# Confidentiality of Substance Use Disorder Patient Records > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2020-14675 ## Record - **Collection:** Federal Register - **Document type:** Rule - **Published:** July 15, 2020 - **Citation:** 85 FR 42986 ## Text DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 42 CFR Part 2 [SAMHSA-4162-20] RIN 0930-AA32 Confidentiality of Substance Use Disorder Patient Records AGENCY: Substance Abuse and Mental Health Services Administration (SAMHSA), U.S. Department of Health and Human Services (HHS). ACTION: Final rule. SUMMARY: This final rule makes changes to the Department of Health and Human Services' (HHS) regulations governing the Confidentiality of Substance Use Disorder Patient Records. These changes were prompted by the need to continue aligning the regulations with advances in the U.S. health care delivery system, while retaining important privacy protections for individuals seeking treatment for substance use disorders (SUDs). SAMHSA strives to facilitate information exchange for safe and effective SUD care, while addressing the legitimate privacy concerns of patients seeking treatment for a SUD. Within the constraints of the authorizing statute, these changes are also an effort to make the regulations more understandable and less burdensome. DATES: This final rule is effective August 14, 2020. FOR FURTHER INFORMATION CONTACT: Ms. Deepa Avula, (240) 276-2542. SUPPLEMENTARY INFORMATION: Table of Contents I. Background II. Summary of the Major Provisions III. Overview of Public Comments IV. Final Modifications to 42 CFR Part 2 and Discussion of Public Comments A. General Comments on the Proposed Rule 1. General Feedback on the Proposed Rule a. General Support for the Proposed Rule b. General Opposition for the Proposed Rule c. General Request for Clarification and Guidance Related to Part 2 2. General Comments on Realigning the Part 2 Rule to the HIPAA Privacy Rule B. Definitions (§  2.11) C. Applicability (§  2.12) D. Consent Requirements (§  2.31) E. Prohibition on Re-Disclosure (§  2.32) F. Disclosures Permitted With Written Consent (§  2.33) G. Disclosures To Prevent Multiple Enrollments (§  2.34) H. Disclosures to Prescription Drug Monitoring Programs (§  2.36) I. Medical Emergencies (§  2.51) J. Research (§ 2.52) K. Audit and Evaluation (§  2.53) L. Orders Authorizing the Use of Undercover Agents and Informants (§  2.67) V. Collection of Information Requirements VI. Regulatory Impact Analysis A. Statement of Need B. Overall Impact C. Alternatives Considered D. Conclusion Acronyms ADAMHA Alcohol, Drug Abuse, and Mental Health Administration CEHRT Certified Electronic Health Record Technology CFR Code of Federal Regulations DEA Drug Enforcement Agency DOJ Department of Justice DS4P Data Segmentation for Privacy EHR Electronic Health Record FAX Facsimile FDA Food and Drug Administration FEMA Federal Emergency Management Agency FHIR Fast Healthcare Interoperability Resources FR Federal Register HHS Department of Health and Human Services HIPAA Health Insurance Portability and Accountability Act of 1996 HIE Health Information Exchange HIN Health Information Network IHS Indian Health Service MAT Medication-Assisted Treatment NPRM Notice of Proposed Rulemaking ONC Office of the National Coordinator for Health Information Technology OTP Opioid Treatment Program OUD Opioid Use Disorder PDMP Prescription Drug Monitoring Program QIO Quality Improvement Organization TPO Treatment, Payment, and Health Care Operations SAMHSA Substance Abuse and Mental Health Services Administration SNPRM Supplemental Notice of Proposed Rulemaking SUD Substance Use Disorder U.S.C. United States Code I. Background The Confidentiality of Substance Use Disorder Patient Records regulations (42 CFR part 2) implement section 543 of the Public Health Service Act, 42 U.S.C. 290dd-2. The regulations were originally issued to ensure the confidentiality of patient records for the treatment of substance use disorder, at a time when there was no broader privacy and data security standard for protecting health care data. Under the regulations, a “substance use disorder” is a defined term, which refers to a cluster of cognitive, behavioral, and physiological symptoms indicating that an individual continues using a substance, despite significant substance-related problems such as impaired control, social impairment, risky use, and pharmacological tolerance and withdrawal. For the purposes of part 2, this definition does not include tobacco or caffeine use. The regulations were first promulgated as a final rule in 1975 (40 FR 27802) and amended thereafter in 1987 (52 FR 21796) and 1995 (60 FR 22296). On February 9, 2016, SAMHSA published a notice of proposed rulemaking (NPRM) (81 FR 6988) (the “2016 proposed rule”), inviting comment on proposals to update the regulations, to reflect the development of integrated health care models and the growing use of electronic platforms to exchange patient information, as well as the new laws and regulations implemented since 1975, that more broadly protect patient data. At the same time, consistent with the authorizing statute, we (note that throughout this final rule, “we” refers to SAMHSA) wished to preserve the confidentiality protections that part 2 establishes for patient identifying information originating from covered programs, because persons with SUDs may encounter significant discrimination or experience other negative consequences if their information is improperly disclosed. In response to public comments, on January 18, 2017, SAMHSA published a final rule (82 FR 6052) (the “2017 final rule”), providing for greater flexibility in disclosing patient identifying information within the health care system, while continuing to protect the confidentiality of SUD patient records. SAMHSA concurrently issued a supplemental notice of proposed rulemaking (SNPRM) (82 FR 5485) (the “2017 proposed rule”) to solicit public comment on additional proposals. In response to public comments, SAMHSA subsequently published a final rule on January 3, 2018 (83 FR 239) (the “2018 final rule”) that provided greater clarity regarding payment, health care operations, and audit or evaluation-related disclosures, and provided language for an abbreviated prohibition on re-disclosure notice. In both the 2017 and 2018 final rules, SAMHSA signaled its intent to continue to monitor implementation of 42 CFR part 2, and to explore potential future rulemaking to better address the complexities of health information technology, patient privacy, and interoperability, within the constraints of the statute. The emergence of the opioid crisis, with its catastrophic impact on individuals, families, and caregivers, and corresponding clinical and safety challenges for providers, has highlighted the need for thoughtful updates to 42 CFR part 2. The laws and regulations governing the confidentiality of substance abuse records were originally written out of concern for the potential for misuse of those records against patients in treatment for a SUD, thereby undermining trust and leading individuals with SUDs not to seek treatment. As observed in the 1983 proposed rule, the purpose of 42 CFR part 2 is to ensure that patients receiving treatment for a SUD in a part 2 program “are not made more vulnerable to investigation or prosecution because of their association with a treatment program than they would be if they had not sought treatment” (48 FR 38763). In recent years, the devastating consequences of the opioid crisis have resulted in an unprecedented spike in overdose deaths related to both prescription and illegal opioids including heroin and fentanyl, 1 as well as correspondingly greater pressures on the SUD treatment system, and heightened demand for SUD treatment services. 2 On August 26, 2019, SAMHSA published a Notice of Proposed Rulemaking (NPRM) (84 FR 44568) that proposed changes to the part 2 regulations that SAMHSA believed would better align with the needs of individuals with SUD and of those who treat these patients in need, and help facilitate the provision of well-coordinated care, while ensuring appropriate confidentiality protection for persons in treatment through part 2 programs. 1 Mortality statistics published by the Centers for Disease Control and Prevention reflected a spike in the rate of opioid-related overdose deaths during the period from 2013-2017. See https://www.cdc.gov/mmwr/volumes/67/wr/mm675152e1.htm?s_cid=mm675152e1_w. More recent data from the State Unintentional Drug Overdose Reporting System (SUDORS), showed that opioid-involved overdose deaths in 25 states slightly decreased from July-December 2017 to January-June 2018. However, even in that time period, increases in illicitly-manufactured fentanyl overdose deaths involving multiple drugs almost negated decreases in fentanyl analog deaths and prescription opioid-involved overdose deaths. See https://www.cdc.gov/mmwr/volumes/68/wr/mm6834a2.htm ). 2 With regard to heightened demand for, and pressures upon, SUD treatment services in the opioid epidemic, see for example, “HHS Acting Secretary Declares Public Health Emergency to Address National Opioid Crisis,” Department of Health and Human Services, October 26, 2017 (at https://www.hhs.gov/about/news/2017/10/26/hhs-acting-secretary-declares-public-health-emergency-address-national-opioid-crisis.html ); “Today's Heroin Epidemic: More People at Risk, More Drugs Abused,” Centers for Disease Control and Prevention, July 7, 2015 (at https://www.cdc.gov/vitalsigns/heroin/ ). SAMHSA requested public input of the proposed changes during a 60-day public comment period. After consideration of the public comments received in response to the NPRM, SAMHSA is issuing this final rule substantially as proposed, with one caveat. On March 27, 2020, President Trump signed the Coronavirus Aid, Relief and Economic Security Act (“CARES Act”) into law (Pub. L. 116-136). The CARES Act was enacted to provide emergency assistance to individuals, families and businesses affected by the COVID-19 pandemic; to support the U.S. health care system; and to make emergency appropriations to the Executive Branch. Section 3221 of the CARES Act, Confidentiality and Disclosure of Records Relating to Substance Use Disorder, substantially amended several sections of the part 2 authorizing statute; specifically, sections 42 U.S.C. 290dd-2(b), (c) and (f), which specify requirements for patient consent, restrict the use of records in legal proceedings, and set penalties for violations of the statute, respectively. 3 The CARES Act provides far greater flexibility for patients and health care providers to share SUD records than presently allowed under 42 U.S.C. 290dd-2. Most notably, some sections in the new statute seek to align the part 2 confidentiality standards more closely with the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The CARES Act requires HHS to update its regulations to implement these new statutory changes; therefore, HHS intends to publish a new NPRM and subsequently to issue a new final implementing rulemaking for the CARES Act in the future. Because both Congress and SAMHSA have sought to address many of the same barriers to information sharing by patients and among health care providers, we expect that the CARES Act implementing regulations will further modify several of the amendments adopted in this final rule. 3 Section 3221 of the CARES Act also added several new provisions to the Part 2 authorizing statute, codified at 42 U.S.C. 290dd-2(i), (j), and (k), regarding antidiscrimination, notification of breach and definitions, respectively. The statutory timeline in § 3221 prevents the part 2-related provisions of the CARES Act from taking effect before March 27, 2021. In the interim, we believe that this final rule makes important changes that can help safeguard the health and outcomes of individuals with SUD, and specifically takes important first steps toward the greater flexibility for information sharing envisioned by Congress in its passage of § 3221 of the CARES Act. Thus, several of the regulatory amendments in this final rule will serve as interim and transitional standards, until regulations conforming to the CARES Act legislation can be promulgated. II. Summary of the Major Provisions Proposed modifications to 42 CFR part 2 were published as an NPRM on August 26, 2019 (84 FR 44568). After consideration of the public comments received in response to the NPRM, SAMHSA is issuing this final rule as follows: Definitions (§ 2.11) revises the definition of “Records” to create an exception so that information conveyed orally by a part 2 program to a non-part 2 provider for treatment purposes with consent of the patient does not become a record subject to part 2 regulations merely because that part 2 information is reduced to writing by that non-part 2 provider. Applicability (§ 2.12) revises the regulatory text to state that the recording of information about an SUD and its treatment by a non-part 2 provider does not, by itself, render a medical record subject to the restrictions of 42 CFR part 2, provided that the non-part 2 provider segregates any specific SUD records received from a part 2 program (either directly, or through another lawful holder). Consent requirements (§ 2.31) revises consent requirements to allow patients to consent to the disclosure of their information to a wide range of entities without naming a specific individual to receive this information on behalf of a given entity, and includes special instructions applicable to consents for disclosure of information to information exchanges and research institutions. The final rule provides additional guidance, with regard to consent for disclosures for the purpose of care coordination and case management. Prohibition on redisclosure (§ 2.32) revises the prohibition on redisclosure notices to clarify that non-part 2 providers do not need to redact information in a non-part 2 record regarding SUD and allows re-disclosure if expressly permitted by written consent of the patient or permitted under part 2 regulations. Disclosures permitted with written consent (§ 2.33) expressly allows disclosure to specified entities and individuals for 18 types of payment and health care operational activities, including the 17 proposed activities and the addition of disclosures for the purpose of care coordination and case management. Disclosures to prevent multiple enrollments (§ 2.34) revises disclosure requirements to allow non-opioid treatment providers with a treating provider relationship to access central registries. Disclosures to Prescription Drug Monitoring Programs (§ 2.36) creates new permissions to allow opioid treatment programs (OTPs) to disclose dispensing and prescribing data, as required by applicable state law, to prescription drug monitoring programs (PDMPs), subject to patient consent. Medical Emergencies (§ 2.51) authorizes disclosures of patient information to another part 2 program or other SUD treatment provider during State or Federally-declared natural and major disasters. Research (§ 2.52) permits research disclosures of part 2 patient data by a HIPAA covered entity to individuals and organizations who are neither HIPAA covered entities, nor subject to the Common Rule, for the purpose of conducting scientific research. The revised § 2.52 better aligns the requirements of part 2, the Common Rule, and the Privacy Rule around the conduct of research on human subjects, and seeks to streamline duplicative requirements for research disclosures under part 2 and the Privacy Rule in some instances. This final rule also revises § 2.52 to permit research disclosures to recipients who are covered by Food and Drug Administration (FDA) regulations for the protection of human subjects in clinical investigations (at 21 CFR parts 50 and 56). Audit and evaluation (§ 2.53) clarifies that federal, state and local governmental agencies and third-party payers may conduct audits and evaluations to identify needed actions at the agency or payer level to improve care; that audits and evaluations may include reviews of appropriateness of medical care, medical necessity, and utilization of services; and that auditors may include quality assurance organizations as well as entities with direct administrative control over a part 2 program or lawful holder. Section 2.53 also updates language related to quality improvement organizations (QIOs), and allows for patient identifying information to be disclosed to federal, state, or local government agencies, and to their contractors, subcontractors, and legal representatives for audit and evaluations required by statute or regulation. Orders authorizing use of undercover agents and informants (§ 2.67) amends the period for court-ordered placement of an undercover agent and informant within a part 2 program to 12 months and clarifies that the 12-month time period starts when an undercover agent or informant is placed in the part 2 program. Use of Personal Devices and Accounts This final rule preamble also provides guidance on how employees, volunteers and trainees of part 2 facilities should handle communications using personal devices and accounts, especially in relation to § 2.19 concerning disposition of records by discontinued programs. In § 2.11, the current regulation defines “Records” to include information relating to a patient that could include email and texts. In § 2.19, the regulation codifies the requirements for disposition of records from a discontinued part 2 program. These requirements state that records which are electronic must be “sanitized” within one year of the discontinuation of the part 2 program. This sanitization must render the patient identifying information non-retrievable in accordance with § 2.16 (security for records). Read together, current §§ 2.11, 2.16, and 2.19 could be interpreted to mean that, if an individual working in a part 2 program receives a text or email from a patient on his or her personal phone which he or she does not use in the regular course of employment in the part 2 program, and this part 2 program is discontinued, then the personal device may need to be sanitized. Depending on the policies and procedures of the part 2 program, this sanitization may render the device no longer useable to that individual. SAMHSA clarifies that this interpretation is not the intent of the regulations. Although SAMHSA does not encourage patient communication through personal email and cell phones, we recognize that patients may make contact through the personal device or account of an employee (or volunteer or trainee) of a part 2 program, even if the employee (or volunteer or trainee) does not use such device or account in the regular course of their employment in the part 2 program. In such instances, SAMHSA wishes neither to convey that these devices become part of the part 2 record, nor that, if the part 2 program is discontinued, these devices must be sanitized. Instead, SAMHSA clarifies that, in the case that patient contact is made through an employee's (or volunteer's or trainee's) personal email or cell phone account which he or she does not use in the regular course of business for that part 2 program, the employee should immediately delete this information from his or her personal account and only respond via an authorized channel provided by the part 2 program, unless responding directly from the employee's account is required in order to protect the best interest of the patient. 4 If the email or text contains patient identifying information, the employee should forward this information to such authorized channel and then delete the email or text from any personal account. These authorized channels are then subject to the normal standards of sanitization under §§ 2.16 and 2.19 and any other applicable federal and state laws. SAMHSA believes that this process will both protect the employee's personal property and the confidentiality of the patient's records if the patient makes such unauthorized contact. 4 When the circumstances requiring a response from the employee's account due to the best interest of the patient have ended or otherwise permit, the messages should be forwarded to an authorized channel (if containing patient identifying information) and deleted. Following the proposed rule, SAMHSA received the following comments on its guidance concerning how employees, volunteers and trainees of part 2 facilities should handle communications using personal devices and accounts. Public Comments Many commenters supported the clarification on sanitizing personal devices. A few commenters noted that while this change will require education and monitoring, the clarification is important and valuable for part 2 programs to properly handle patient communication. Some commenters also noted that this clarification reduces burden for providers in rural areas where communication on authorized channels may not always be available. SAMHSA Response We appreciate comments in support of this clarification. Public Comments Some commenters had additional questions regarding the use of personal devices. One commenter requested guidance pertaining to the sanitizing of any other devices synchronized (“synced”) to personal accounts. A few commenters requested clarification as to whether deleting content from a personal account contravenes any state record retention requirements. One commenter requested clarification that this guidance applies only to personal devices, not professional devices from which EHRs are accessed. One commenter requested that “incidental” communication be defined more clearly. One commenter suggested that the rise of personal devices and changing nature of communication with patients may warrant greater consideration from SAMHSA in future rulemaking. SAMHSA Response We appreciate questions from commenters to further clarify the use of personal devices. Providers should ensure that any patient communication accessible from synced devices is deleted from each device. Additionally, if a patient communication is contained solely on a personal device, providers should ensure that the communication is forwarded to and stored within an authorized channel prior to deleting the communication from the personal device. Providers concerned about state record retention requirements may include a note that the information has been forwarded to and stored within an authorized channel and deleted in compliance with 42 CFR part 2; however, this rule does not preempt more restrictive state record retention requirements Given that the definition of what constitutes incidental communication varies for providers in different settings ( e.g., rural), we decline to further define the phrase at this time. We appreciate the suggestion to further consider personal devices and will continue monitoring the issue. The other sections in 42 CFR part 2 that are not referenced above are not addressed in this final rule nor were they discussed in the NPRM because SAMHSA is maintaining their content substantively unchanged from the 2017 and 2018 final rules. III. Overview of Public Comments Received SAMHSA received 684 public comment submissions on the proposed rule from medical and behavioral health care providers; combined medical/behavioral health care providers; third-party payers; privacy/consumer advocates; medical health care provider associations; behavioral health care provider associations; accrediting organizations; researchers; individuals (with no stated affiliation); attorneys (with no stated affiliation); health information technology (HIT) vendors; and state/local governments. The comments ranged from general support or opposition to the proposed provisions, to specific questions or comments regarding the proposed rules. Some comments were outside the scope of or inconsistent with SAMHSA's legal authority regarding the confidentiality of SUD patient records. Likewise, other comments did not pertain to specific proposals made by SAMHSA in the NPRM. In some instances, commenters raised policy or operational issues that are best addressed through sub-regulatory guidance that SAMHSA will consider issuing subsequent to this final rule. Consequently, SAMHSA did not address these comments in this final rule. IV. Final Modifications to 42 CFR Part 2 and Discussion of Public Comments In this section of the final rule, SAMHSA explains the finalized revisions to the part 2 regulations and responds to public comments received. If a 42 CFR part 2 section is not addressed below, it is because SAMHSA did not propose changes to that part 2 provision and this final rule maintains the existing language in that section. A. General Comments on the Proposed Rule 1. General Feedback on the Proposed Rule a. General Support for the Proposed Rule Public Comments Many commenters expressed general support for the proposed rule. Among them, many believed that providers will be better able to offer a fully integrated model of care as a result, thereby allowing SUD services to be accessed more seamlessly, while increasing access to critically-needed SUD treatment. Other commenters expressed general support for the proposed rule because they saw it as protecting patient privacy, while making electronic health information sharing less burdensome and more efficient. Another set of commenters articulated support for SAMHSA's efforts to balance privacy protections with advances in the health care delivery system. Some commenters who expressed broad support for the proposed rule also suggested that HHS should carry out a comprehensive assessment of how well all the HHS patient privacy rules are currently working. A few commenters who expressed support for the proposed rule also expressed concern that it might not be flexible enough to support the rapid pace of care coordination that is needed to improve SUD patient care. SAMHSA Response SAMHSA appreciates the support for updating the part 2 regulations. This final rule is intended to modernize part 2 by continuing to align the regulations with advances in the U.S. health care delivery system. In general, SAMHSA aims to facilitate information exchange for safe and effective SUD care, while addressing the legitimate privacy concerns of patients seeking treatment for a SUD. But in recent years, the devastating consequences of the opioid crisis have resulted in an unprecedented spike in overdose deaths related to both prescription and illegal opioids, as well as correspondingly greater pressures on the SUD treatment system, and heightened demand for SUD treatment services. This final rule implements changes that SAMHSA believes will better align the needs of individuals with SUD and of the providers who treat them, thereby facilitating the coordination of care, while ensuring appropriate confidentiality protection for patients. SAMHSA will continue to monitor part 2 and its impact on both persons with SUD and providers, and will likewise continue to consider opportunities for further refinement of the rule in alignment with the provisions set forth in the CARES Act. b. General Opposition to the Proposed Rule Public Comments Many commenters opposed the proposed rule, either without stating a specific reason, or else expressing that the proposed rule would constitute an invasion of patient privacy generally, or of their own personal privacy in particular. Many commenters opposed the rule on the grounds that it would exacerbate the stigma of substance use disorder, increase the potential for law enforcement access to patient records, deter people from seeking SUD treatment, and/or result in harm to SUD patients in several other ways, as through discrimination by health insurers. A different group of commenters expressed a competing concern about continuing administrative, financial and clinical barriers to better SUD care, and more effective coordination of care, under the proposed rule. Several of these commenters said that they believed the barriers could continue to endanger the safety of patients. SAMHSA Response SAMHSA wants to ensure that persons with SUD will have access to treatment services that include better coordination of care, and that deliver better quality of care and enhanced patient safety, while continuing to respect the legitimate privacy concerns of patients. The current final rule is consistent with this aim, and with the intent of the governing statute (42 U.S.C. 290dd-2) and regulations at 42 CFR part 2, which is to facilitate entry into SUD care by protecting the confidentiality of SUD patient records. SAMHSA believes that this final rule reflects an appropriate balancing of interests toward achieving these ends. SAMHSA does not believe that this final rule will generally exacerbate stigma for persons with SUD, deter them from seeking treatment, or lead to other broadly negative downstream effects. SAMHSA will continue to consider opportunities for future refinements to the part 2 regulations, consistent with the provisions of the CARES Act. c. General Request for Clarification and Guidance Related to Part 2 Public Comments Several commenters broadly requested that SAMHSA provide clarification and guidance, in connection with confusing language and complexity in the proposed rule. Many other commenters said that educational outreach and guidance should be targeted to providers, to ensure that they understand the terms of the proposed rule. SAMHSA Response SAMHSA has provided further clarification through its responses to public comments in several sections of the final rule. SAMHSA recognizes the need for educational outreach both to persons with SUD and to providers in connection with the final rule, and is considering opportunities for further guidance and for carrying out related educational outreach. SAMHSA will continue to monitor the response to part 2 in the SUD treatment community, and will consider future refinements and further clarification to the part 2 rules as needed. 