Confidentiality of Substance Use Disorder Patient Records

DEPARTMENT OF HEALTH AND HUMAN SERVICES 42 CFR Part 2 [SAMHSA-4162-20] RIN 0930-AA21 Confidentiality of Substance Use Disorder Patient Records AGENCY:

Substance Abuse and Mental Health Services Administration (SAMHSA), HHS.

ACTION:

Proposed rule.

SUMMARY:

This proposed rule addresses changes to the Confidentiality of Alcohol and Drug Abuse Patient Records regulations. This proposal was prompted by the need to update and modernize the regulations. These laws and regulations governing the confidentiality of substance abuse records were written out of great concern about the potential use of substance abuse information against an individual, preventing those individuals with substance use disorders from seeking needed treatment. The last substantive update to these regulations was in 1987. Over the last 25 years, significant changes have occurred within the U.S. health care system that were not envisioned by the current regulations, including new models of integrated care that are built on a foundation of information sharing to support coordination of patient care, the development of an electronic infrastructure for managing and exchanging patient information, and a new focus on performance measurement within the health care system. SAMHSA wants to ensure that patients with substance use disorders have the ability to participate in, and benefit from new integrated health care models without fear of putting themselves at risk of adverse consequences. These new integrated models are foundational to HHS's triple aim of improving health care quality, improving population health, and reducing unnecessary health care costs. SAMHSA strives to facilitate information exchange within new health care models while addressing the legitimate privacy concerns of patients seeking treatment for a substance use disorder. These concerns include: The potential for loss of employment, loss of housing, loss of child custody, discrimination by medical professionals and insurers, arrest, prosecution, and incarceration

alth care costs. SAMHSA strives to facilitate information exchange within new health care models while addressing the legitimate privacy concerns of patients seeking treatment for a substance use disorder. These concerns include: The potential for loss of employment, loss of housing, loss of child custody, discrimination by medical professionals and insurers, arrest, prosecution, and incarceration. This proposal is also an effort to make the regulations more understandable and less burdensome. We welcome public comment on this proposed rule.

DATES:

To be assured consideration, comments must be received at one of the ADDRESSES provided below, no later than 5 p.m. on April 11, 2016.

ADDRESSES:

In commenting, please refer to file code SAMHSA 4162-20.

Because of staff and resource limitations, we cannot accept comments by facsimile (FAX) transmission.

You may submit comments in one of four ways (to avoid duplication, please submit your comments in only one of the ways listed):

1. Electronically: Federal eRulemaking Portal. You may submit comments electronically to http://www.regulations.gov. Follow the “Submit a comment” instructions.

2. By regular mail. Written comments mailed by regular mail must be sent to the following address ONLY: The Substance Abuse and Mental Health Services Administration, Department of Health and Human Services, Attn: SAMHSA-4162-20, 5600 Fishers Lane, Room 13N02B, Rockville, Maryland 20857.

Please allow sufficient time for mailed comments to be received before the close of the comment period. 3. By express or overnight mail. Written comments sent by express or overnight mail must be sent to the following address ONLY: The Substance Abuse and Mental Health Services Administration, Department of Health and Human Services, Attn: SAMHSA-4162-20, 5600 Fishers Lane, Room 13N02B, Rockville, Maryland 20852.

4. By hand or courier

comments to be received before the close of the comment period. 3. By express or overnight mail. Written comments sent by express or overnight mail must be sent to the following address ONLY: The Substance Abuse and Mental Health Services Administration, Department of Health and Human Services, Attn: SAMHSA-4162-20, 5600 Fishers Lane, Room 13N02B, Rockville, Maryland 20852.

4. By hand or courier. Written comments delivered by hand or courier must be delivered to the following address ONLY: The Substance Abuse and Mental Health Services Administration, Department of Health and Human Services, Attn: SAMHSA-4162-20, 5600 Fishers Lane, Room 13N02B, Rockville, Maryland 20857.

For information on viewing public comments, see the beginning of the SUPPLEMENTARY INFORMATION section.

FOR FURTHER INFORMATION CONTACT:

Kate Tipping, 240-276-1652, Email address: PrivacyRegulations@samhsa.hhs.gov.

SUPPLEMENTARY INFORMATION:

Inspection of Public Comments: ALL COMMENTS received before the close of the comment period are available for viewing by the public, including any personally identifiable and/or confidential information that is included in a comment. We post all comments received as soon as possible after they have been received on the following Web site: http://www.regulations.gov. Follow the search instructions on that Web site to view public comments.

