information pursuant to a general designation and, thus, would not need to comply with the List of Disclosures requirement. Those that choose to disclose information pursuant to general designations must ensure the capability to comply with the List of Disclosures requirements at § 2.13(d) before they disclose the information pursuant to a general designation. But there is no timeframe in which they need to comply; only the condition that if they choose to have the option of disclosing information pursuant to a general designation on a consent form, they must also be capable of providing a List of Disclosures upon request per § 2.13(d). Regarding the suggestion to allow for implementation of the Research provision § 2.52 immediately after the final rule takes effect, SAMHSA declines to make this change. For clarity regarding part 2 compliance, the 1987 part 2 final rule remains in effect until the effective date for the 2016 part 2 regulations established in this final rule. Because of the revised definitions that impact the research provision, it would create unnecessary confusion to make effective § 2.52 before the rest of the final rule. V. Discussion of Public Comments and Final Modifications to 42 CFR Part 2 In this section of the final rule, SAMHSA explains the finalized revisions to the part 2 regulations and responds to public comments received. If a part 2 CFR section is not addressed below, it is because SAMHSA did not propose changes to that part 2 provision and that this final rule maintains the existing language in that section. However, SAMHSA notes that in addition to the revisions discussed below, SAMHSA has made other technical, non-substantive, and nomenclature changes to various part 2 provisions. Those changes are reflected in the regulatory text at the end of this rule. A. General Comments on the Proposed Rule 1. General Feedback on the Proposed Rule a. General Support for the Proposed Rule Public Comments Many commenters expressed general support for the proposed rule, with some noting that the proposed rule would preserve the confidentiality rights of substance use disorder patients while facilitating the sharing of health information; would ensure that patients with a substance use disorder participate in, and benefit from, new integrated health care models without fear of putting themselves at risk of adverse consequences; would help reduce the stigma associated with substance use disorder; and would provide patients comfort in knowing they have control of their record. Several commenters expressed general support for the NPRM's proposed part 2 changes to enhance integrated care and information exchange. Multiple commenters, with some stressing the need for patient privacy protections, suggested that integrated networks of care between medical and behavioral health services is current best practice and will benefit patients. Two commenters implied general support. The first of these two commenters stated that the current practice of keeping paper substance use records separate from the EHR system increases work required to maintain records, creates redundancies, and could contribute to providers missing critical information needed for treating patients. The second commenter stated that the current (1987) part 2 regulations are out of step with the health care system's rapid adoption of EHRs, its capacity to quickly exchange information ( e.g., HIEs), the federal privacy and security regulations (Health Insurance and Portability and Accountability Act [HIPAA] and HITECH) governing these EHRs and exchanges, and the increasing treatment of patients' substance use in health care systems not covered by existing part 2 regulations, but by HIPAA. Another commenter expressed support for the facilitation of electronic exchange of substance use disorder treatment information where the confidentiality protections historically afforded patients by part 2 are maintained. A few commenters stated that the proposal would help patients with substance use disorders benefit from emerging care models that require enhanced health information exchange for better care coordination ( e.g., CPCMHs, ACOs). SAMHSA Response SAMHSA appreciates the support for updating the regulations. This final rule is intended to modernize the part 2 regulations by facilitating the electronic exchange of substance use disorder information for treatment and other legitimate health care purposes while ensuring appropriate confidentiality protections for records that might identify an individual, directly or indirectly, as having or having had a substance use disorder. Many new integrated care models rely on interoperable health IT and these proposed changes are expected to support the integration of substance use disorder treatment into primary and other specialty care, improving the patient experience, clinical outcomes, and patient safety while at the same time ensuring patient choice, confidentiality, and privacy. Due to its targeted population, part 2 provides more stringent federal protections than most other health privacy laws, including HIPAA. b. General Opposition to the Proposed Rule Public Comments Some commenters expressed general opposition to the proposed rule, with some arguing that it would eliminate the right of patients to protect and control personal health information; would introduce complexity, not simplification; and would maintain the stigma surrounding drug use. One commenter warned the proposed rule would create concessions to institutional stakeholders, both providers and researchers, who find the consent requirements inconvenient and burdensome. Many commenters requested that part 2 remain unchanged, with some stating that loosening part 2 regulations would dissuade substance use disorder patients from seeking help out of fear of how their information could be used against them or that the proposed regulations would not offer the intended protection. Some commenters asserted that maintaining a separate set of confidentiality restrictions aimed solely at substance use disorder providers and patients perpetuates the discrimination associated with substance use disorder and ultimately negatively impacts patients and the care they receive, suggesting that issues of substance use disorder information confidentiality should be part of the broader general medical care confidentiality regulations. Others argued that the fear of discrimination is a real problem for many individuals suffering from a substance use disorder and being able to receive treatment without worrying that personal information will be leaked is crucial in helping these people get the help they need so that they can return to their communities as contributing members of society. SAMHSA Response SAMHSA wants to ensure that patients with substance use disorders have the ability to participate in, and benefit from, new and emerging health care models that promote integrated care and patient safety while respecting the legitimate privacy concerns of patients seeking treatment for a substance use disorder due to the potential for discrimination, harm to their reputations and relationships, and serious civil and criminal consequences. This approach is consistent with the intent of the governing statute (42 U.S.C. 290dd-2) and regulations at 42 CFR part 2, which is to protect the confidentiality of substance use disorder patient records. SAMHSA has added more flexibility to some of the consent provisions, including a range of “To Whom” consent options that includes the current (1987) “To Whom” consent requirement, but still retained core part 2 protections, including the prohibition on re-disclosure as well as requiring the “Amount and Kind” section of the consent form to include how much and what kind of information is to be disclosed, including an explicit description of the substance use disorder information that may be disclosed. Changes to the research provision also enable patients to benefit from advanced research protocols while still complying with part 2 protections regarding patient confidentiality. However, with these conflicting comments, as well all other comments, SAMHSA was guided by the governing statute in developing the final rule, which restricts disclosure without consent other than under a small number of exceptions 2. The Proposed Rule Did Not Go Far Enough To Facilitate Information Exchange Public Comments Several commenters suggested that the proposed part 2 revisions did not go far enough to facilitate information exchange and data sharing. For example, some commenters asserted that the proposed regulations would maintain previous barriers and create additional barriers that impede the sharing of information exchange and care coordination necessary to effectively treat patients who seek care in a variety of settings. A few commenters said the proposed part 2 revisions go beyond the protections intended by the statutory requirements in 42 U.S.C. 290dd-2 and suggested that the proposed changes would continue to decrease access to substance use disorder treatment and the achievement of positive health outcomes. Citing concerns about people with substance use disorders who visit multiple health care providers to obtain medication, one commenter advocated that substance use disorder health care records should be accessible to all health care facilities for the sole purpose of better treating and rehabilitating these patients. Other commenters requested further clarification on the regulations to ensure that coordination of care happens smoothly for all patients, especially those at the highest need of coordination, without unnecessary barriers. Citing a 2010 report from the President's Council of Advisors on Science and Technology, a couple of commenters urged SAMHSA to initiate a broad conversation among other HHS agencies to develop a granular data specification standard that enables patients to be in full control of all their health data, not just part 2 data. Citing technological barriers, a commenter asserted that additional changes to part 2 are necessary to allow for technological solutions for sharing data. One commenter said new funding for HIEs permitted by recent CMS guidance could be maximized by more substantial revisions to part 2 that would encourage the inclusion of substance use