2. General Comments on Realigning the Part 2 Rule to the HIPAA Privacy Rule Public Comments Many commenters offered broad feedback that the privacy rules of 42 CFR part 2 are cumbersome and should be re-aligned with the HIPAA privacy rule. The commenters asserted that doing so could strengthen patient protections while allowing clinicians access to patient information needed to ensure patient safety and provide quality care. In a related vein, other commenters expressed support for legislation already introduced in Congress, aimed at more fully aligning the confidentiality standards of 42 CFR part 2 with the HIPAA privacy rule. SAMHSA Response SAMHSA noted the many comments that requested that SAMHSA align part 2 provisions with HIPAA where possible. In some instances, SAMHSA has attempted to do so in this final rule, to the extent that such changes were permissible under 42 U.S.C. 290dd-2. At the same time, part 2 and its governing statute are separate and distinct from HIPAA and its implementing regulations. Because of its targeted population, part 2 does establish more stringent federal protections than most other health privacy laws, including HIPAA. Consistent with general comments about alignment of this regulation with HIPAA, SAMHSA has modified the definition of “records” (§ 2.11) and the applicability section (§ 2.12) to facilitate the disclosure of records from part 2 programs to non-part 2 providers for treatment purposes, while allowing the non-part 2 providers to engage in their own clinical encounters and record-keeping without fear that those activities will be subject to part 2. In addition, SAMHSA has offered revised guidance concerning the part 2 consent requirements (§ 2.31), in order to more explicitly allow patients to consent to disclosure of their records for the purpose of care coordination. As discussed below, SAMHSA is also modifying the regulatory text in § 2.33(b), to include disclosures for the purpose of care coordination and case management to the list of permitted activities. All these revisions will have the effect of more closely aligning confidentiality standards under part 2 with the HIPAA privacy rule. As previously noted, on March 27, 2020, the President signed the CARES Act into law, and § 3221 of the CARES Act makes a significant modification to the authorizing statute for part 2, with the aim of realigning the part 2 rules more strongly with the HIPAA privacy rule. HHS anticipates releasing a new proposed rule within the next 12 months to implement § 3221 of the CARES Act. In the meantime, several of the regulatory amendments in this final rule will serve as transitional standards, until regulations fully conforming to the CARES Act legislation can be promulgated. B. Definitions (§ 2.11) SAMHSA is finalizing this section as proposed. In the current regulation, “Records” is defined to mean “any information, whether recorded or not, created by, received, or acquired by a part 2 program relating to a patient.” In the 2017 final rule, SAMHSA noted that some commenters expressed confusion regarding what is considered unrecorded information (82 FR 6068); we, therefore, added parenthetical examples in an effort to clarify. But with the exception of these parenthetical examples, the basic definition for “records” under part 2 has remained the same since the 1987 final rule. In section III.B. of the proposed rule [84 FR 44571] on “Applicability” (at § 2.12), SAMHSA discussed a proposed change to the restriction on disclosures under part 2, which would serve to clarify some record-keeping activities of non-part 2 providers that fall outside the scope of 42 CFR part 2. As explained in section III.B., the change was needed to facilitate communication and coordination between part 2 programs and non-part 2 providers, and to ensure that appropriate communications were not hampered by fear among non-part 2 providers of inadvertently violating part 2, as a result of receiving and reading a protected SUD patient record and then providing care to the patient. SAMHSA proposed to make a conforming amendment to the § 2.11 definition of “records,” [84 FR 44571] by adding, at the end of the first sentence of the definition, the phrase, “provided, however, that information conveyed orally by a part 2 program to a non-part 2 provider for treatment purposes with the consent of the patient does not become a record subject to this part in the possession of the non-part 2 provider merely because that information is reduced to writing by that non-part 2 provider. Records otherwise transmitted by a part 2 program to a non-part 2 provider retain their characteristic as a “record” subject to this part in the possession of the non-part 2 provider, but may be segregated by that provider.” The effect of the proposed amendment was to incorporate a very limited exception to the definition of “records,” such that a non-part 2 provider who orally receives information from a protected SUD record from a part 2 program may subsequently engage in an independent conversation with her patient, informed by her discussion with the part 2 provider, and record SUD information received from the part 2 program or the patient, without fear that her own records thereafter would become covered by part 2. The intent of this change was to better facilitate coordination of care between non-part 2 providers and part 2 programs, and to resolve lingering confusion among non-part 2 providers about when and how they can capture SUD patient care information in their own records, without fear of those records being subject to the confidentiality requirements of part 2. The comments we received on the proposed amendments to § 2.11, and our responses, are provided below. Public Comments Many commenters supported the proposed change to the definition of records, saying that it would provide clarification as to which records are subject to part 2 protections; enable providers to take account of the entirety of a patient's health needs when determining a treatment plan; improve care coordination, especially among those with multiple medical concerns; better integrate primary and behavioral care for SUD patients; enhance patient safety; and potentially incentivize clinicians to treat patients with SUD. One commenter said the proposed definition of a record may be the most beneficial proposal in the rule, and noted that SAMHSA retains in its proposals the necessary protections against redisclosure by downstream recipients of part 2 records absent explicit patient consent. Another commenter expressed a desire to have more flexibility for care coordination across their delivery system for SUD patients, and observed that any changes to the definition of records requires balancing the need for increased protection for SUD treatment information with the need for access to care coordination. SAMHSA Response We thank the commenters for their support and reflections. Public Comments Several commenters supported the proposal but asked that SAMHSA expand the proposal beyond information conveyed orally to cover other forms of communications, including secure clinical messages (such as a secure web portal), which are common ways for providers to share information. One commenter said it would be confusing to allow orally communicated information to be covered under HIPAA while the same information conveyed via text would retain part 2 requirements. Other commenters said that imparting the oral requirement fails to appreciate workflow; that secure messaging is just as critical for patient safety; and that if information is received through electronic means, such as a Health Information Exchange, it should not become a record subject to part 2 if the non-part 2 provider includes it in his/her record. A few commenters recommended that SAMHSA remove the word “orally” altogether from the proposed definition of records, to enable non-part 2 providers to document critical information received from a program regardless of the manner and mode in which it is provided. A few commenters suggested that non-part 2 providers should be allowed to document information such as medications if that information constitutes redisclosure with other providers for treatment purposes, without penalty hinging on whether the information is conveyed orally or by other means. Others encouraged SAMHSA to provide greater emphasis on the ways that health information can be shared, used, and disclosed for the benefit of individuals' treatment, payment processes, and health care operations, and to further align definitions in the future such that part 2 providers could share pertinent information with non-part 2 providers. SAMHSA Response Although the change to the definition of “records” under § 2.11 applies to information disclosed orally by a part 2 program to a non-part-2 provider, this change will not create a disconnect under part 2 with regard to how other forms of communication by a part 2 program are treated. More specifically, the changes in § 2.12 of the rule on “Applicability” establish that records containing SUD information about a patient created by a non-part 2 provider will not be covered by part 2, unless any SUD record previously received from a part 2 program is incorporated into such records. Under § 2.12, segregation of the received record can be used by non-part 2 providers to ensure that their own created patient records can be distinguished from the received record, and thus will not become covered by part 2. Taken together, the effect of the revisions to §§ 2.11 and 2.12 is to cause both oral and non-oral communications made by a part 2 program to a non-part 2 provider to be treated in the same way under the regulations. In each instance, the intent is to allow the part 2 program to make a disclosure, with the patient's consent, to the recipient non-part 2 provider. In turn, the non-part 2 provider can then carry out her own encounter with the patient, and create her own patient record, which will not fall under the coverage of part 2. Again, segregation of any received SUD record may be used by a non-part 2 provider to ensure that her own created records can be distinguished, and will therefore not become subject to part 2. SAMHSA recognizes the importance of secure messaging and other forms of electronic communication and record-keeping in SUD care. SAMHSA nevertheless believes that the current revisions to §§ 2.11 and 2.12 offer an appropriate fix for allowing a limited transfer of information between part 2 programs and non-part 2 providers, subject to patient consent, in order to facilitate better coordination of care. SAMHSA will continue to consider opportunities for further re-alignment of part 2 requirements for the disclosure of SUD records for treatment, payment and health care operations in the future, to the extent permissible under the part 2 enabling statute, and in alignment with the provisions of § 3221 of the CARES Act. Public Comments One commenter requested that SAMHSA revise the definition of records to allow for oral communication between relevant entities without obtaining patient consent. The commenter said that requiring the consent of the patient in this instance is contrary to the stated intent of facilitating care coordination, and that SAMHSA should clarify that conversations between part 2 providers, non-part 2 providers and other appropriate third parties, including managed care organizations, should not require patient consent if undertaken for the purpose of treatment, payment or health operations, including care coordination and case management. Another commenter recommended exempting information about medications and laboratory results from the definition of “records,” thereby making it possible for a part 2 program to disclose such information without patient consent. That commenter asserted that such an exemption would help to enable a patient's [non-part 2] treatment providers to monitor for abuse, medication-seeking behavior, drug interactions, and possible diversion. SAMHSA Response SAMHSA believes that the current revisions to §§ 2.11 and 2.12 offer an appropriate fix for allowing a limited transfer of information between part 2 programs and non-part 2 providers, subject to patient consent, in order to facilitate better coordination of care. Other forms of communication between lawful holders of part 2 records are also permitted under the part 2 regulations with patient consent, consistent with the enabling statute. The revisions to §§ 2.11 and 2.12 reflect a balance of interests between ensuring robust privacy protection for part 2 program treatment records, while also pursuing patient safety, reduction of adverse events, and better coordination of care for persons with SUD. As discussed below, SAMHSA is also modifying the regulatory text in § 2.33(b), to include disclosures for the purpose of care coordination and case management to the list of permitted activities. SAMHSA will continue to consider opportunities for further re-alignment of part 2 requirements for the disclosure of SUD records for treatment, payment and health care operations in the future, to the extent permissible under the part 2 enabling statute and in alignment with § 3221 of the CARES Act. Public Comments One commenter urged SAMHSA to further update the definitions of part 2 to make it clear that entities that are not directly delivering SUD treatment services, such as health plans and insurers, are explicitly not part 2 programs and are not non-part 2 providers. The commenter believes that making this concept more explicit would clarify confusion as to whether records created by health plans and insurers, independent of information disclosed to the health plan or insurer by a part 2 provider, are subject to part 2. SAMHSA Response SAMHSA appreciates this comment. Although outside the scope of the current rulemaking, SAMHSA will consider further clarifications to the definition of “part 2 program” in the future. Public Comments A few commenters expressed concern that the proposed revision to § 2.11 may create an-over-reliance upon oral communication and transcription, which they believe is inherently less accurate than electronic sharing of records; may further fragment patient records; and may encourage providers to avoid using electronic health records, especially for certain SUD information. Another commenter stated that the proposed exception for oral communications will prove difficult for part 2 programs and treating providers. The commenter said that compliance, privacy, and legal advisors will be hesitant to permit part 2 program staff to communicate with other health care providers orally due to concerns about misunderstandings or inaccurate transcriptions of oral