Comments received before the close of the comment period will also be available for public inspection, generally beginning approximately 3 weeks after publication of a document, at the headquarters of the Substance Abuse and Mental Health Services Administration, 5600 Fishers Lane, Rockville, Maryland 20857, Monday through Friday of each week from 8:30 a.m. to 4 p.m. To schedule an appointment to view public comments, phone 240-276-1660.

We will consider all comments we receive by the date and time specified in the DATES section of this preamble, and will respond to the comments in the preamble of the final rule

and Mental Health Services Administration, 5600 Fishers Lane, Rockville, Maryland 20857, Monday through Friday of each week from 8:30 a.m. to 4 p.m. To schedule an appointment to view public comments, phone 240-276-1660.

We will consider all comments we receive by the date and time specified in the DATES section of this preamble, and will respond to the comments in the preamble of the final rule.

Effective date of proposed § 2.13(d): As discussed in the preamble, the proposed § 2.13(d) shall not go into effect until two years after the effective date of the final rule.

Table of Contents

To assist readers in referencing sections contained in this preamble, we are providing a table of contents.

I. Executive Summary A. Purpose B. Summary of the Major Provisions C. Summary of Impacts II. Background A. Significant Technology Changes B. Statutory and Rulemaking History III. Provisions of This Proposed Rule A. Reports of Violations (§ 2.4) 1. Overview 2. Proposed Revisions B. Definitions (§ 2.11) 1. Overview 2. Proposed Revisions a. New Definitions i. Part 2 Program ii. Part 2 Program Director iii. Substance Use Disorder iv. Treating Provider Relationship v. Withdrawal Management b. Existing Definitions i. Central Registry ii. Disclose or Disclosure iii. Maintenance Treatment iv. Member Program v. Patient vi. Patient Identifying Information vii. Person viii. Program ix. Qualified Service Organization x. Records xi. Treatment c. Terminology Changes C. Applicability (§ 2.12) 1. Overview 2. Proposed Revisions D. Confidentiality Restrictions and Safeguards (§ 2.13) 1. Overview 2. Proposed Revisions E. Security for Records (§ 2.16) 1. Overview 2. Proposed Revisions F. Disposition of Records by Discontinued Programs (§ 2.19) 1. Overview 2. Proposed Revisions G. Notice to Patients of Federal Confidentiality Requirements (§ 2.22) 1. Overview 2. Proposed Revisions H. Consent Requirements (§ 2.31) 1. Overview 2. Proposed Revisions a. To Whom i. Overview ii. Proposed Revisions b. Amount and Kind i. Overview ii

for Records (§ 2.16) 1. Overview 2. Proposed Revisions F. Disposition of Records by Discontinued Programs (§ 2.19) 1. Overview 2. Proposed Revisions G. Notice to Patients of Federal Confidentiality Requirements (§ 2.22) 1. Overview 2. Proposed Revisions H. Consent Requirements (§ 2.31) 1. Overview 2. Proposed Revisions a. To Whom i. Overview ii. Proposed Revisions b. Amount and Kind i. Overview ii. Proposed Revisions c. From Whom i. Overview ii. Proposed Revisions d. New Requirements i. Overview ii. Proposed Revisions I. Prohibition on Re-disclosure (§ 2.32) 1. Overview 2. Proposed Revisions J. Disclosures to Prevent Multiple Enrollments (§ 2.34) 1. Overview 2. Proposed Revisions K. Medical Emergencies (§ 2.51) 1. Overview 2. Proposed Revisions L. Research (§ 2.52) 1. Overview 2. Proposed Revisions M. Audit and Evaluation (§ 2.53) 1. Overview 2. Proposed Revisions IV. Collection of Information Requirements V. Response to Comments VI. Regulatory Impact Analysis A. Statement of Need B. Overall Impact 1. Direct Costs of Implementing the Proposed Regulations a. Staff Training b. Updates to Consent Forms c. List of Disclosures Costs d. IT Updates C. Conclusion Acronyms