disorder providers in HIEs. Expressing uncertainty as to whether data segmentation can be implemented effectively absent clear standards, a commenter expressed concern the result would be a two-tier system of how substance use disorder data are defined both by payers and by local and state jurisdictions that has the effect of having substance use disorder data exchanged differently depending on if the patient received services within or beyond the veil of part 2 regulation. Some commenters suggested that the current (1987) part 2 regulation and the proposed revisions maintain a status quo of segregated substance use disorder information with minimal benefits to patients, high compliance costs, and deterrence for organizations to provide substance use treatment. Some of these commenters said the part 2 regulations keep the substance use disorder treatment system isolated from general health care providers and reduce access to substance use disorder treatment being added by general health care organizations, which, due to administrative burden and liability fears, are less likely to add substance use disorder treatment. A few of these commenters asserted that the part 2 regulations have unintended consequences, including disadvantaging persons with a substance use disorder and treatment providers because of the burdens associated with constantly updating expiring consents. One of these commenters said that the burdens caused by the part 2 regulations are particularly costly because patients with substance use disorder are among the highest cost utilizers in the health care system. Some commenters asserted that maintaining a separate set of confidentiality restrictions aimed solely at substance use disorder providers and patients perpetuates the stigma associated with substance use disorder and ultimately negatively impacts patients and the care they receive, suggesting that issues of substance use disorder information confidentiality should be part of the broader general medical care confidentiality regulations. Some commenters expressed concern that the proposed part 2 revisions did not address information exchange issues associated with specific types of health care services delivery, including integrated delivery systems operating with a behavioral health organization unit or department; organizations that include affiliated entities, such as jointly held and operated hospital-based systems and health insurance plans; risk-based Medicaid managed care; social service programs integrated with publicly financed health delivery systems; and combined behavioral health service delivery. One commenter urged SAMHSA to include the release of previous substance use disorder treatment information from insurance companies to part 2 programs as disclosure permitted without consent under part 2. Another commenter expressed concern that SAMHSA did not propose an allowance under part 2 regarding appropriate disclosures by a health plan for the coordination of a health plan member's care. Expressing concern that the proposed part 2 revisions do not address many of the issues on which SAMHSA has issued guidance with respect to health information networks, a commenter asserted that such guidance is outdated and creates unintended obstacles to the desired exchange of information on patients with substance use disorders. SAMHSA Response The governing statute (42 U.S.C. 290dd-2) and regulations at 42 CFR part 2 protect the confidentiality of substance use disorder patient records. Consistent with the governing statute, SAMHSA wants to ensure that patients with substance use disorders have the ability to participate in, and benefit from new and emerging health care models which promote integrated care and patient safety while respecting the legitimate privacy concerns of patients seeking treatment for a substance use disorder due to the potential for discrimination, harm to their reputations and relationships, and serious civil and criminal consequences. Toward that end, SAMHSA held a Listening Session on June 11, 2014, to solicit feedback on the Confidentiality of Alcohol and Drug Abuse Patient Records regulations. All the feedback received from the Listening Session was considered and helped to inform the development of the proposed and final rules. In addition, SAMHSA collaborated with its federal partner experts in developing this final rule. Information exchange is addressed in both the applicability provision (§ 2.12) and the consent requirements provision (§ 2.31), among other places in this final rule. SAMHSA has added more flexibility to the “To Whom” section of the consent form, which will give patients the option to release their records to past, current, and/or future treating providers. In addition, § 2.13 requires a part 2-compliant consent form must list the date, event, or condition upon which the consent will expire, if not revoked before. Thus, it is not sufficient under part 2 for a consent form to merely state that that disclosures will be permitted until the consent is revoked by the patient. It is, however, permissible for a consent form to specify the event or condition that will result in revocation, such as having its expiration date be “upon my death.” The Applicability provision includes: “The restrictions on disclosure in these regulations do not apply to communications of information between or among personnel having a need for the information in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of patients with substance use disorders if the communications are within a part 2 program; or between a part 2 program and an entity that has direct administrative control over the program.” With this rulemaking, SAMHSA has attempted to facilitate the electronic exchange of substance use disorder treatment records while ensuring patient privacy. SAMHSA acknowledges that many EHRs and HIEs are experiencing technical barriers to segmenting or redacting substance use disorder treatment data. As a result, SAMHSA has spent several years supporting the continued development of the Consent2Share application, an open-source health IT solution based on DS4P, which assists in both consent management and data segmentation. It is designed to integrate with existing EHR and HIE systems via the developed standards. Consent2Share enables electronic implementation of various sensitive health information disclosure policies by applying the information-sharing rules needed to constrain the disclosure of sensitive data according to patient preferences. SAMHSA, in conjunction with ONC and other federal partners, also continues to support the development of data standards and IGs to further reduce technical barriers in the field. Finally, SAMHSA has added additional information from previously issued FAQ guidance to the preamble discussion in this final rule, such as information about medical emergencies and “holds itself out,” and plans to issue additional subregulatory guidance after publication of the final rule. 3. Final Rule Should Balance Patient Protections With Enhanced Information Exchange Public Comments Numerous commenters emphasized that the part 2 revisions must balance patient protections with enhanced information exchange and data sharing. Some commenters suggested that patient confidentiality should not be compromised by any updates to the part 2 regulations, reasoning that the stigma associated with having or having had a substance use disorder and the fear that this information may be used against an individual would lead them to not seek treatment. To this end, a few of these commenters cautioned SAMHSA to remain diligent in the oversight of these regulations to ensure that the information is only being conveyed to the appropriate parties with the sole intent to improve patient care. Other commenters emphasized that sharing patient information should be solely for necessary medical purposes. Another commenter argued that the interest in integrating mental health care with physical health care should not result in the erosion or elimination of the heightened privacy protections that are essential for effective mental health treatment. A few commenters urged SAMHSA to ensure that the final rule respects patient choice for privacy in the treatment of sensitive information like substance use disorder treatment records, including the right to control how their records are disclosed, even for health and payment purposes. A commenter said the proposed part 2 changes have substantially weakened the privacy protections surrounding the sharing of a patient's substance use treatment data. One commenter stated that before an individual's health data can be accessed, there should be a specific, legitimate reason, and a careful review of the patient's set of permissions. In addition to suggesting that mental health and substance abuse records be blocked from view by any providers or staff not directly involved in the care and treatment of a patient, a commenter asserted that a patient has the right to have substance abuse and/or mental health treatment records blocked from view by even their primary care provider or nurses. A couple of commenters asserted that it is both necessary and technologically possible to integrate substance use disorder and other health care information and effectively exchange substance use treatment data while maintaining the core protections of part 2, including consent requirements and the prohibition on re-disclosure. Emphasizing the importance of patient confidentiality and privacy, a few commenters asserted that sacrificing the dignity and well-being of a person seeking help for a substance use disorder in the name of convenience, administrative efficiency, and research is a poor way to achieve the well-being of either the person in need or the community. One of these commenters recommended that SAMHSA delay the part 2 changes until the technology is available to protect persons with substance use disorder. Another commenter encouraged a cautious, step-wise approach to making substance use treatment records more integrated with general medical records. This commenter expressed concern that making treatment records more accessible to other providers would exacerbate the stigmatization of substance use disorder, particularly among pregnant women, which could lead