communications, especially if there is no written record. Several commenters encouraged SAMHSA to recognize the need for accurate, complete, and efficient electronic exchange of information, such as through the new interoperable electronic health records that CMS and ONC seek to promote with their recent rulemaking, and move away from paper charts and manual faxing. SAMHSA Response Although the change to the definition of “records” under § 2.11 applies to information communicated orally by a part 2 program to a non-part-2 provider, this change will not result in a disconnect under part 2 with regard to how other forms of disclosure by a part 2 program are treated. Rather than creating a new reliance on oral communications over other methods of sharing records, SAMHSA believes that the change in §§ 2.11 and 2.12 will have the opposite effect, by making it more clear how a non-part-2 provider can receive and segregate an electronic or paper record from a part 2 program, without incurring the risk that any subsequent patient records directly created by the recipient provider will then become covered by part 2. For example, in the context of receiving an electronic part 2 record, such as a summary of care document, shared between interoperable EHR systems that meet DS4P standards, “segregation” might be carried out by segmenting the received SUD record so as to preserve the recipient's ability not to disclose it based on the sensitivity of its content. SAMHSA has been collaborating with both ONC and CMS in connection with their rulemaking efforts on the interoperability of electronic healthcare records, to ensure that health IT policies consider the impacts for part 2 providers and vice versa. Public Comments One commenter recommended that SAMHSA devote resources toward ensuring that patients understand the implications of the new policy. The commenter stated that when a patient consents to the release of a part 2 record to a non-part 2 provider, he or she must understand that they are not simply consenting to use of the information for a one-time conversation with the non-part 2 provider, but rather they are consenting to the information potentially becoming a part of his or her main medical record. The commenter believes that both the part 2 provider and the non-part 2 provider should make this clear, or else it could have a significant chilling effect on patients seeking SUD treatment, as those patients may believe that their right to confidentiality has been removed. SAMHSA Response SAMHSA appreciates this comment. We are considering opportunities for further guidance and patient and provider education, in connection with the new part 2 rule. Public Comments Several commenters opposed the changes proposed in the revised § 2.11. Some commenters explicitly opposed excluding from the definition of “records” any oral communication from a part 2 program that is received and later reduced to writing by a non-part 2 provider. These commenters said the ability to transmit SUD information orally would circumvent part 2, because the information would thereby lose its protection, and that patients who consent to sharing their records with a non-part 2 provider will not understand that information shared orally is not protected by part 2 in the recipient provider's records. SAMHSA Response Although the change to the definition of “records” under § 2.11 does apply to information communicated orally by a part 2 program to a non-part-2 provider, this change will serve to clarify, rather than to modify, the application of part 2 to patient records created by downstream non-part 2 providers. Neither the enabling statute, nor older versions of the part 2 regulations going back to 1987, ever intended the outcome that an oral communication made by a part 2 program to a non-part 2 provider, subject to patient consent, would make all subsequent clinical recordkeeping by the non-part 2 provider subject to the requirements of part 2. The revisions to §§ 2.11 and 2.12 will help to clarify the longstanding balance of interests that part 2 requires, ensuring robust privacy protection for part 2 program treatment records, while also promoting patient safety, reduction of adverse events, and effective coordination of care for persons with SUD. Meanwhile, SAMHSA does acknowledge the importance of making sure that patients understand the contours of their part 2 privacy rights under the revised rule. Again, we are considering opportunities for further guidance and patient and provider education, in connection with the new part 2 rule, as well as in connection with other applicable laws, such as Jessie's Law, which was enacted as section 7051 of the Substance Use-Disorder Prevention that Promotes Opioid Recovery and Treatment for Patients and Communities Act (SUPPORT Act) (Pub. L. 115-271). Jessie's Law calls for best practice development and dissemination around the display of an opioid use disorder diagnosis in health care records. Public Comments A few commenters said the proposed changes would allow sensitive information about a patient's substance use diagnosis or treatment that is included the general medical record to be shared much more broadly, putting the patient at greater risk of legal prosecution and discrimination. Commenters noted that while HIPAA may still protect the information, it permits much greater access to patient records by law enforcement, insurance companies, entities performing healthcare operations and courts. One commenter said that HIPAA is not sufficiently protective of health condition information that may be highly stigmatized or criminalized. Another said that patients must be able to access care for a SUD without fear of their highly sensitive information being transferred into HIPAA records that offer less protections. A few commenters said the changes will discourage people from seeking help or staying in treatment, including individuals living in areas that are already heavily policed. One commenter said that if any program or activity related to SUD knows that oral communications are no longer considered “records”, then actions encompassing the identity, diagnosis, prognosis or treatment of any patient acquired in connection with the performance of that activity will be compromised, which runs counter to SAMHSA's claim of wanting to promote better quality of care for patients. SAMHSA Response SAMHSA believes that the revisions to §§ 2.11 and 2.12 offer an appropriate transitional fix for allowing a limited transfer of information between part 2 programs and non-part 2 providers, subject to patient consent, in order to facilitate better coordination of care. The revised provisions continue to require patient consent, even with oral communications. SAMHSA does not believe that this rule will create the downstream effects of substantially increased discrimination and stigma, nor of substantially decreased patient willingness to enter treatment. Public Comments A few commenters said the change to the definition of “records” under § 2.11 would be confusing to patients and providers, including one commenter who found the distinction between receiving an oral disclosure versus a disclosure of paper or electronic records unclear. The commenter noted that all of the part 2 protections cease to apply once a patient begins sharing information through a patient portal with a non-part 2 provider, since part 2 only applies to part 2 programs. Several commenters said the proposed change would cause confusion for patients and providers in non-part 2 settings, by requiring different privacy standards for information disclosed orally versus in writing, different layers of protection for the same information, and a process to reconcile written records and oral communications in the receiving provider's system. Another commenter questioned how EHRs will distinguish among information received verbally, information received electronically and scanned, and information received in writing and then rewritten into the chart, which would presumably still enjoy part 2 protection. SAMHSA Response As discussed above, although the change to the definition of “records” under § 2.11 applies to oral disclosures made by a part 2 program to a non-part-2 provider, this change will not create a disconnect under part 2 with regard to how other forms of disclosure are treated. Notably, there is no requirement for a recipient, non-part 2 provider to reconcile a received oral disclosure with her own written records. More broadly, the revised §§ 2.11 and 2.12 create no new requirements for the use of EHRs, and no new risks for non-part 2 providers who are already using EHRs in the care of patients with SUDs. Rather, §§ 2.11 and 2.12 together make it clear that non-part 2 providers can create their own patient records, including SUD information, without that activity becoming subject to part 2. Any records previously received from a part 2 program may be segregated, in order to distinguish them from the independent recordkeeping activity of the non-part-2 provider recipient based on her own clinical encounters. And these basic parameters apply equally, regardless of what technology the non-part 2 provider is using to keep his or her own records. SAMHSA does note that using an EHR that supports data tagging and segmentation for privacy and consent management is one path by which a non-part 2 provider could comply with the final rule, particularly with regard to a received electronic record. In order to address any confusion in the patient and provider communities, SAMHSA is considering opportunities for guidance and educational outreach, in connection with §§ 2.11 and 2.12 specifically, and the new part 2 rule more broadly. Public Comments One commenter asked if a patient must give written consent to “verbal” disclosure as well as to “written or electronic” disclosures, and if they could do so by checking distinct boxes. SAMHSA Response In general, the part 2 requirements for patient consent to a disclosure of his SUD treatment record by a part 2 program or lawful holder apply regardless of the medium by which any such disclosure is made. Under revisions in this final rule, a patient still must provide written consent in order for a part 2 program to orally share his or her part 2 information with a non-part 2 provider, unless an exception provided for under this Part applies. Public Comments One commenter asked for clarification on the difference between the terms, “record,” “part 2 record,” and “part 2-covered record.” The commenter said these terms are not defined. Likewise, another commenter said confusion remains about what constitutes a part 2 record and recommended that SAMHSA engage with stakeholders to inform future guidance that clarifies ambiguity. SAMHSA Response SAMHSA appreciates these comments. Although the term “records” is defined under § 2.11, the expressions “part 2 record” and “part 2-covered record” are not defined in the regulation. Broadly speaking, “part 2 record” and “part-2 covered record” both refer to an SUD patient record which is subject to the requirements of part 2, by virtue of originating from a part 2 program. In order to address any confusion in the patient and provider communities, SAMHSA is considering guidance and opportunities for educational outreach, in connection with §§ 2.11 and 2.12 specifically and the new part 2 rule more broadly. Public Comments One commenter said it was not clear whether certain facilities, like health centers, would benefit from the changes in §§ 2.11 and 2.12. SAMHSA Response SAMHSA appreciates this comment. SAMHSA will monitor the implementation of revised §§ 2.11 and 2.12 in the field, and will consider further guidance on the impact of the revisions to §§ 2.11 and 2.12, including with regard to disclosures by part 2 programs made to non-part 2 health centers. Public Comments One commenter appreciated the attempt to bring 42 CFR part 2 into alignment with other privacy rules but said there is still more work to be done to align with HIPAA and across agencies. The commenter said a paper-based workflow point of view is outdated and runs counter to burden-reduction efforts. SAMHSA Response SAMHSA appreciates these comments. SAMHSA will consider further revisions to the part 2 regulations in the future, particularly to implement § 3221 of the CARES Act. Several of the related CARES Act provisions will likely have the effect of more strongly aligning part 2 confidentiality standards with the HIPAA privacy rule. Public Comments A few commenters said that despite SAMHSA's statement that it does not intend to permit wholesale transcription of the patient's part 2 records into the primary care record, the proposed change may lead to that outcome, especially given the availability of text-to-speech technology applications. One commenter said SAMHSA had provided no parameters on what is permissible beyond the term “clinical purpose,” which could result in inappropriate and broad sharing of extensive and potentially damaging information, exposing SUD patients to legal prosecution and discrimination. Another commenter said that if SAMHSA finalizes the proposed amendment to § 2.11, it should include limits on the quantity of information to be transcribed, a clear prohibition on the use of text-to-speech technology for the purposes of this provision, and a requirement that the primary care practitioner counsel the patient on the privacy implications of consenting to such a disclosure, including the ways that HIPAA is less protective of patient privacy than part 2 or applicable state privacy laws. One commenter applauded SAMHSA's inclusion of language in the preamble addressing the possibility that a non-part 2 provider might transcribe extensively from a part 2 record without having a clinical purpose for doing so and the agency's explicit statement that this is not the intent of the proposal. The commenter urged SAMHSA to incorporate this concept into regulatory text so that non-part 2 providers and other lawful holders are on notice that the intent behind SAMHSA's revised definition of “records” is to facilitate a treatment discussion between a non-part 2 provider and a patient and not a loophole to circumvent patient privacy and consent. The commenter urged that both §§ 2.11 and 2.12 reference this principle, and asked that § 2.11 specifically note that oral communications from part 2 providers to payers or other third parties are not to be used as the basis of the creation of separate record streams for patients. The commenter also said that SAMHSA should make clear in regulations that its intent behind the revisions to §§ 2.11 and 2.12 is to promote a clinical purpose, such as to allow a treatment note based on a direct clinical encounter with the patient. Short of this clarification, the commenter said SAMHSA should not revise the definition of records to exclude oral communications. Another