ACO Accountable Care Organization ABAM American Board of Addiction Medicine ADAMHA Alcohol, Drug Abuse and Mental Health Administration ANSI American National Standards Institute ARRA American Recovery and Reinvestment Act of 2009 (Pub. L. 111-5) ATR Access to Recovery CCO Coordinated Care Organization CFR Code of Federal Regulations CHIP Children's Health Insurance Program CMS Centers for Medicare & Medicaid Services DS4P Data Segmentation for Privacy EHR Electronic Health Record FAX Facsimile FDA Food and Drug Administration FR Federal Register FWA Federalwide Assurance HHS Department of Health and Human Services HIE Health Information Exchange HIPAA Health Insurance Portability and Accountability Act of 1996 (Pub. L

lations CHIP Children's Health Insurance Program CMS Centers for Medicare & Medicaid Services DS4P Data Segmentation for Privacy EHR Electronic Health Record FAX Facsimile FDA Food and Drug Administration FR Federal Register FWA Federalwide Assurance HHS Department of Health and Human Services HIE Health Information Exchange HIPAA Health Insurance Portability and Accountability Act of 1996 (Pub. L. 104-191) HITECH Health Information Technology for Economic and Clinical Health HL7 Health Level 7 IG Implementation Guide IT Information Technology IRB Institutional Review Board NPRM Notice of Proposed Rulemaking N-SSATS National Survey of Substance Abuse Treatment Services OECD Organization for Economic Cooperation and Development OHRP Office for Human Research Protections OMB Office of Management and Budget ONC Office of the National Coordinator for Health Information Technology PDMP Prescription Drug Monitoring Program QE Qualified Entity QSO Qualified Service Organization QSOA Qualified Service Organization Agreement RFA Regulatory Flexibility Act SAMHSA Substance Abuse and Mental Health Services Administration S&I Standards and Interoperability TEDS Treatment Episode Data Set U.S.C. United States Code VA Department of Veterans Affairs I. Executive Summary

A. Purpose

This proposed rule would revise title 42 of the Code of Federal Regulations part 2 (42 CFR part 2), Confidentiality of Alcohol and Drug Abuse Patient Records regulations. The authorizing statute (Title 42, United States Code, Section 290dd-2) protects the confidentiality of the identity, diagnosis, prognosis, or treatment of any patient records which are maintained in connection with the performance of any federally assisted program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research. Title 42 of the CFR part 2 was first promulgated in 1975 (40 FR 27802) and last substantively updated in 1987 (52 FR 21796)

f the identity, diagnosis, prognosis, or treatment of any patient records which are maintained in connection with the performance of any federally assisted program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research. Title 42 of the CFR part 2 was first promulgated in 1975 (40 FR 27802) and last substantively updated in 1987 (52 FR 21796).

The laws and regulations governing the confidentiality of substance abuse records were written out of great concern about the potential use of substance abuse information against individuals, causing individuals with substance use disorders to not seek needed treatment. The disclosure of records of individuals with substance use disorders has the potential to lead to a host of negative consequences including: Loss of employment, loss of housing, loss of child custody, discrimination by medical professionals and insurers, arrest, prosecution, and incarceration. The purpose of the regulations at 42 CFR part 2 is to ensure that a patient receiving treatment for a substance use disorder in a part 2 program is not made more vulnerable by reason of the availability of their patient record than an individual with a substance use disorder who does not seek treatment. Under the current regulations, a federally assisted substance use disorder program generally may only release identifiable information related to substance use disorder diagnosis, treatment, or referral for treatment with the individual's express consent. Now over 25 years later, this proposed rule would make policy changes to the regulations to better align them with advances in the U.S. health care delivery system while retaining important privacy protections.

Unless otherwise noted, these changes would be applicable beginning 180 days after the publication of the final rule

ment, or referral for treatment with the individual's express consent. Now over 25 years later, this proposed rule would make policy changes to the regulations to better align them with advances in the U.S. health care delivery system while retaining important privacy protections.

Unless otherwise noted, these changes would be applicable beginning 180 days after the publication of the final rule. If programs that were required to comply with 42 CFR part 2 prior to the effective date of the final rule continue to fall within the scope of 42 CFR part 2 as outlined in the final rule, they would be required to come into compliance with any revised regulations by the effective date of the final rule. However, signed consent forms in place prior to the effective date of the final rule would be valid until they expire. Nonetheless, part 2 programs may update signed consent forms consistent with the final rule, prior to the effective date of the final rule if they so choose. Consents obtained after the effective date would need to comply with the final rule, regardless of whether the consents involve patient identifying information obtained prior to or after the effective date of the final rule.