to these individuals not seeking treatment for their substance use disorder or prenatal care. SAMHSA Response SAMHSA reiterates its intent to ensure that patients with substance use disorders have the ability to participate in, and benefit from new and emerging health care models which promote integrated care and patient safety while respecting the legitimate privacy concerns of patients seeking treatment for a substance use disorder due to the potential for discrimination, harm to their reputations and relationships, and serious civil and criminal consequences. This approach is consistent with the intent of the governing statute (42 U.S.C. 290dd-2) and regulations at 42 CFR part 2, which is to protect the confidentiality of substance use disorder patient records. In response to the commenters who cautioned SAMHSA to remain diligent in the oversight of these regulations, SAMHSA has the statutory authority to promulgate 42 CFR part 2, but the Department of Justice retains the authority for enforcing 42 CFR part 2. Reports of violation of these regulations may be directed to the United States Attorney for the judicial district in which the violation occurs. The report of any violations of these regulations by an opioid treatment program may be directed to United States Attorney for the judicial district in which the violation occurs as well as the SAMHSA office for opioid treatment program oversight. SAMHSA has oversight of opioid treatment programs through 42 CFR part 8. Related to oversight and compliance education, SAMHSA expects to issue FAQs as it has done in the past and develop other subregulatory guidance such as education and outreach materials. SAMHSA has added more flexibility to some of the consent provisions but still retained core part 2 protections, including prohibition on re-disclosure as well as consent options that would continue to give patients significant control. For example, the “To Whom” section of the consent form includes an option permitting a general designation under certain circumstances. However, SAMHSA retained the option of listing the name(s) of the individual(s) to whom a disclosure is made. In addition, any disclosure made under these regulations must comply with the “Amount and Kind” of information to be disclosed and the purpose of the disclosure, as provided on a part 2-compliant consent form. Furthermore, § 2.13(a) limits the information to be disclosed to that information which is necessary to carry out the purpose of the disclosure. Moreover, a patient has the option to withhold consent to disclosure of any of their substance use disorder information. SAMHSA is aware that technology adoption is an ongoing process and that many behavioral health providers have yet to adopt electronic health records as incentive payments have been unavailable for such purposes for these providers under the HITECH Meaningful Use Program. In addition, paper records are still used today in some part 2 programs and shared through facsimile (FAX). Therefore, in spite of advances in technology, some stakeholders are concerned that part 2, as currently written, continues to be a barrier to the integration of substance use disorder treatment and physical health care. Rather than waiting for the development and adoption of technology, SAMHSA decided to issue these final regulations to ensure that patients with substance use disorders have the ability to participate in, and benefit from new and emerging health care models which promote integrated care and patient safety while respecting the legitimate privacy concerns of patients seeking treatment for a substance use disorder due to the potential for discrimination, harm to their reputations and relationships, and serious civil and criminal consequences. SAMHSA understands the importance of not compromising patient protection, and has, in § 2.13(d) of these final regulations, required an entity that serves as an intermediary (upon request) to provide a List of Disclosures made pursuant to the general designation option. Further, as discussed later in this preamble, the general designation option may not be used until there is technical capability to provide the required List of Disclosures. 4. Part 2 Should Align With the Health Insurance Portability and Accountability Act Public Comments Many commenters expressed that part 2 should be aligned with HIPAA. Some commenters specifically mentioned various areas for HIPAA alignment, including the consent form; Business Associate Agreement standards; treatment, payment, and health care operations; patient-requested restrictions on disclosure; de-identification standards, medical emergencies; research; the definition of “Patient identifying information;” HIPAA penalties contained in the HITECH Act; and re-disclosure provisions. Many commenters asserted that aligning the regulations with HIPAA would help to strike an appropriate balance between protecting sensitive patient health information while providing coordinated, quality care. Many commenters urged SAMHSA to align part 2 with HIPAA to broaden the allowable sharing of data for purposes of care coordination and patient safety. Numerous commenters urged that substance use disorder records and treatments should be held to the same level of privacy as all other health records. Other commenters raised the concern of equal access, stating that individuals with substance use disorder should have the same access to the benefits of increased care coordination as individuals without substance use disorder. Commenters encouraged the broader harmonization of part 2, HIPAA, and HITECH into a single uniform set of standards applicable for all personal health information, including substance use disorder treatment and payment. Some commenters asserted that HIPAA is sufficient to protect patient privacy and part 2 is no longer necessary. Some commenters also asserted that part 2 also predates the development of EHR and HIEs, and there is pressing need to reconsider these rules in light of more recent technological and legal developments. Some commenters expressed concern that complying with both part 2 and HIPAA would lead to undue administrative burden and management issues across the continuum of patient care. A commenter recommended that SAMHSA should add the same release requirements for substance use disorder treatment as is required for psychotherapy notes under HIPAA, which are restricted from release without the client's consent. According to the commenter, this would give substance use disorder patients protections with Business Associates Agreements (instead of additional rules and forms for Qualified Service Organization Agreements [QSOAs]), notification upon breach requirements, and other rights already afforded persons receiving medical and mental health care. Several commenters said part 2 should be as consistent as possible with HIPAA, except for the prohibition on use for investigation, prosecution, or criminal charges. SAMHSA Response SAMHSA noted the many comments from a wide range of commenters that requested that SAMHSA align part 2 provisions with HIPAA where possible. In some instances, SAMHSA has attempted to do so in this final rule to the extent the change was permissible under 42 U.S.C. 290dd-2. At the same time, part 2 and its governing statute are separate and distinct from HIPAA and its implementing regulations. Because of its targeted population, part 2 provides more stringent federal protections than most other health privacy laws, including HIPAA. In response to comments about alignment of this regulation with HIPAA, SAMHSA has aligned the interpretation the definition of “Patient identifying information” with HIPAA to the extent feasible. In addition, SAMHSA revised Security for records (§ 2.16) to more closely align with HIPAA. B. Statutory Authority (§  2.1) SAMHSA is adopting this section as proposed. SAMHSA has combined what was §§  2.1 (Statutory authority for confidentiality of drug abuse patient records) and 2.2 (Statutory authority for confidentiality of alcohol abuse patient records) and renamed the new §  2.1, Statutory authority for confidentiality of substance use disorder patient records. We have re-designated §§  2.2 through 2.5 accordingly. In the new § 2.1, SAMHSA has deleted references to 42 U.S.C. 290ee-3 and 42 U.S.C. 290dd-3. Sections 290dd-3 and 290ee-3 were omitted by Public Law 102-321 and combined and renamed into Section 290dd-2, Confidentiality of records. In addition, we have deleted references to laws and regulations that have been repealed in §  2.21. Public Comments One commenter urged SAMHSA to assess whether existing statutory authority is adequate to modernize part 2 regulatory requirements to keep pace with existing laws and industry developments while also protecting privacy, and to discuss necessary statutory changes in the final rule. Further, the commenter recommended that SAMHSA encourage Congress to convene public hearings to evaluate proposals for statutory changes and delay issuing a final rule if pending legislative proposals are enacted that change the legal landscape for substance use disorder information and related protections. A commenter urged SAMHSA to address the congressional action that may be needed to effectively expand the ability to provide coordinated services, such as including health and human services agencies' field staff clearly into the definition of treatment terms. A few commenters suggested that the statutory authority underlying the part 2 regulations (42 U.S.C. 290dd-2) should be revised. Another commenter asserted that the 1992 confidentiality statute should be reformed to afford patients greater protections against unlawful disclosure of their substance use disorder treatment, limit the use of information shared for non-health purposes, provide meaningful enforcement and penalties, and more effectively prevent discrimination. Another commenter recommended that modifications should be made to HIPAA to incorporate special protections and limitations for substance use information and that the part 2 regulations should be rescinded. If the intent of the part 2 changes is to prevent inappropriate adverse consequences from the disclosure of substance use disorder health data, a commenter suggested that those specific adverse consequences