commenter suggested that SAMHSA provide sub-regulatory guidance and narrative examples that illustrate acceptable practices regarding the extent of transcription and/or documentation permitted from this change. SAMHSA Response As we explained above, the effect of the revision in § 2.11 is to incorporate a very limited exception to the definition of “records,” such that a non-part 2 provider who orally receives a protected SUD information from a part 2 program may subsequently engage in an independent conversation with her patient, informed by her discussion with the part 2 provider, and record SUD information received from the part 2 program or the patient, without fear that her own records for that patient thereafter would become covered by part 2. This provision will not immunize the misconduct of a non-part 2 provider who engages in the wholesale transcription of a received SUD patient record, without her own direct patient encounter and without clinical purpose. SAMHSA will consider issuing future guidance on acceptable practices regarding the extent of transcription and/or documentation permitted under §§ 2.11 and 2.12 if we find it is necessary. Public Comments One commenter said the proposed revisions to the definition of “records” and “applicability” are vague and do not provide any meaningful or clear guidance on what can be added to a medical record without triggering the requirements of 42 CFR part 2. Another commenter asked for clarification as to whether part 2 redisclosure limitations apply when a treating non-part 2 provider reviews the part 2 program record, transcribes information from that record which has been validly shared pursuant to patient consent, and then inserts it into his or her own treatment record. The commenter asked SAMHSA to confirm that doing so would avoid application of part 2 to the treating provider's record and to broaden the exception to permit portions, summaries, or other extractions from the record to be redisclosed without consent. SAMHSA Response As discussed above, the preamble and revisions to §§ 2.11 and 2.12 speak with specificity to the circumstances in which a non-part 2 provider can receive and hold a treatment record from a part 2 program, while nevertheless being able to create her own patient records without fear that these will become covered by part 2. Taken together, the effect of the revisions to §§ 2.11 and 2.12 is to allow a part 2 program to make a disclosure, with the patient's consent, to the recipient non-part 2 provider. In turn, the non-part 2 provider can then carry out her own encounter with the patient, and create her own patient record, which will not fall under the coverage of part 2. Again, segregation of any received SUD record may be used by a non-part 2 provider to ensure that her own created records can be distinguished and will therefore not become subject to part 2. Consistent with the foregoing explanation, SAMHSA believes that the revised §§ 2.11 and 2.12 strike the appropriate balance in describing how part 2 will apply in these situations. Public Comments One commenter asked whether patient SUD treatment information obtained and then recorded by a part 2 program from a non-part 2 provider could be exempt or outside the definition for a part 2 record. SAMHSA Response No, that information would still receive part 2 protection. There is nothing in the final rule that modifies the basic definition of “records” under § 2.11, as this applies to a part 2 program. Section 2.11 states, in pertinent part, that “Records means any information, whether recorded or not, created by, received, or acquired by a part 2 program relating to a patient.” C. Applicability (§ 2.12) SAMHSA is finalizing this section as proposed. In the 1987 final rule, SAMHSA broadly established that the restrictions on disclosure under 42 CFR part 2 would apply to any alcohol and drug abuse information obtained by a federally assisted alcohol or drug abuse program. As explained in 1987, by limiting the applicability of 42 CFR part 2 to specialized programs—that is, to those programs that hold themselves out as providing and which actually provide alcohol or drug abuse diagnosis, treatment, and referral for treatment—the aim was to simplify the administration of the regulations, but without significantly affecting the incentive to seek treatment provided by the confidentiality protections. Limiting the applicability of 42 CFR part 2 to specialized programs was intended to lessen the adverse economic impact of the regulations on a substantial number of facilities which provide SUD care only as incident to the provision of general medical care. The exclusion of hospital emergency departments and general medical or surgical wards from coverage was not seen as a significant deterrent to patients seeking assistance for alcohol and drug abuse. SAMHSA's experience in the more than 30 years since 1987 has been consistent with this expectation. The 2017 final rule elaborated on this policy, by establishing that the disclosure restrictions on SUD patient records would extend to individuals or entities who receive such records either from a part 2 program or from another lawful holder. See 42 CFR 2.12(d)(2)(i)(C). As explained in the 2017 final rule, a “lawful holder” of patient identifying information is an individual or entity who has received such information as the result of a part 2-compliant patient consent, or as a result of one of the exceptions to the consent requirements in the statute or implementing regulations (82 FR 6068). Thus, the effect of the 2017 rule was to expand the scope of application for part 2 confidentiality, by ensuring that records initially created by a part 2 program would remain protected under 42 CFR part 2 throughout a chain of subsequent re-disclosures, even into the hands of a downstream recipient not itself a part 2 program. The reason for the 2017 change was, once again, to avoid any deterrent effect on patients seeking specialized SUD care through part 2 treatment programs, by virtue of the patient records from those programs losing their part 2 confidentiality protection following a disclosure downstream to other “lawful holder” recipients of those records (81 FR 6997). Although that policy was established in the 2017 final rule, specifically in § 2.12(d)(2)(i)(C), there remains some confusion within the provider community about what information collected by non-part 2 entities is (or is not) covered by the part 2 restrictions on re-disclosure. When SAMHSA expanded the reach of the Applicability provision in 2017, the intent was not to change the policy established in the 1987 rulemaking, nor to make the records of non-part 2 entities (such as some primary care providers) directly subject to 42 CFR part 2, simply because information about SUD status and treatment might be included in those records. Rather, the intent underlying the 2017 provision was to clarify the applicability of 42 CFR part 2 in a targeted manner, so that records initially created under the protection of part 2 would continue to be protected following disclosure to downstream recipients. In doing so, SAMHSA sought to encourage individuals to enter into SUD treatment through part 2 programs, by strengthening the confidentiality protection for records that originate from those programs. Implicit in SAMHSA rulemaking since 1987 has been the pursuit of a balance of policy interests: On the one hand, consistent with the Congressionally stated purpose of the drug abuse confidentiality statute, to encourage entry into SUD treatment by ensuring that the records of treatment through a part 2 program would not be publicly disclosed, and on the other hand, to reduce the adverse impact of part 2 burdens on general medical care providers and facilities and on patient care. In the wake of the nation's opioid epidemic and continuing trends related to alcohol use disorder and cannabis use disorder, it has become increasingly important for primary care providers and general medical facilities not covered by 42 CFR part 2 to be able to carry out treatment and health care operations that sometimes involve creating new records that mention SUD status and care. Such records and activities are not covered by 42 CFR part 2. However, coordination of care between part 2 programs and non-part 2 providers would involve the disclosure of SUD records and information by the former to the latter. Under the current 42 CFR part 2 regulation, such disclosures of records by a part 2 program to a non-part 2 provider do not render all subsequent records on SUD caretaking activity undertaken by the non-part 2 provider subject to the part 2 regulation. For example, when a non-part 2 provider is directly treating her own patient, and creates a record based on her own patient contact that includes SUD information, then that record is not covered by part 2. Nevertheless, SAMHSA recognizes that there may be significant confusion or misunderstanding as to the applicability of part 2 rules to non-part 2 providers. This results in increased burden on non-part 2 providers, and the potential for impaired coordination of care for patients, which could be life threatening, for example, if an affected patient has an opioid use disorder. Although the existing text of 42 CFR 2.12 (d)(2)(i)(C) on Applicability does not compel these results, SAMHSA's experience in recent years has demonstrated the need for clearer regulatory language, to better delineate the records of non-part 2 entities which are not covered by the 42 CFR part 2 rules. Based on the above considerations, SAMHSA proposed to add a new § 2.12(d)(2)(ii), to better clarify that a non-part 2 treating provider's act of recording information about a SUD and its treatment would not make that record subject to 42 CFR part 2. SUD records received by that non-part 2 entity from a part 2 program are subject to part 2 restrictions on redisclosure of part 2 information by lawful holders, including redisclosures by non-part 2 providers. However, the records created by the non-part 2 provider in its direct patient encounter(s) would not be subject to part 2, unless the records received from the part 2 program are incorporated into such records. Segregation or segmentation of any part 2 records previously received from a part 2 program can be used to ensure that new records ( e.g., a treatment note based on a direct clinical encounter with the patient) created by non-part 2 providers during their own patient encounters would not become subject to the part 2 rules. SAMHSA believed that this addition will further clarify the 2017 revisions, by affirming that the independent record-keeping activities of non-part 2-covered entities remain outside the coverage of 42 CFR part 2, despite such providers' (segregated) possession, as lawful holders, of part 2-covered records. The part 2 disclosure restrictions only apply to SUD patient records originating with part 2 providers. Such part 2 originating records are subject to the part 2 limitations on use and disclosure as they move through the hands of other “lawful holders” and part 2 programs. Even where part 2 does not apply to a patient record created by a non-part 2 provider following a direct patient encounter, that record will nevertheless be subject to the HIPAA Privacy Rule. One means by which non-part 2 treating providers could benefit from the above proposal would be through the segregated storage of part 2-covered SUD records received from a part 2 program or other lawful holder. In the context of a paper record received from a part 2 program, the proposed requirement could be met by the “segregation” or “holding apart” of these records; in the context of electronic records from a part 2 program, the proposed requirement could be met by logical “segmentation” of the record in the electronic health record (EHR) system in which it is held. As under the current rule, when a non-part 2 entity receives a protected SUD record from a part 2 program or other lawful holder, the received record is subject to the heightened confidentiality requirements under part 2. “Segregating” the received record, whether by segmenting it or otherwise labeling or holding it apart, would allow the recipient entity to identify and keep track of a record that requires heightened protection. Under both the proposed and the current text of part 2, the lawful holder recipient entity remains subject to part 2 re-disclosure restrictions with regard to the part 2 record, whether or not the recipient entity is able to segregate it. But “segregating” allows the recipient entity both to keep track of the part 2 records, and readily distinguish them from all the other patient records that the entity holds which are not subject to part 2 protection. As mentioned above, “segregating” the part 2 record may involve physically holding apart any part 2-covered records from the recipient's other records, which would be quite feasible in the case of a received paper record or an email attachment containing such data. Alternately, “segregating” can involve electronic solutions, such as segmenting an electronic SUD patient record received from a part 2 program by use of electronic privacy and security tags such as those in an EHR platform leveraging the HL7 Data Segmentation for Privacy (DS4P) standard, in which segmentation is carried out electronically based on the standards of DS4P architecture (discussed further below). Either of these methods for “segregating” part 2 covered records is a satisfactory way for the recipient entity to keep track of them, and to distinguish them from all the other patient records that the entity holds which are not subject to part 2 protection. We note that “segregating” a received part 2 record does not require the use of a separate server for holding the received part 2 records. We do not intend this rule to result in the creation of separate servers or health IT systems for part 2 documents. Our policy is intended to be consistent with existing technical workflows for data aggregation, storage, and exchange. One concern that the proposed provision raises is the possibility that a non-part 2 provider might transcribe extensively from a part 2 record without having a clinical purpose for doing so. This, however, is not the intent of the provision. Briefly, the intent is to allow a non-part 2 provider to receive SUD information about a patient from a part 2 program, and then to engage in a treatment discussion with that patient, informed by that information, and then be able to create her own treatment records including SUD content, without the latter becoming covered by part 2. This level of flexibility is needed in order to improve coordination of care efforts, and to save lives. It is not SAMHSA's intent to encourage a non-part 2 provider to abuse the rules, by transcribing extensively from a conversation with a part 2 program or from a received part 2 record when creating her own records, without having a clinical purpose for doing so. Our intent is to expressly permit an avenue of communication, with patient consent, between a part 2 program and non-part 2 provider to facilitate better coordination of care, without automatically triggering application of the rule to the independent records of non-part 2 providers. In the 2017 final rule, SAMHSA responded to several public comments about data segmentation issues connected to 42 CFR part 2. We acknowledged then that although significant challenges exist for data segmentation of SUD records within some current EHR systems, SAMHSA has led the development of use-case discussions related to the technical implementation of the DS4P standard and recently contributed to the development of the Fast Healthcare Interoperability Resources (FHIR) implementation guide for Consent2Share. 