B. Summary of the Major Provisions

This proposed rule is intended to modernize the 42 CFR part 2 (part 2) rules by facilitating the electronic exchange of substance use disorder information for treatment and other legitimate health care purposes while ensuring appropriate confidentiality protections for records that might identify an individual, directly or indirectly, as having or having had a substance use disorder. To achieve this goal, we propose the following modifications

42 CFR part 2 (part 2) rules by facilitating the electronic exchange of substance use disorder information for treatment and other legitimate health care purposes while ensuring appropriate confidentiality protections for records that might identify an individual, directly or indirectly, as having or having had a substance use disorder. To achieve this goal, we propose the following modifications.

We propose, in Section III.A., Reports of Violations (§ 2.4), to revise the requirement for reporting violations of these regulations by methadone programs (now referred to as opioid treatment programs) to the Food and Drug Administration (FDA) because the authority over these programs was transferred from the FDA to Substance Abuse and Mental Health Services Administration (SAMHSA) in 2001.

In Section III.B., Definitions (§ 2.11), we propose to revise some existing definitions, add new definitions of key terms that apply to 42 CFR part 2, and consolidate all but one of the definitions that are currently in other sections in § 2.11. We propose to revise the definitions of “Central registry,” “Disclose or disclosure,” “Maintenance treatment,” “Member program,” “Patient,” “Patient identifying information,” “Person,” “Program,” “Qualified service organization (QSO),” “Records,” and “Treatment.” We also propose to add definitions of “Part 2 program,” “Part 2 program director,” “Substance use disorder,” “Treating provider relationship,” and “Withdrawal management.” Some of these new definitions replace existing definitions. In addition, we propose to revise the regulatory text to use terminology in a consistent manner

am,” “Qualified service organization (QSO),” “Records,” and “Treatment.” We also propose to add definitions of “Part 2 program,” “Part 2 program director,” “Substance use disorder,” “Treating provider relationship,” and “Withdrawal management.” Some of these new definitions replace existing definitions. In addition, we propose to revise the regulatory text to use terminology in a consistent manner.

In Section III.C., Applicability (§ 2.12), SAMHSA proposes to continue to apply the 42 CFR part 2 regulations to a program that is federally assisted and holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment, but, where currently paragraph (1) of the definition of “Program” does not apply to general medical facilities, SAMHSA now proposes that paragraph (1) would not apply to either general medical facilities or general medical practices. The proposed language goes on to clarify that paragraph (2) and (3) of the definition of Program would apply to “general medical facilities” and “general medical practices” under certain conditions. For example, an identified unit within a general medical facility or general medical practice will be subject to part 2 if it holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment, or if the primary function of medical personnel or other staff in the general medical facility or general medical practice is the provision of such services and they are identified as providing such services.

In Section III.D., Confidentiality Restrictions and Safeguards (§ 2.13), SAMHSA proposes to add a requirement that, upon request, patients who have included a general designation in the “To Whom” section of their consent form (see § 2.31) must be provided a list of entities to which their information has been disclosed pursuant to the general designation

re identified as providing such services.

In Section III.D., Confidentiality Restrictions and Safeguards (§ 2.13), SAMHSA proposes to add a requirement that, upon request, patients who have included a general designation in the “To Whom” section of their consent form (see § 2.31) must be provided a list of entities to which their information has been disclosed pursuant to the general designation.

In Section III.E., Security for Records (§ 2.16), SAMHSA proposes to clarify that this section requires both part 2 programs and other lawful holders of patient identifying information to have in place formal policies and procedures addressing security, including sanitization of associated media, for both paper and electronic records.

In Section III.F., Disposition of Records by Discontinued Programs (§ 2.19), we propose to address both paper and electronic records. SAMHSA also is proposing to add requirements for sanitizing associated media.

In Section III.G., Notice to Patients of Federal Confidentiality Requirements (§ 2.22), we propose to clarify that the written summary of federal law and regulations may be provided to patients in either paper or electronic format. SAMHSA also proposes to require the statement regarding the reporting of violations include contact information for the appropriate authorities.