should be targeted with legislation reform, rather than providing a blanket privacy allowance that hides medical information from providers. SAMHSA Response SAMHSA does not have the authority to repeal or revise the governing statute for the regulations codified at 42 CFR part 2 nor any other statute, as that power is given to Congress. The part 2 authorizing statute, 42 U.S.C. 290dd-2, gives the Secretary broad authority to carry out the confidentiality provisions therein, but to promulgate requirements to: (1) Carry out the purposes of the legislation; (2) prevent its circumvention or evasion; and (3) facilitate its compliance. These part 2 revisions were drafted to further these three purposes while, to the extent allowable under the legislation, permitting disclosure and use to increase access to treatment and improve treatment services. The intent of the part 2 regulations and its governing statute (42 U.S.C. 290dd-2) is to protect the confidentiality of substance use disorder patient records. Because individuals seeking treatment for substance use disorders may experience a host of negative consequences, including discrimination, harm to their reputations and relationships, and possibly serious civil and criminal consequences should information regarding their treatment be improperly disclosed, there is a specific need for strong privacy protections for substance use disorder records. C. Reports of Violations (§  2.4) SAMHSA is adopting this section as proposed. We have revised the requirement of reporting violations of these regulations by a methadone program to the FDA (§  2.5(b)). The authority over methadone programs (now referred to as opioid treatment programs) was transferred from the FDA to SAMHSA in 2001 (66 FR 4076). Suspected violations of 42 CFR part 2 by opioid treatment programs may be reported to the U.S. Attorney's Office for the judicial district in which the violation occurred, as well as the SAMHSA office responsible for opioid treatment program oversight. Public Comments SAMHSA received no public comments on this section. This section of the final rule is adopted as proposed. D. Definitions (§  2.11) SAMHSA has consolidated all of the definitions in 42 CFR part 2, with the exception the definition of the term “Federally assisted,” into a single section at §  2.11. SAMHSA has retained the definition of the term “Federally assisted” in § 2.12 (Applicability) for the purpose of clarity because it is key to understanding the applicability of the part 2 regulations. SAMHSA is adopting these structural changes as proposed in the NPRM. Specific definitions are discussed in the sections below. If a part 2 definition is not addressed below, it is because SAMHSA did not propose or make substantive changes to that definition. However, as discussed below, SAMHSA updated the terms in those definitions, as appropriate ( e.g., to replace “program” with “part 2 program,” and when “alcohol abuse” and “drug abuse” were used collectively to replace it with “substance use disorder”). The definitions in the regulatory text of this final rule reflect these changes. 1. New Definitions a. Part 2 Program SAMHSA is adopting this definition as proposed. SAMHSA defines a “Part 2 program” as “a federally assisted program (federally assisted as defined in §  2.12(b) and program as defined in §  2.11). See §  2.12(e)(1) for examples.” We have retained the examples provided in §  2.12(e)(1) of the current (1987) regulations, with minor clarifications in § 2.12(e)(1), because they explain the part 2 applicability and coverage. SAMHSA has replaced the term “program” with “part 2 program,” where appropriate. For example, we have revised the definition of QSO, including replacing “program” with “part 2 program,” which is discussed in depth below (see Section V.D.2.i., Existing Definitions). We also replaced “program” with “part 2 program” in several other definitions, while making no additional changes. While a couple of commenters purported to address the proposed definition of “Part 2 program,” the nature of their comments made clear that their underlying concern was how SAMHSA defined “Program” for purposes of part 2. For this reason, these comments are addressed in the discussion of the definition of “Program” below (see Section V.D.2.h). b. Part 2 Program Director SAMHSA is adopting this definition as proposed, except for a non-substantive technical edit. Because of the addition of the “Part 2 program” definition, we have defined a “Part 2 program director” as: • In the case of a part 2 program that is an individual, that individual; and • In the case of a part 2 program that is an entity, the individual designated as director or managing director, or individual otherwise vested with authority to act as chief executive officer of the part 2 program. We have deleted the definition of “Program Director.” Public Comments SAMHSA received no public comments on this definition. This section of the final rule is adopted as proposed. c. Substance Use Disorder SAMHSA is adopting this definition as proposed, except to remove the final sentence, “Also referred to as substance abuse.” Throughout this rule, SAMHSA made revisions to refer to alcohol abuse and drug abuse collectively as “substance use disorder” but, when referring to the part 2 governing statute, we use “substance abuse” since that is the term used in 42 U.S.C. 290dd-2. SAMHSA also uses the term “substance abuse” when discussing public comments and other publications that use that term. For consistency, SAMHSA also revised the title of 42 CFR part 2 from “Confidentiality of Alcohol and Drug Abuse Patient Records” to “Confidentiality of Substance Use Disorder Patient Records.” SAMHSA has replaced “alcohol or drug abuse” with “substance use disorder” in several definitions. While SAMHSA has deleted the definitions of “Alcohol abuse” and “Drug abuse,” we continued to use the terms “alcohol abuse” and “drug abuse” when referring to 42 U.S.C. 290dd-3 and 42 U.S.C. 290ee-3 (omitted by Pub. L. 102-321 and combined and renamed into Section 290dd-2), respectively, because they are the terms used in the statutes. SAMHSA is defining the term “Substance use disorder” in such a manner as to cover substance use disorders that can be associated with altered mental status that has the potential to lead to risky and/or socially prohibited behaviors, including, but not limited to, substances such as, alcohol, cannabis, hallucinogens, inhalants, opioids, sedatives, hypnotics, anxiolytics, and stimulants. In addition, the “Substance use disorder” definition clarifies that, for the purposes of these regulations, the term excludes both tobacco and caffeine. Public Comments Several commenters expressed support for the newly defined term “substance use disorder” to replace references to alcohol and drug abuse. One commenter requested that SAMHSA clarify the scope of substance use disorder and what constitutes substance use treatment. Another commenter suggested that, in the definition of substance use disorder, protected data should be directly related to an objective measure, such as information related to specific payment or clinical diagnosis codes submitted in connection with reimbursement for services. SAMHSA Response The final rule adopts the definition of substance use disorder as proposed, except that the parenthetical of the proposed definition is not adopted in the final rule. Use of the term is consistent with recognized classification manuals, current diagnostic lexicon, and commonly used descriptive terminology. Moreover, SAMHSA declines to define substance use disorder treatment by specific billing or diagnostic codes in in the final rule as these codes are subject to frequent revision. d. Treating Provider Relationship SAMHSA is modifying the proposed definition of “Treating provider relationship” slightly to account for the situation of involuntary commitment and other situations where a patient is diagnosed, evaluated and/or treated, but may not have actually consented to such care, as discussed in greater detail below. In summary, a treating provider relationship means that, regardless of whether there has been an actual in-person encounter: • A patient is, agrees to, or is legally required to be diagnosed, evaluated, and/or treated, or agrees to accept consultation, for any condition by an individual or entity, and; • The individual or entity undertakes or agrees to undertake diagnosis, evaluation, and/or treatment of the patient, or consultation with the patient, for any condition. As explained in the NPRM, the term “agrees” as used in the definition does not necessarily imply a formal written agreement. An agreement might be evidenced, among other things, by making an appointment or by a telephone consultation. It is also important to note that, based on the definition of treating provider relationship, SAMHSA considers an entity to have a treating provider relationship with a patient if the entity employs or privileges one or more individuals who have a treating provider relationship with the patient. Public Comments A few commenters expressed support for the proposed definition of “treating provider relationship.” One commenter supported the definition and added that this type of relationship could be a result of any action taken to schedule, refer, or order services that are related to health services to be provided in the future. Other commenters provided suggestions to improve the definition, including specifying entities involved in identifying, evaluating, and referring for treatment any persons in need of substance use disorder services; adding related services, including social services, and consultation; accounting for patients who cannot agree or consent to the relationship; and clarifying that an individual's designated treating provider is also a treating provider for part 2 purposes, even before the patient's first appointment. A few commenters requested that HIEs, health plans, and organizations that provide care coordination be added to the definition, or that comparable definitions be provided for these entities. A few commenters objected to the consent requirements limiting recipients to entities with a “treating provider relationship,” and suggested that the requirement be eliminated, or the term be redefined to