5 We believe that the existing health IT standards which enable data tagging and data segmentation and which support the SAMHSA Consent2Share tool are important to help advance the needs of part 2 providers and providers across the care continuum. SAMHSA recognizes and encourages the further development of DS4P standards, and the adoption by developers and vendors of EHR systems that meet those standards. The final revisions at § 2.12 do not, however, impose on non-part 2 entities any new requirement for data segmentation as a practice, nor do they establish any new standards or requirements for EHR technology. SAMHSA considered including, in the proposed rule, the policy option of defining “segmented” and “segmentation” under 42 CFR part 2, in order to offer greater clarity about what these terms mean under the rule. Segmentation involves technical capabilities and implementation for tagging and consent management, as well as technical specifications to accurately effect disclosure or non-disclosure of data based on federal, state, and local jurisdictions privacy restrictions and patient consent. This requires both technical specifications as well as supporting policies and governance for the treatment of sensitive data that is tagged. The latter is essential for effective segmentation, and segmentation is not achievable solely via adoption of a specific standard, nor is part 2 the only applicable use case for segmentation. For these reasons, we decided not to define segmentation for the purposes of this rulemaking, as such a definition might have unforeseen technical ramifications for EHR and HIE systems implementation in the future. In addition, SAMHSA believes this policy should be flexible, to allow providers with different operational standards and capabilities to implement the policy with regard to segregation or segmentation in the least burdensome way to their practices, while still maintaining confidentiality of patient records subject to part 2. Nevertheless, using health IT to support data tagging and data segmentation for privacy and consent management is one path that a provider could use to support their effort to meet part 2 requirements, including those described in the proposed rule. 5 “Consent2Share FHIR Profile Design.docx” can be accessed at https://gforge.hl7.org/gf/project/cbcc/frs/. In addition to the proposed revision to 42 CFR 2.12(d) above, SAMHSA proposed conforming changes to the regulatory text of several other sections of 42 CFR 2.12, to provide further clarification of the applicability of part 2 restrictions on patient records. In § 2.12(a), SAMHSA proposed to change the text to reflect that the restrictions on disclosure apply to “any records,” rather than to “any information, whether recorded or not.” We also proposed a conforming change to § 2.12(a)(ii), to indicate that the restrictions of this part apply to any records which “contain drug abuse information obtained . . .” or “contain alcohol abuse information obtained . . . .” Taken together, these changes are congruent with the amendment to § 2.12(d) and help to make it clear that part 2 applies to “records” (as defined under § 2.11). In § 2.12(e)(3), SAMHSA proposed to change the text to reflect that the restrictions on disclosure apply to the recipients “of part 2-covered records,” rather than to the recipients “of information.” This proposed change is congruent with the proposed amendment to § 2.12(d) and would help to make explicit that downstream restrictions on re-disclosure by non-Part 2 entities are tied to protected records which originate from a part 2 program in the first instance. SAMHSA believes that this proposed conforming change is important, because it would further establish that the re-disclosure burden for non-part 2 entities as lawful holders ties specifically to the protected records that they receive from a part 2 program, and not to any other records that the non-part 2 entity creates by itself, regardless of whether the latter might include some SUD-related content. In § 2.12(e)(4), SAMHSA likewise proposed a conforming change to the text, by adding language to reflect that a diagnosis prepared by a part 2 program for a patient who is neither treated by nor admitted to that program, nor referred for care elsewhere, is nevertheless covered by the regulations in this part. The change to the regulatory text is for clarity, to ensure that this section could not be misread as applying directly to the activities of a non-part 2 entity or provider. Similarly, and congruent with the above conforming changes, SAMHSA also proposed to modify the definition of “Records” in § 2.11 as discussed in Section III.A. above and to modify and streamline the language in § 2.32 as discussed in Section III.D. below. Readers are referred to those sections of the proposed rule for specifics on those proposals and the rationales for such proposed policies. The comments we received on the proposed amendments to § 2.12, and our responses, are provided below. Public Comments Many commenters supported our proposal to clarify that a non-part 2 treating provider's act of recording information about a SUD and its treatment would not make that record subject to 42 CFR part 2, stating that, since the information disclosed to non-part 2 providers will still be governed and protected by HIPAA, the proposal strikes the appropriate balance between allowing for coordination of care and encouraging patients to seek treatment for a SUD by ensuring patient records remain confidential. Another commenter said SAMHSA's proposal to allow non-part 2 treating providers to record information about a SUD and its treatment during direct patient encounters without subjecting the information and the record to part 2 would reduce confusion and burden on providers. Several commenters also stated that the policy could help facilitate meaningful communication between part 2 programs and non-part 2 providers. One commenter specifically noted that patients are often surprised when they find out that their records cannot be shared between providers, and this policy may alleviate that concern. Another commenter specifically noted that this proposal is necessary because the schema of DS4P and specifically the Consent to Share tool that SAMHSA proposed in the 2017 Final Rule does not work within a shared electronic health record, but this proposal could. SAMHSA Response We thank the commenters for their support. Public Comments One commenter, while supporting the proposal, asked for further clarification and guidance on the implementation of the proposed changes so that providers can assure compliance with the regulations. SAMHSA Response SAMHSA thanks the commenter for this support. SAMHSA will consider issuing implementation guidance for providers in connection with this rule. Public Comments Several commenters opposed our proposal to clarify that a non-part 2 treating provider's act of recording information about a SUD and its treatment would not make that record subject to 42 CFR part 2, stating that confidentiality is imperative for building trust, establishing rapport, and creating a therapeutic environment in which individuals are able to explore their mental health needs and substance use history. Some commenters argued that this proposal would deter treatment, infringe the patient-provider relationship, increase stigma, and lead to criminalization. One commenter specifically noted that recent research suggests that healthcare providers perceive patients with documented substance use more negatively than patients with other documented health conditions, and widely sharing records could lead to negative impacts on care. SAMHSA Response SAMHSA believes that the revisions to §§ 2.11 and 2.12 offer an appropriate transitional fix for allowing a limited transfer of information between part 2 programs and non-part 2 providers, subject to patient consent, in order to facilitate better coordination of care. The revised provisions continue to require patient consent for disclosure of a patient record by a part 2 program for the purpose of treatment, even in the case of oral disclosures. SAMHSA does not believe that these regulations will create downstream effects of substantially increased discrimination and stigma, or of substantially decreased patient willingness to enter into treatment. Public Comments One commenter opposed the proposal because of the belief that it made a problematic and stigmatizing assumption that patients have not disclosed their treatment information to their providers. Alternatively, another commenter stated that the proposal would not fix the existing challenges for patient safety, because providers may not be aware of a patient's history of opioid use disorder when treating the patient for other conditions, even if those other conditions are related to the SUD. SAMHSA Response SAMHSA believes that the revisions to §§ 2.11 and 2.12 will help to improve the coordination of care between part 2 programs and non-part 2 providers, as well as by non-part 2 providers who receive an SUD patient record disclosed to them by a part 2 program. Rather than making a stigmatizing assumption that patients have not disclosed their SUD treatment information to their [non-part 2] providers, the revisions to §§ 2.11 and 2.12 are intended to facilitate both patients and providers in carrying out exactly those disclosures. Although SAMHSA anticipates that these revisions will help to enhance quality of care efforts and to improve patient safety, it is unlikely that any single policy reform under part 2 will fully resolve the adverse events and safety problems associated with the opioid epidemic. SAMHSA will continue to consider a range of other policies and interventions to address the public health impact of the opioid epidemic in the future. Public Comments Several commenters asked for clarification regarding the recording of part 2 information by a non-part 2 provider in a patient's record. One commenter stated that the proposal was too vague and did not provide any meaningful or clear guidance on what can be added to a medical record without triggering the requirements of 42 CFR part 2. Another commenter asked if the proposal would result in the entire record being enveloped in part 2. A few commenters asked us to clarify whether a non-part 2 provider's act of copying and pasting relevant information from a patient's part 2 program record into a non-part 2 record would constitute the “recording” of SUD information and thus preclude the application of part 2 to the non-part 2 record. Commenters requested detailed guidance to ensure part 2 programs and treating providers are aware of the permissible means to transfer SUD information. One commenter specifically requested guidance on the nature and extent of data that can arise from treatment discussions informed by part 2 data or clinically relevant transcription and whether data segmentation/tagging of such a non-part 2 record is required. The commenter also urged more evaluation and real-world implementation testing with respect to the implementation, standards, and technology issues associated with both clarifications. SAMHSA Response As discussed above, we believe both the preamble and revisions to §§ 2.11 and 2.12 speak with specificity to the circumstances in which a non-part-2 provider can receive and hold a treatment record from a part 2 program, while nevertheless being able to create her own subsequent patient records without fear that these will become covered by part 2. Notably, there is nothing in the final rule that would cause an entire record to be “enveloped in part 2,” any more so than is the case now. Again, the effect of the revisions to §§ 2.11 and 2.12 is to allow the part 2 program to make a disclosure, with the patient's consent, to the recipient non-part 2 provider. In turn, the non-part 2 provider can then carry out her own encounter with the patient, and create her own patient record, which will not fall under the coverage of part 2. Segregation of any received SUD record may be used by a non-part 2 provider to ensure that her own created records can be distinguished, and will therefore not become subject to part 2. Taken together, SAMHSA believes that the revised §§ 2.11 and 2.12 strike the appropriate balance in describing how part 2 will apply in these situations. SAMHSA is considering future guidance to clarify the requirements of §§ 2.11 and 2.12 for providers, and SAMHSA will continue to collaborate with other federal agencies in regard to technology implementation and standard-setting that touches on part 2 records. Public Comments One commenter stated opposition to any limitations on how, when or how much SUD information the non-part 2 provider can document within its own record, even when that information is transcribed from a received record from a part 2 program. This commenter stated that the preamble implies that, in order for part 2 not to apply, the non-part 2 provider needs to document the SUD information as part of a direct clinical patient encounter and upon reviewing it with the patient first, as opposed to directly copying from a record received from a part 2 program. The commenter stated that for appropriate care, non-part 2 providers should be able to document SUD information for safe patient care without the information becoming subject to 42 CFR part 2, regardless of how a part 2 program originally provides the information, or whether information is independently discussed with the patient during a visit. SAMHSA Response SAMHSA believes that the revisions to §§ 2.11 and 2.12 offer the appropriate fix for allowing a limited transfer of information between part 2 programs and non-part 2 providers, subject to patient consent, in order to facilitate better coordination of care. As discussed below, SAMHSA is also modifying the regulatory text in § 2.33(b), to add disclosures for the purpose of care coordination and case management to the list of permitted activities. Other