include entities that provide care management. A few commenters also disagreed with the interpretation that equates making an appointment with an agreement to diagnose or treat. Some commenters raised a number of questions about the definition, including whether the definition applies to each hospital in a system or to the system as a whole; whether the definition applies to Medicaid managed care programs with mandatory enrollment; whether a care coordination entity can form a treating provider relationship with an individual; and whether ancillary providers, such as laboratories, pharmacies, therapists, counselors, or mental health specialists, fall within the definition of treating provider relationship. SAMHSA Response A treating provider relationship, as defined in this final rule, begins when an individual seeks or receives health-related assistance from an individual or entity who may provide assistance. However, the relationship is clearly established when the individual or entity agrees to undertake diagnosis, evaluation, and/or treatment of the patient, or consultation with the patient, and the patient agrees to be treated, whether or not there has been an actual in-person encounter between the individual or entity and the patient. When a patient is not regarded as being legally competent under the laws of their jurisdiction, such as when a patient is subject to an involuntary commitment ( i.e., formally committed for behavioral health treatment by a court, board, commission, or other legal authority), a treating provider relationship may be established when a patient is, agrees to, or is legally required to be provided consultation, diagnosis, evaluation, and/or treatment by an individual or entity. A treating provider relationship may be established whether or not there has been an actual in-person encounter between the individual or entity and patient. A treating provider relationship with a patient may be established by any member of the health care team as long as the relationship meets the definition of “Treating provider relationship.” SAMHSA believes that further specification in this definition is unnecessary. e. Withdrawal Management SAMHSA is adopting this definition as proposed. SAMHSA has removed the definition of “Detoxification treatment” and replaced it with the definition of the currently acceptable term “Withdrawal management” as indicated in the American Society of Addiction Medicine (ASAM) Principles of Addiction Medicine, 5 th edition. 1 1 ASAM Principles of Addiction Medicine, 5th edition, 2014, Richard Ries et al., editor. http://www.asam.org/quality-practice/essential-textbooks/principles-of-addiction-medicine (last accessed Aug. 1, 2016). Public Comments One commenter supported replacing the term “Detoxification treatment” with the term “Withdrawal management.” SAMHSA Response SAMHSA appreciates this support. 2. Existing Definitions a. Central Registry SAMHSA is adopting this definition as proposed. SAMHSA has updated the definition of “Central registry” to incorporate currently accepted terminology. Public Comments One commenter stated that the NPRM preamble described the proposed revisions to the definition of “central registry” as changes to “update terminology to make the definition clearer,” rather than detailing the proposed changes to the definition, so there was insufficient information for public comment. SAMHSA Response Exact language for the definition of “central registry” was provided in the NPRM regulation text and is being adopted as proposed. b. Disclose or Disclosure SAMHSA is modifying the proposed definition of “Disclose” to specifically cover diagnosis, treatment, and referral for treatment for substance use disorder, as follows: “ Disclose means to communicate any information identifying a patient as being or having been diagnosed with a substance use disorder, having or having had a substance use disorder, or being or having been referred for treatment of a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person.” We have updated terminology and made the definition clearer. SAMHSA has defined only one word, “Disclose,” since it is implied that the same definition applies to other forms of the word. Public Comments A commenter encouraged SAMHSA to develop guidance and promote standards adoption for the identification of part 2 data so that the implementation and applicability of concrete restrictions and obligations can be applied to the disclosure of such data. Another commenter urged coordination between the definitions of “disclosure” of a substance use disorder and a current or former “patient,” because someone may have a past substance use disorder but may not have been a former patient. A commenter stated that the NPRM preamble described the proposed revisions to the definition of “disclosure” as changes to “update terminology and make the definition clearer,” rather than detailing the proposed changes to the definition, so there was insufficient information for public comment.SAMHSA Response With regard to developing subregulatory guidance and promoting standards adoption, SAMHSA is an organizational member of Health Level 7 (HL7) and is working to ensure that health IT standards support the needs of behavioral health treatment patients and providers. SAMHSA has supported the creation of several HL7 standards, including the Composite Privacy Consent Directive Domain Analysis Model to capture the requirement of states and federal agencies. Those requirements were reflected in the IG for Clinical Document Architecture Release 2 (CDA R2) to provide a standard-based electronic representation of a consent to support the management of consent directives and policies. In response to comments urging coordination between the definition of “disclosure” and a current or former patient, SAMHSA has expanded the definition of “disclose” to include any information identifying a patient as “being or having been diagnosed with a substance use disorder, having or having had a substance use disorder, or being or having been referred for treatment of a substance use disorder.” Exact language for the definition of “disclosure” was provided in the NPRM regulatory text and is being adopted as proposed. We note that to the extent an individual may have had a past substance use disorder diagnosis, but never sought or received diagnosis, treatment, or referral for substance use disorder treatment, the definition of patient would not cover such individual and the part 2 regulations would not apply to that individual's health information unless and until the individual is a patient as defined in these regulations. c. Maintenance Treatment SAMHSA is modifying this definition from what was proposed by replacing the term “pharmacotherapy” with the phrase “long-term pharmacotherapy” for purposes of clarity to read as follows: “ Maintenance treatment means long-term pharmacotherapy for individuals with substance use disorders that reduces the pathological pursuit of reward and/or relief and supports remission of substance use disorder-related symptoms.” As compared to the 1987 final rule definition of “Maintenance treatment,” SAMHSA updated terminology in the definition and moved it from § 2.34 to § 2.11. Public Comments A commenter stated that the NPRM preamble described the proposed revisions to the definition of “maintenance treatment” as changes to “update terminology and make the definition clearer,” rather than detailing the proposed changes to the definition, so there was insufficient information for public comment. SAMHSA Response Exact language for the proposed definition of “maintenance treatment” was provided in the NPRM regulation text at 81 FR 7014. d. Member Program In response to comments received, SAMHSA has revised the definition of “Member program,” by replacing a reference to a specific geographic distance, so it reads as follows: “ Member program means a withdrawal management or maintenance treatment program which reports patient identifying information to a central registry and which is in the same state as that central registry or is in a state that participates in data sharing with the central registry of the program in question.” Public Comments A commenter asserted that the 125-mile distance to a state border limitation contained within the definition of “member program” does not adequately recognize the geographic realities of states with significant rural and frontier areas, and the commenter strongly suggested that it be eliminated. SAMHSA Response In response to the comment, SAMHSA has removed the distance from the definition to address the concerns about rural areas and replaced it with “is in a state that participates in data sharing with the central registry of the program in question.” We removed the distance requirement from the definition of “Member program” to reflect that in some states ( e.g., with rural areas) the distance from the border of the state in which the central registry is located may exceed 125 miles. e. Patient SAMHSA is adopting this definition as proposed. To emphasize that the term “Patient” refers to both current and former patients, SAMHSA has revised the definition as follows: “ Patient means any individual who has applied for or been given diagnosis, treatment, or referral for treatment for a substance use disorder at a part 2 program. Patient includes any individual who, after arrest on a criminal charge, is identified as an individual with a substance use disorder in order to determine that individual's eligibility to participate in a part 2 program. This definition includes both current and former patients.” Public Comments One comment opposed the inclusion of former patients in the definition because retrospective outcome studies would be difficult to conduct because many patients relocate or their contact information becomes otherwise unobtainable for purposes of obtaining consent to disclose and use patient identifying information. One commenter opposed including in the definition individuals who “applied for” but did not receive a diagnosis and also asked who makes the identification of an individual with a substance use disorder. Another commenter suggested that the definition should include individuals participating in prevention programs and recovery support programs. A commenter