forms of communication between lawful holders of part 2 records are also permitted under the part 2 regulations with patient consent, consistent with the enabling statute. The revisions to §§ 2.11 and 2.12 reflect a balance of interests between ensuring robust privacy protection for part 2 program treatment records, while also pursuing patient safety, reduction of adverse events, and better coordination of care for persons with SUD. SAMHSA will continue to consider opportunities for further re-alignment of part 2 requirements for the disclosure of SUD records for treatment, payment and health care operations in the future, to the extent permissible under the part 2 enabling statute and consistent with § 3221 of the CARES Act. Public Comments One commenter asked if the process of using the capabilities of certified electronic health record technology (CEHRT) to electronically “copy” a medication item, a problem or a medication allergy from the received part 2 document as an external list to the internal list maintained by the non-part 2 provider's CEHRT is considered “transcription.” This commenter asked that we include an example discussing a form of transcription that is permitted that does not violate the handling of a part 2 record received by a non-part 2 provider. Likewise, another commenter specifically recommended that we revise the proposed regulations to allow health systems/providers using an integrated EHR to include the following in the patient's EHR without the patient's consent: Part 2 SUD in the integrated common problem list; Part 2 SUD treatment/post treatment medications on the integrated common medications list; medication allergies found during Part 2 SUD treatment/post treatment encounters on the integrated common medication allergy list; and an exception to obtaining a patient's consent to share this information for health systems/providers who use an integrated EHR. SAMHSA Response Currently, a part 2 program may make a disclosure with the patient's consent to a non-part 2 provider. Taken together, the effect of the revisions to §§ 2.11 and 2.12 is to clarify that the non-part 2 provider can then discuss that information in her own encounter with the patient, and create her own patient record that includes SUD information which will not be subject to part 2. The recipient non-part 2 provider is permitted but not required to segregate the received part 2 record (in whatever medium is relevant), as a way to ensure that her own subsequent record-keeping activity can be distinguished. These general principles continue to apply, regardless of whether the recipient non-part 2 provider is using a CEHRT [certified electronic health record technology ]or whether the recipient non-part 2 provider and the part 2 program exchange their communications through a common, integrated EHR platform. SAMHSA believes that revised §§ 2.11 and 2.12 strike the right balance of interests between ensuring robust privacy protection for part 2 program treatment records, while also promoting patient safety, reduction of adverse events, and better coordination of care for persons with SUD. SAMHSA will continue to consider future guidance and refinement to the part 2 rules, and will continue to work with ONC to support and implement health IT policies consistent with the part 2 rules. Public Comments Many commenters asked for further clarification from SAMHSA in determining which records and providers are subject to part 2 requirements. Commenters specifically asked for definitions as to what “holding oneself out as providing” entails. Other commenters noted that, in the current healthcare environment and its emphasis on integrated care, providers are likely to apply the Part 2 requirements to more treatment settings and providers than required, creating excess compliance burden. Some commenters also noted that it is hard to imagine a scenario in which part 2 would prevent a specialist for any other chronic disease from supporting a treatment team without subjecting the entire team to unwieldy regulations. Commenters also stated that further clarification of the definition of a part 2 program could help patients choose which type of providers—and, consequently, confidentiality protections—they should seek. One commenter recommended that SAMHSA clarify that Medication-Assisted Treatment (MAT) services and their associated workflows provided as part of a general medical facility do not meet the definition of a part 2 program, as long as the providers rendering the MAT services do not do so as their primary function within the facility. This commenter also recommended that SAMHSA clarify that any education or outreach (including posting notices, advertising and informing patients) about the availability of MAT services at a general medical facility, including Indian Health Service (IHS) and tribal facilities, would not change its status as a non-part 2 provider. SAMHSA Response SAMHSA appreciates these comments. Although outside the scope of the current rulemaking, SAMHSA will consider issuing guidance in the future to further clarify when a general medical facility is subject to the part 2 regulations. Public Comments A few commenters asked us to provide further guidance to clarify how health plans may similarly communicate with non-part 2 providers without subjecting their own records to part 2. Commenters asked if the proposed change applies to other lawful holders, specifically health plans. SAMHSA Response The revisions in § 2.12 establish that SUD treatment records created by a non-part 2 provider will not be covered by part 2, unless any SUD record previously received from a part 2 program is incorporated into such records. Under § 2.12, segregation of the received record can be used by non-part 2 providers to ensure that their own created patient records can be distinguished from the received record, and thus will not become covered by part 2. The revisions in § 2.12 do not address the direct disclosure made by a health plan to a non-part 2 provider. In general, the broader part 2 framework concerning disclosures made by health plans as “lawful holders” continue to apply. SAMHSA will consider issuing future guidance to clarify the application of part 2 to disclosures of SUD records by health plans. Public Comments One commenter suggested that rather than modifying § 2.12 in order to facilitate disclosures by part 2 programs to non-part 2 providers in support of care coordination, it would instead be more effective under § 2.33 to add care coordination to the list of payment and operations activities for which a disclosure may be made with patient consent. SAMHSA Response SAMHSA believes that the current revisions to § 2.12 create an appropriate and limited pathway for part 2 programs to disclose SUD records to non-part 2 providers, and then to allow non-part 2 providers to create their own treatment records based on subsequent clinical encounters with their patients. However, as we explain below under § 2.33, SAMHSA has decided to modify the regulatory text in § 2.33(b), by adding disclosures for the purpose of care coordination and case management to the list of permitted activities under that section. Public Comments One commenter specifically recommended that SAMHSA clarify that systems that permit secure communication between patients, their permitted designates and non-part 2 caregivers may be used by part 2 caregivers that are employed by the same healthcare organization, or that use the same implementation of the secure communications system. This commenter also asked us to exempt communications between part 2 providers and non-part 2 healthcare providers that are actively engaged in the care of the same patient, but are not employed by the same healthcare organization. This commenter also asked that we specify that part 2 providers performing hospital consultation work may communicate with non-part 2 providers within the same organization without generating a part 2 covered record. SAMHSA Response Communications between patients, part 2 programs, and non-part 2 providers through patient portals and integrated EHR platforms can present an array of challenges and scenarios for patient consent under part 2. The current rulemaking does not attempt to address or resolve all such situations, nor does it change the status quo of how part 2 applies in many such situations. SAMHSA will consider future guidance with regard to the application of part 2 to integrated EHR platforms, and particularly within integrated healthcare systems that include both part 2 programs and non-part 2 providers within the same system. Public Comments One commenter noted that SAMHSA did not make any proposals related to “Jessie's Law.” The commenter explained that Jessie's Law requires HHS to develop best practices for prominently displaying information relating to a patient's history of substance use in his or her treatment records when the patient makes a request for such disclosure. SAMHSA Response We will continue to work within HHS to ensure that we are complying with any applicable legal requirements stemming from Jessie's Law. Public Comments Several commenters noted support for our description of segregating records, specifically appreciating that we did not impose any new requirement for data segmentation as a practice or establish new standards for EHR technology. Commenters stated that this segregation policy should be flexible to allow providers with different operational capabilities to implement the policy in the least burdensome way and to offer an opportunity for the health IT industry to continue to work with stakeholders in the development of standards to meet patient privacy expectations. One commenter stated the proposal would not incur significant additional burden on vendors because segmenting part 2 data has become an industry norm with the implementation of the Data Segmentation for Privacy standard, as well as the recent FHIR implementation guide for Consent2Share. SAMHSA Response We thank the commenters for their support. Public Comments A few commenters expressed clinical concerns with segmenting records, stating that to do so erodes the reliability of those records to support the delivery of safe care and may discourage the use of EHRs for specific types of SUD information. One commenter noted that this concern is especially important because FDA medical device guidance requires visibility into how IT systems arrive at their recommendations, which may not be possible in a world of segmented data. One commenter cautioned us, for these reasons, to only use data segmentation and separation in a limited way. SAMHSA Response The revisions in § 2.12 do not impose any requirements for non-part 2 providers to segment their electronic health records. Neither do the current revisions in § 2.12 impose any standards for segmenting electronic health records more generally. We believe it is important that providers include clinically relevant information within their records, while still respecting confidentiality requirements. SAMHSA is sensitive to concerns about segmentation standards for EHRs. However, SAMHSA is not introducing new segmentation requirements or standards under this rule-making. Public Comments Some commenters supported the policy of segregating records under § 2.12, but said it is not a practical or best solution to promote the effective handling of SUD information to permit treatment and care coordination, noting that that the proposed changes still do not allow the exchange of information for these purposes without the written consent of the patient. These commenters argued that the policy would be burdensome and costly, and, because of the multitude of different operational standards and capabilities, part 2 programs will find themselves in an economically burdensome and legally questionable position as legal holders of information disclosed to them by patients seeking care. A few of these commenters also noted, however, that these burdens could not be overcome without statutory changes. SAMHSA Response We appreciate these comments. The revised § 2.12 does continue to require patient consent for the disclosure of a patient SUD record by a part 2 program to a non-part 2 provider. The revised § 2.12 reflects a balance of interests between ensuring robust privacy protection for part 2 program treatment records, while also promoting patient safety, reducing adverse events, and facilitating better coordination of care for persons with SUD. SAMHSA does not believe that the revised § 2.12 will place part 2 programs under any greater operational or legal burden than they currently face, with regard to making disclosures to non-part 2 providers. Meanwhile, it would go considerably beyond the current rulemaking, and the current authorizing statute, to permit the disclosure of a patient record by a part 2 program to a non-part 2 provider, without the consent of the patient, except as otherwise permitted under Part 2. Public Comments A few commenters asked us to clarify the scenario in which one entity has Part 2 and non-Part 2 providers utilizing the same EHR that automatically populates diagnosis and prescription information. Commenters requested SAMHSA expand its proposal to clarify that if a general medical facility includes both Part 2 and non-Part 2 providers, then basic information that prepopulates, such as diagnosis and prescription information, is not subject to Part 2 requirements. Commenters further explained that some providers are unable to segregate records with any degree of confidence in their current workflows, and noted that many health systems either use separate EHRs or consider all providers in the system Part 2 providers due to burden and cost, which makes the referral of SUD and non-SUD patients and their health records more complicated. Other commenters similarly noted that they must treat all possible Part 2 information as if it were subject to the rule, and that requiring segmentation of part 2-protected patient records to prevent unauthorized redisclosure may be strictly interpreted by the non-part 2 recipients, causing the information to be inaccessible for care coordination or other purposes beneficial for the patient. SAMHSA Response Taken together, the effect of the revisions to §§ 2.11 and 2.12 is to allow the part 2 program to make a disclosure, with the patient's consent, to the recipient non-part 2 provider. In turn, the non-part 2 provider can then carry out her own encounter with the patient, and create her own patient record, which will not fall under the coverage of part 2. The recipient non-part 2 provider is permitted, but not required, to segregate the received part 2 record (in whatever medium is relevant), as a way to ensure that her own subsequent record-keeping activity can be distinguished. These general principles continue to apply, regardless of whether