asked whether the definition includes an individual who has been involuntarily committed to a program for treatment and suggested that the final rule clarify that such an individual is considered a patient and entitled to part 2's protections. SAMHSA Response Regarding the opposition to including former patients in the definition of “Patient” because retrospective outcome studies would be difficult to conduct, this concern appears to be based on a misunderstanding that a consent requires a specific expiration date. A part 2-compliant consent form must list the date, event, or condition upon which the consent will expire, if not revoked before. Therefore, it would be permissible for a consent form to specify the event or condition that will result in revocation, such as having its expiration date be “upon my death.” Consequently, it is possible for researchers to obtain consents that would permit retrospective outcome studies. Regarding the inclusion of “applied for” in the definition of “Patient,” this definition has not changed from that included in the 1987 final rule except to replace “alcohol and drug abuse” with “substance use disorder.” SAMHSA declines to make the recommended change since no other concerns regarding the inclusion of “applied for” have been received in over 29 years. Patients who are involuntarily committed to participating in or receiving substance use disorder services from a part 2 program are covered by the definition. SAMHSA declines to accept the suggestion that the definition should be expanded to cover patients in prevention programs as such programs are not covered by the definition of a part 2 program. f. Patient Identifying Information SAMHSA is modifying the definition as proposed to: (1) Clarify that SAMHSA intends for the identifiers listed in the HIPAA Privacy Rule at 45 CFR 164.514(b)(2)(i) that are not already included in the definition of patient identifying information to meet the “or similar information” standard; (2) delete the word “publicly” from the phrase “can be determined with reasonable accuracy either directly or by reference to other publicly available information”; and (3) to revise the last sentence as follows: for internal use only by the part 2 program, if that number does not consist of, or contain numbers (such as a social security, or driver's license number) that could be used to identify a patient with reasonable accuracy from sources external to the part 2 program.” SAMHSA intends for the identifiers listed in the HIPAA Privacy Rule at 45 CFR 164.514(b)(2)(i) that are not already included in the definition of “Patient identifying information” to meet the following clause: “or similar information.” Those HIPAA Privacy Rule identifiers are: (1) Name; (2) All geographic subdivisions smaller than a [s]tate, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: (i) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (ii) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000; (3) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; (4) Telephone numbers; (5) Fax numbers; (6) Electronic mail addresses; (7) Social security numbers; (8) Medical record numbers; (9) Health plan beneficiary numbers; (10) Account numbers; (11) Certificate/license numbers; (12) Vehicle identifiers and serial numbers, including license plate numbers; (13) Device identifiers and serial numbers; (14) Web Universal Resource Locators (URLs); (15) Internet Protocol (IP) address numbers; (16) Biometric identifiers, including finger and voice prints; (17) Full face photographic images and any comparable image; or (18) Any other unique identifying number, characteristic, or code. Public Comments A few commenters urged that the definition of “Patient identifying information” be aligned with the “protected health information,” including the patient identifiers, under HIPAA. One commenter recommended that telephone numbers and email addresses should be mentioned because they are accessible by electronic means. Another commenter suggested that SAMHSA delete the reference to publicly available information; use a phrase such as, “information with respect to which there is a reasonable basis to believe that the information can be used to identify the individual”; and mention other identifiers assigned to an individual, including credit card numbers, driver's license numbers, and automobile license numbers. SAMHSA Response The HIPAA Privacy Rule, at 45 CFR 164.514(b)(2)(i), enumerates 18 identifiers that make health information individually identifiable. SAMHSA considers any of these identifiers to be patient identifying information either because SAMHSA has explicitly listed the identifier in the definition of patient identifying information in 42 CFR part 2 or because SAMHSA considers the identifier to be `similar information' (See § 2.11 Definitions). Also as suggested, SAMHSA has deleted the word “publicly” from the phrase “can be determined with reasonable accuracy either directly or by reference to other publicly available information;” g. Person SAMHSA is adopting this definition as proposed. SAMHSA has revised the definition of “Person” to clearly indicate that “Person” is also referred to as individual or entity. Public Comments A commenter urged SAMHSA to recognize an “Affiliated Covered Entity” under HIPAA as an “entity” in the definition of “Person.” Another commenter asked that the definition specify that it includes limited liability companies. A commenter suggested removing the redundant parenthetical at the end of the proposed definition. SAMHSA Response SAMHSA has determined that no change is needed in response to the comments; the definition covers any legal entity. SAMHSA declines to delete the clarifying parenthetical at the end of the definition since the terms “individual” and “entity” are more intuitive than the term “person,” as defined in these regulations. h. Program SAMHSA decided not to finalize its proposed changes to the definition of “Program,” but did make minor updates to the terminology in the text. We are, however, finalizing certain other minor changes to the proposed definition to update terminology so that it is consistent with current best practice. First, SAMHSA moved the reference to examples from the definition of “Program” to the definition of “Part 2 program.” Second, we retain the language changes from drug and/or alcohol abuse to substance use disorder. Finally, as stated in the NPRM, SAMHSA clarifies that paragraph (1) of the definition of “Program” would not apply to “general medical facilities”. However, paragraphs (2) and (3) of the definition of “Program” would apply to “general medical facilities.” Public Comments A few commenters expressed support for the revised definition of “Program.” However, many commenters generally opposed the proposed revision to the definition of “Program.” The reasons primarily related to interpretations that SAMHSA did not intend to imply. Many commenters asked that SAMHSA not call out general medical practices as a separate category of provider excluded from paragraph one but included in paragraphs two and three of the definition of program. Some commenters requested clarification in various areas, including the meaning and examples of “holds itself out;” determining “primary function;” treatment of behavioral health clinics and community mental health centers; roles of general medical or dental practices that engage in screening, brief intervention, and referrals for treatment (SBIRT) activities, and co-located substance abuse/mental health counselors; whether covered part 2 facilities provide some, primarily provide, or only provide substance use disorder diagnosis, treatment, and referral to treatment; physicians who prescribe buprenorphine products and pharmacies that fill those prescriptions; a general psychiatric unit that also provides substance use disorder treatment; and offering patients integrated behavioral health care in a primary care setting. Some commenters suggested limiting programs to those that meet a minimum standard, are specifically licensed, credentialed, or accredited, such as state licensure. Several commenters asked that SAMHSA provide an exception for pharmacists and pharmacies or dentists. Lastly, a commenter said the rule should include rehabilitation centers as medical facilities. SAMHSA Response Based on the number and type of comments received regarding including general medical practices in the Program definition, SAMHSA has decided not to finalize the general medical practices language in the final rule. The number and type of comments led SAMHSA to believe separating out general medical practices from general medical facilities was more confusing than clarifying. Most commenters indicated a belief that SAMHSA was expanding the definition of program to include individuals and entities that had not previously been covered. As we've previously noted in our publicly available FAQ guidance, a practice comprised of primary care providers could be considered a “general medical facility and be subject to 42 CFR part 2 if they are both “federally assisted” and meet the definition of a program under 42 CFR 2.11. Nevertheless, consistent with the definition of a “program”: 1. If a provider is not a general medical care facility, then the provider meets the part 2 definition of a “Program” if it is an individual or entity who holds itself out as providing, and provides substance use disorder diagnosis, treatment, or referral for treatment. 