the recipient non-part 2 provider and the part 2 program exchange their communications through a shared, integrated EHR platform. SAMHSA believes that revised §§ 2.11 and 2.12 strike the right balance of interests between ensuring robust privacy protection for part 2 program treatment records, while also promoting patient safety, reduction of adverse events, and better coordination of care for persons with SUD. SAMHSA will consider future guidance with regard to the application of part 2 to integrated EHR platforms, and particularly within integrated healthcare systems that include both part 2 programs and non-part 2 providers within the same system. Public Comments One commenter specifically noted concerns for IHS or tribal facilities still using the full Resource and Patient Management System (RPMS) EHR system. This commenter stated that, while non-part 2 IHS or tribal facilities could segregate a paper record fairly easily, the RPMS system does not allow for the segregation of electronic records. For this reason, the commenter recommended that IHS and tribal facilities using RPMS be exempted as to compliance with part 2 until IHS modernizes its EHR system. This commenter also asked that SAMHSA conduct tribal consultation to negotiate with tribes on part 2 compliance as to IHS and tribal facilities. SAMHSA Response It is beyond the scope of the current rulemaking for SAMHSA to address specific operational challenges for IHS or tribal facilities associated with part 2. SAMHSA notes, however, that there is no new requirement under § 2.12 for a non-part 2 provider to segregate any SUD records received from a part 2 program. There is also no requirement under the revised § 2.12 for record-keeping practice at IHS or tribal facilities to change. Segregating a received part 2 record under § 2.12 is entirely at the option of the recipient provider. Regardless, SAMHSA will consider conducting future tribal consultations and outreach around the revised part 2 rule, as an input to future guidance on implementation and compliance. Public Comments Several commenters stated what is meant by requiring the records to be “segregated” or “segmented” is unclear and unrealistic, and may mean creating an entirely separate EHR or resorting to paper medical records. One commenter suggested that SAMHSA should propose alternate solutions to segmentation by non-part 2 providers of records received from part 2 programs, which could ease provider burden. Commenters specifically noted concerns with technological barriers to segmenting non-Part 2 covered patient data, because current EHR technology does not allow for a provider to share just the non-Part 2 covered patient information with other providers, and asked SAMHSA to offer guidance. Commenters noted that, currently, there are no federal requirements for EHRs to include DS4P standards, and that, absent a requirement imposed on electronic medical record vendors to adopt DS4P and requirements for receiving providers to have a consent management system, this situation is unlikely to improve. Commenters also questioned whether it is feasible to require DS4P standards in all EHRs and urged SAMHSA to pursue additional testing of the DS4P standards and to work with developers and ONC on a solution. One commenter said that expecting programs to adopt compliant medical records could be expensive, disruptive to patient care, and problematic for many programs. As an alternative, this commenter suggested establishing minimum requirements for all EHRs through the appropriate EHR regulations. SAMHSA Response There is no requirement under revised § 2.12 for a non-part 2 provider to segregate or segment an SUD treatment record received from a part 2 program. It is beyond the scope of the current rulemaking to address a wide range of technical concerns about support for segmentation under specific EHR technologies; or concerns about the development or refinement of future DS4P standards; or concerns about the cost or burden to providers of adopting EHR systems in the future. None of these concerns detracts from the central premise of § 2.12, which is to establish that a patient record created by a non-part 2 provider will not become subject to part 2, simply because SUD information may be included within that record. Nevertheless, SAMHSA remains broadly sensitive to concerns about segmentation, DS4P standards, and EHRs. SAMHSA will continue to collaborate with ONC and CMS on efforts that relate more directly to interoperability and standard-setting for EHRs. Public Comments Although some commenters appreciated that SAMHSA did not prescriptively state a requirement for use of the electronic data segmentation approaches, they similarly noted that DS4P and FHIR standards are still unsettled topics. Commenters explained that, while policies have been adopted and are being further proposed to “tag” sensitive health information in various ways, no progress has been made to provide support to identification of “what” is sensitive in a way that is semantically interoperable or at a meaningful level of data granularity. To make data segmentation a reality that is not burdensome, these commenters stated that many stakeholders must decide how sensitive health information can be “tagged.” Even with this consensus, some commenters expressed concern that tags are not persistent through transfer because DS4P does not detail how recipient systems should handle tagged data, and the scenarios under which it is appropriate to use/disclose data tagged as sensitive. Commenters noted that these technical aspects will require a significant investment in time and resources to ensure the alignment of technical infrastructure and policy approaches for both EHRs and health information exchanges, requiring policy responses as well as the upgrade and maintenance of data dictionaries and technology components. Therefore, commenters urged SAMHSA to continue working with ONC on these issues. One commenter strongly urged SAMHSA to demonstrate commitment to greater interoperability and privacy protections by prioritizing data segmentation in development, testing, and policymaking, specifically noting the need for data segmentation to be made accessible and affordable to physicians. SAMHSA Response SAMHSA acknowledges that many technical issues and standards with regard to data segmentation and tagging practices remain unresolved, and are continuing to evolve rapidly. SAMHSA will monitor the field and continue to work with ONC on these issues, and will likewise collaborate with ONC and CMS on efforts that relate more directly to interoperability and standard-setting for EHRs. Regardless, SAMHSA continues to believe that EHRs that support tagging and segmentation offer one approach for implementing part 2 compliant clinical workflows. Public Comments A few commenters asked us to clarify if “segregation” or “holding apart” applies to claims data, which may hold information about a patient's diagnosis and treatment. One commenter asked that we work with ONC to clarify how treatment of SUD data by non-Part 2 providers will work under information blocking and TEFCA and administrative transaction policies. SAMHSA Response Under § 2.12, it is contemplated that a part 2 program may disclose a treatment record to a non-part 2 provider with the consent of the patient, in support of better coordination of care. In turn, the non-part 2 provider may then carry out her own clinical encounter with the patient, and create her own patient record that includes SUD information, without that record being subject to part 2. The non-part 2 provider may segregate any record previously received from the part 2 program as a way to distinguish this from her own clinical records. Note that all of the foregoing assumes an initial disclosure of a clinical record or information for treatment purposes, rather than a disclosure of claims data, by the part 2 program to the non-part 2 provider. A disclosure involving a claim would typically involve a health plan as a recipient, which is beyond the scope of the current revision of § 2.12 to address. SAMHSA will continue to collaborate within the department on any potential future guidance as may involve health IT. Public Comments One commenter noted support of our proposal to clarify the language of § 2.12 from the use of “any information” to “any records,” and agrees that it better illustrates the intent SAMHSA describes in the preamble. SAMHSA Response We thank the commenter for its support. Public Comments One commenter asked for clarification on whether there is a distinction (or conversely, an ambiguity) between what constitutes the legally recognized medical record, versus shared information that is structured and record-like. In other words, at what threshold of structure and formality of conveyance does “information” become “record?” SAMHSA Response SAMHSA does not draw any distinction between “records” as defined under § 2.11, versus “shared information that is structured and record-like.” Per the regulatory text of § 2.11, a “record” is defined as “any information, whether recorded or not, created by, received, or acquired by a part 2 program relating to a patient.” D. Consent Requirements (§ 2.31) SAMHSA is finalizing this section as proposed, and adding further guidance concerning the application of § 2.31 to disclosures for the coordination of care, as outlined below. In the 2017 final rule, SAMHSA made several changes to the consent requirements at § 2.31, to facilitate the sharing of information within the health care context, while ensuring the patient is fully informed and the necessary confidentiality protections are in place. Among those changes, SAMHSA amended the written consent requirements regarding identification of the individuals and entities to whom disclosures of protected information may be made (82 FR 6077). Specifically, SAMHSA adopted a framework for disclosures to entities that made several distinctions between recipients that have a treating provider relationship with the patient and recipients that do not. Under the current rules at § 2.31(a)(4), if the recipient entity does not have a treating provider relationship with the patient whose information is being disclosed and is not a third-party payer, such as an entity that facilitates the exchange of health care information or research institutions, the written consent must include the name of the entity and one of the following: The name(s) of an individual participant(s); the name(s) of an entity participant(s) that has a treating provider relationship with the patient whose information is being disclosed; or a general designation of an individual or entity participant(s) or class of participants that must be limited to a participant(s) who has a treating provider relationship with the patient whose information is being disclosed. As stated in the 2017 final rule, SAMHSA wants to ensure that patient identifying information is only disclosed to those individuals and entities on the health care team with a need to know this sensitive information (82 FR 6084). SAMHSA, accordingly, limited the ability to use a general designation in the `to whom' section of the consent requirements to those individuals or entities with a treating provider relationship to the patient at issue. Since the 2017 final rule was published, SAMHSA has learned that some patients with SUDs would like part 2 programs to disclose their protected information to entities for reasons including eligibility determinations and seeking non-medical services or benefits from governmental and non-governmental entities ( e.g., social security benefits, local sober living or halfway house programs). Because these entities lack a treating provider relationship with the patient, the current rules preclude them from being designated by name to receive the information, unless they are third-party payers, or the patient knows the identity of the specific individual who would receive the information on behalf of the benefit program or service provider. In addition, many of these entities may not be able to identify a specific employee to receive application information, and instead are likely to encourage patients to contact them or apply online, such that information is submitted to the organization rather than to a specific person. SAMHSA has heard that many patients have encountered frustration and delays in applying for and receiving services and benefits from, and in authorizing part 2 providers to release their information to, entities providing such services and benefits, by virtue of the inability to designate these entities by organization name only on the written consent for disclosure of part 2 information. We also understand that the requirement to include an individual's name could make it more burdensome for part 2 programs or lawful holders to facilitate a patient's specific consent to share their information with a contractor or subcontractor that performs care coordination or case management activities on behalf of the program or lawful holder. It is not SAMHSA's intent to limit patients' ability to consent to the disclosure of their own information or create barriers to care coordination. We wish, rather, to empower patients to consent to the release and use of their health information in whatever way they choose, consistent with statutory and regulatory protections designed to ensure the integrity of the consent process. Therefore, in this final rule, SAMHSA is amending the current regulations to clarify when patients may consent to disclosures of part 2 information to organizations without a treating provider relationship. In particular, SAMHSA has amended § 2.31(a)(4)(i), which previously required a written consent to include the names of individual(s) to whom a disclosure is to be made. The amended section inserts the words “or the name(s) of the entity(-ies)” to that section, so that a written consent must include the name(s) of the individual(s) or entity(-ies) to whom or to which a disclosure is to be made. SAMHSA believes that this language aligns more closely with the wording of the regulation before the January 2017 final rule changes, and would alleviate problems caused by the inability to designate by name an individual recipient at an entity. For example, if a patient wants a part 2 program to disclose impairment information to the Social Security Administration for a determination of benefits, such patient would only need to authorize this agency on the “to whom” section of the consent form, rather than identify a specific individual at the agency to receive such information. In addition, in response to the many comments requesting that SAMHSA provide more flexibility throughout the rule to facilitate care coordination and case management, the chang [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2020-14675. Public record. Not legal advice.