2. If the provider is an identified unit within a general medical facility, it is a “Program” if it holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment. 3. If the provider consists of medical personnel or other staff in a general medical facility, it is a “Program” if its primary function is the provision of substance use disorder diagnosis, treatment, or referral for treatment and is identified as such specialized medical personnel or other staff by the general medical facility. SAMHSA's FAQ guidance further addresses the issue of what constitutes a general medical facility. This FAQ guidance clarifies that, while the term “general medical care facility” is not defined in the definitions section of 42 CFR 2.11, hospitals, trauma centers, or federally qualified health centers would generally be considered “general medical care” facilities. Therefore, primary care providers who work in such facilities would only meet part 2's definition of a program if (1) they work in an identified unit within such general medical facility that holds itself out as providing, and provides, substance use disorder diagnosis, treatment or referral for treatment, or (2) the primary function of the provider is substance use disorder diagnosis, treatment or referral for treatment and they are identified as providers of such services. In addition, a practice comprised of primary care providers could be considered a “general medical facility.” As such, only an identified unit within that general medical care facility which holds itself out as providing and provides substance use disorder diagnosis, treatment or referral for treatment would be considered a “program” under the definition in the part 2 regulations. Medical personnel or staff within that facility whose primary function is the provision of those services and who are identified as such providers would also qualify as a “program” under the definition in the part 2 regulations. Other units or practitioners within that general medical care facility would not meet the definition of a part 2 program unless such units or practitioners also hold themselves out as providing and provide substance use disorder diagnosis, treatment or referral for treatment. SAMHSA also clarifies that the program definition does not categorically exclude buprenorphine providers. However, holding a waiver to prescribe buprenorphine or holding a waiver and prescribing buprenorphine as part of primary care practice also does not lead to categorical inclusion of providers in the definition of a part 2 program; such determinations are fact-specific. Also, a health care provider that does not otherwise meet the definition of a part 2 program would not become a program simply because they provided screening, brief intervention, and/or referral to treatment within the context of general health care. SBIRT is discussed in further detail under Section V.E (Applicability) below. Regarding comments on the meaning of “primary function,” SAMHSA did not propose a definition of “primary function” because it has not historically received many, if any, questions on its meaning. Consistent with previously published FAQ guidance, we reiterate that “Holds itself out” means any activity that would lead one to reasonably conclude that the individual or entity provides substance use disorder diagnosis, treatment, or referral for treatment, including but not limited to: • Authorization by the state or federal government ( e.g. licensed, certified, registered) to provide, and provides, such services, • Advertisements, notices, or statements relative to such services, or • Consultation activities relative to such services. i. Qualified Service Organization SAMHSA is adopting the definition of “Qualified Service Organization” as proposed. SAMHSA has revised the definition of QSO to include population health management in the list of examples of services a QSO may provide. SAMHSA also revised the term “medical services” as listed in the examples of permissible services offered by a QSO to clarify that it is limited to “medical staffing services.” SAMHSA made this revision to emphasize that QSOAs should not be used to avoid obtaining patient consent. Public Comments A large number of commenters supported the proposed QSO definition, particularly the addition of “population health management.” Many commenters requested a clarification or a narrow definition of “population health management.” SAMHSA Response SAMHSA provided guidance in the NPRM preamble regarding what constitutes population health management services. Specifically, population health management refers to increasing desired health outcomes and conditions through monitoring and identifying individual patients within a group. To achieve the best outcomes, providers must supply proactive, preventive, and chronic care to all of their patients, both during and between encounters with the health care system. For patients with substance use disorders, who often have comorbid conditions, proactive, preventive, and chronic care is important to achieving desired outcomes. Any QSOA executed between a part 2 program and an organization providing population health management services would be limited to the office(s) or unit(s) responsible for population health management in the organization ( e.g., the ACO, CCO, CPCMH, or managed care organization [MCO]), not the entire organization and not its participants ( e.g., case managers, physicians, addiction counselors, hospitals, and clinics). However, the presence of a QSOA does not preclude disclosures of patient identifying information to other individuals within these organizations based on a valid part 2-compliant consent. Public Comments Some commenters requested clarification about the definition, such as whether an HIE could be considered a QSO; whether the definition, which includes “an individual,” can include members of the covered entity's workforce; and whether public health management staff can share part 2 information with case managers. A few commenters expressed opposition to the proposed definition of QSO, asserting that patient consent should be obtained before making a disclosure of substance use disorder information to multiple entities. Another commenter warned that under the definition, it would be difficult to track which part 2 patients may or may not be within a population health program at any given time. SAMHSA Response The NPRM as well as the current (1987) definition of QSO uses the term person. Person is defined in the current (1987) regulations as: “ Person means an individual, partnership, corporation, federal, state or local government agency, or any other legal entity.” The NPRM definition proposed a parenthetical: “(also referred to as individual or entity).” Because both the 1987 regulations and the NPRM definition of person includes both individuals and entities, the definition of the term QSO has always included both individual and entities, the definition of the term QSO has always included individuals, as well as entities. Whether the QSO definition applies to members of an entity's workforce and case managers depends on whether they meet the definition of QSO as defined in § 2.11 because such determinations are fact-specific. An individual or entity who does not meet the definition of a QSO may, however, meet the definition of “Treating provider relationship” for the purposes of obtaining consent. Likewise, care coordination was not added to the list of examples of permissible services offered by a QSO because care coordination has a patient treatment component. Under the part 2 governing statute, patient records pertaining to the patient's substance use disorder may be shared only with the prior written consent of the patient or as permitted under the part 2 statute, regulations, or guidance. However, the regulations may contain such definitions, and may provide for such safeguards and procedures, including procedures and criteria for the issuance and scope of orders, as in the judgment of the Secretary are necessary or proper to effectuate the purposes of this statute, to prevent circumvention or evasion thereof, or to facilitate compliance therewith. Regarding the concern about disclosing to multiple entities under a QSOA, as noted above, any QSOA executed between a part 2 program and an organization providing population health management services would be limited to the office(s) or unit(s)/entity(ies) responsible for population health management for the organization ( e.g., the ACO, CCO, CPCMH, or MCO), not the entire organization and not its participants ( e.g., case managers, physicians, addiction counselors, hospitals, and clinics). Public Comments Commenters provided various suggestions to improve the definition. Several commenters said the definition should be expanded to permit a multi-party agreement for multi-directional sharing of information. Commenters said the description of the provision should address overlapping requirements of HIPAA and part 2 with respect to contractual agreements and services such as data processing and billing. A commenter said facilitating entities should be able to enter into QSO agreements with participating providers to perform quality improvement activities. Another commenter said the QSO exception to restrictions on disclosure should apply to third-party payers and other holders of part 2 information, and the definition should include other functions to support improved care delivery. SAMHSA Response Part 2 and its implementing statute are much more restrictive than HIPAA. Because 42 CFR part 2 and its governing statute are separate and distinct from HIPAA, the part 2 regulations use different terminology than used in HIPAA. However, SAMHSA aligned policy with HIPAA where possible. Because a QSOA is a two-way agreement between a part 2 program and the entity providing the part 2 program and an individual or entity providing a service to a part 2 program, agreements between more than those two parties ( e.g. multi-party agreements) are prohibited. A QSOA cannot be used to avoid obtaining patient consent in the treatment context. As stated previously in this preamble, SAMHSA is issuing an SNPRM to seek further comments and information on the disclosure to and use of part 2 information by the contractors and subcontractors of third-party payers and other lawful holders for purposes of payment, health care operations, and other health care related activities before establishing any appropriate restrictions on disclosures to them. Public Comments Commenters generally expressed opposition to the change of “medical services” to “medical staffing services” in the definition. A commenter expressed opposition to the interpretation that the QSO agreement executed between a part 2 program and an organization that provided population health management services would be limited to a specific office(s) or unit(s) within the organization that is/are tasked with carrying out such services. SAMHSA Response SAMHSA has revised the term “medical services” as listed in the examples of permissible services offered by a QSO to clarify that it is limited to “medical staffing services.” SAMHSA proposed to make this revision to emphasize that QSOAs should not be used to avoid obtaining patient consent. Accordingly, a QSOA could be used by a part 2 program to contract with a provider of on-call coverage services (previously clarified in FAQ guidance) or other medical staffing services but could not be used to disclose John Doe's patient identifying information to his primary care doctor for the purpose of treatment (other than that provided under a QSOA for medical staffing services). However, an individual or entity who is prohibited from providing treatment to an individual patient under a QSOA may still meet the requirements of having a treating provider relationship (as that term is defined in § 2.11) with respect to the consent requirements in § 2.31. With respect to the comment regarding an organization providing population health management services, a QSOA is a two-way agreement between a part 2 program and the entity providing the service. We reiterate that disclosures by a QSO pursuant to a QSOA executed between a part 2 program and an organization that provides population health management services would be limited to a specific office(s) or unit(s)/entity(ies) that is/are tasked with carrying out such services for the organization. SAMHSA believes this is a needed safeguard to limit disclosures to that which is reasonably necessary to carry out services under the QSOA. Public Comments Many commenters expressed opposition to the exclusion of “care coordination” from the QSO definition or requested clarification for the meaning of “care coordination.” Some commenters specifically requested adding care coordination to the list of services a QSO may provide, reasoning that it would facilitate integrated substance use disorder, health, and mental health services. The commenters asserted that the addition would benefit patients' health, safety, and quality of life while maintaining confidentiality protections. SAMHSA Response In the NPRM, SAMHSA clarified that an individual or entity is prohibited from providing treatment to an individual patient under a QSOA. SAMHSA has revised the term “medical services” as listed in the examples of permissible services offered by a QSO to clarify that it is limited to “medical staffing services.” SAMHSA proposed to make this revision to emphasize that QSOAs should not be used to avoid obtaining patient consent. Accordingly, a QSOA could be used by a part 2 program to contract with a provider of on-call coverage services (previously clarified in FAQ guidance) or other medical staffing services, but could not be used to disclose John Doe's patient identifying information to his primary care doctor for the purpose of treatment (other than that provided under a QSOA for medical staffing services). For this reason, care coordination and medication management, both of which have a treatment component, were not added to the list of examples of permissible services offered by a QSO. However, an individual or entity who is prohibited from providing treatment to an individual patient under a QSOA may still meet the requirements of having a treating provider relationship (as that term is defined in § 2.11) with respect to the consent requirements in § 2.31. Regarding the request to clarify the meaning of “care coordination” and how it differs from “population health management,” because SAMHSA decided not to include care coordination in the examples of permissible services under the definition of a QSO, we did not define the term “care coordination” in the NPRM and, therefore, decline to do so in this final rule. Population health management refers to increasing desired health outcomes and conditions through monitoring and identifying patients within a group. j. Records SAMHSA has revised the proposed definition. As suggested by commenters, SAMHSA has modified the definition of “Records” by adding “created by” and a parenthetical with examples to read as follows: “ Records means any information, whether recorded or not, created by, received, or acquired by a part 2 program relating to a patient ( e.g., diagnosis, treatment and referral for treatment information, billing information, emails, voice mails, and texts). For the purpose of these regulations, records include both paper and electronic records.” SAMHSA revised the definition of “Records” to include any information, whether recorded or not, which includes verbal communications, created, received or acquired by a part 2 program relating to a patient. The revised definition makes clear that, for the purpose of the part 2 regulations, records include both paper and electronic records. Public Comments A commenter remarked that the proposed definition of “records” does not address “identifiability,” asserting that information that is not individually identifiable, that is not reasonably capable of being re-identified, or that is aggregate may not need to be covered by the definition of record. Regarding the phrase “whether recorded or not” in the proposed definition, a couple of commenters requested guidance on what constitutes “unrecorded information.” SAMHSA Response SAMHSA clarifies that unrecorded information includes verbal communications and is still considered part of the record. To add further clarity to the definition, SAMHSA has revised the definition of “Records” from the proposed language by adding examples ( e.g., diagnosis, treatment and referral for treatment information, billing information, emails, voice mails, and texts). SAMHSA also added the phrase “created by” to clarify that “records” includes information received, acquired, or created by a part 2 program relating to a patient. Regarding “identifiability,” identification is addressed in the term “Patient identifying information,” not in the definition of “Record.” The definition of records is just that and does not address information that may be disclosed. k. Treatment SAMHSA is adopting the proposed definition of “Treatment.” SAMHSA has deleted the term “management” from the “Treatment” definition. Public Comments A few commenters opposed the proposed removal of the term “management” from the definition of “treatment” because the narrower definition would decrease information sharing and have a chilling effect on care coordination. A couple of commenters urged that “treatment” should be limited to care of the substance use disorder and not be extended to include care of other medical conditions secondary to or that arose because of the substance use disorder. One commenter suggested that “care” should be defined as it is used in the definition of “treatment.” SAMHSA Response SAMHSA removed the term “management” from the definition of “Treatment” because in today's health care environment, “management” has a much broader meaning than it did when the regulations were last revised. Treatment is not limited to care of the substance use disorder because patients with a substance use disorder often have comorbid conditions. 3. Terminology Changes SAMHSA is adopting the changes proposed in this section, as described in the NPRM. In addition to changes to several definitions, SAMHSA is also implementing several terminology changes intended to ensure consistency in the use of terms throughout the regulations and to increase the understandability of the rule. First, we made revisions to consistently refer to law enforcement as “law enforcement agencies or officials.” Secondly, SAMHSA revised the part 2 regulations to use the term “entity” instead of “organization” wherever possible. Thirdly, SAMHSA clarifies that, for the purposes of this regulation, the term “written” includes both paper and electronic documentation. Fourthly, we use the phrase “part 2 program or other lawful holder of patient identifying information” to refer to a part 2 program or other individual or entity that is in lawful possession of patient identifying information. A “lawful holder” of patient identifying information is an individual or entity who has received such information as the result of a part 2-compliant patient consent (with a prohibition on re-disclosure notice) or as a result of one of the exceptions to the consent requirements in the statute or implementing regulations and, therefore, is bound by 42 CFR part 2. Public Comments One commenter requested clarification about what entities are considered “lawful holders” of patient identifying information in the context of complex health care systems. For example, would the parent company of a health care system, each specific hospital, or each entity affiliated with the health care system be considered a “lawful holder”? Another commenter urged that the term “other lawful holder” should be clearly defined in the final rule. SAMHSA Response A “lawful holder” of patient identifying information is an individual or entity who has received such information as the result of a part 2-compliant patient consent (with a prohibition on re-disclosure notice) or as permitted under the part 2 statute, regulations, or guidance and, therefore, is bound by 42 CFR part 2. SAMHSA cannot determine what entities are “lawful holders” because such determinations are fact-specific. In addition, SAMHSA determined that it was not feasible to define all lawful holders of information so has not included a definition in the rule. As explained in the NPRM, examples of “lawful holders” include a patient's treating provider, a hospital emergency room, an insurance company, an individual or entity performing an audit or evaluation, or an individual or entity conducing scientific research. This list provided in the NPRM was intended only as an illustrative example of who could be a lawful holder. 4. Other Comments on Definitions Public Comments Many commenters expressed general support for the proposed clarification of definitions. Some commenters sought new definitions for terms including HIE; recipient; population health management and care coordination; population health; re-disclosure; law enforcement agency or official; repository; and scientific research. Several commenters addressed the “alternative approach” discussed in the NPRM for allowing disclosure to treating providers by r [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2017-00719. Public record. Not legal advice.