In Section III.H., Consent Requirements (§ 2.31), SAMHSA is proposing to allow, in certain circumstances, a patient to include a general designation in the “To Whom” section of the consent form, in conjunction with requirements that: (1) The consent form include an explicit description of the amount and kind of substance use disorder treatment information that may be disclosed; and (2) the “From Whom” section of the consent form specifically name the part 2 program or other lawful holder of the patient identifying information permitted to make the disclosure

” section of the consent form, in conjunction with requirements that: (1) The consent form include an explicit description of the amount and kind of substance use disorder treatment information that may be disclosed; and (2) the “From Whom” section of the consent form specifically name the part 2 program or other lawful holder of the patient identifying information permitted to make the disclosure. SAMHSA also is proposing to require the part 2 program or other lawful holder of patient identifying information to include a statement on the consent form that the patient understands the terms of their consent and, when using a general designation in the “To Whom” section of the consent form, that they have a right to obtain, upon request, a list of entities to which their information has been disclosed pursuant to the general designation (see § 2.13). In addition, SAMHSA is proposing to permit electronic signatures to the extent that they are not prohibited by any applicable law.

In Section III.I., Prohibition on Re-disclosure (§ 2.32), we propose to clarify that the prohibition on re-disclosure only applies to information that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder, such as indicated through standard medical codes, descriptive language, or both, and allows other health-related information shared by the part 2 program to be re-disclosed, if permissible under other applicable laws.

In Section III.J., Disclosures to Prevent Multiple Enrollments (§ 2.34), we propose to modernize the terminology and definitions and move the definitions to § 2.11, Definitions.

In Section III.K., Medical Emergencies (§ 2.51), we propose to revise the medical emergency exception to make it consistent with the statutory language and to give providers more discretion to determine when a “bona fide medical emergency” exists

ures to Prevent Multiple Enrollments (§ 2.34), we propose to modernize the terminology and definitions and move the definitions to § 2.11, Definitions.

In Section III.K., Medical Emergencies (§ 2.51), we propose to revise the medical emergency exception to make it consistent with the statutory language and to give providers more discretion to determine when a “bona fide medical emergency” exists.

In Section III.L., Research (§ 2.52), SAMHSA proposes to revise the research exception to permit data protected by 42 CFR part 2 to be disclosed to qualified personnel for the purpose of conducting scientific research by a part 2 program or any other individual or entity that is in lawful possession of part 2 data if the researcher provides documentation of meeting certain requirements related to other existing protections for human research. SAMHSA also is proposing to address data linkages to enable researchers holding part 2 data to link to data sets from federal data repositories, and is seeking comment on expanding this provision to non-federal data repositories.

We propose, in Section III.M., Audit and Evaluation (§ 2.53), to modernize the requirements to include provisions for governing both paper and electronic patient records. SAMHSA also proposes to permit an audit or evaluation necessary to meet the requirements of a Centers for Medicare & Medicaid Services (CMS)-regulated accountable care organization (CMS-regulated ACO) or similar CMS-regulated organization (including a CMS-regulated Qualified Entity (QE)), under certain conditions.

C. Summary of Impacts

Our goal in modernizing the part 2 regulations is to increase opportunities for individuals with substance use disorders to participate in new and emerging health and health care models and health information technology (IT)

e organization (CMS-regulated ACO) or similar CMS-regulated organization (including a CMS-regulated Qualified Entity (QE)), under certain conditions.

C. Summary of Impacts

Our goal in modernizing the part 2 regulations is to increase opportunities for individuals with substance use disorders to participate in new and emerging health and health care models and health information technology (IT). Our intent is to facilitate the sharing of information within the health care system to support new models of integrated health care which, among other things, improve patient safety while maintaining or strengthening privacy protections for individuals seeking treatment for substance use disorders. We expect the proposed changes to 42 CFR part 2 to result in a decrease in the burdens associated with several aspects of this rule, including consent requirements. Moreover, as patients are allowed, in certain circumstances, to include a general designation in the “To Whom” section of the consent form, we anticipate there e.g., health information exchanges (HIEs)) and organizations that coordinate care ( e.g., accountable care organizations (ACOs) and coordinated care organizations (CCOs)), leading to increased efficiency and quality in the provision of health care for this population.

When estimating the total costs associated with changes to the 42 CFR part 2 regulations, we assumed five sets of costs: Updates to health IT system costs, costs for staff training and updates to training curricula, costs to update patient consent forms, costs associated with providing patients a list of entities to which their information has been disclosed pursuant to a general designation on the consent form ( i.e., the List of Disclosures requirement), and implementation costs associated with the List of Disclosure requirements

h IT system costs, costs for staff training and updates to training curricula, costs to update patient consent forms, costs associated with providing patients a list of entities to which their information has been disclosed pursuant to a general designation on the consent form ( i.e., the List of Disclosures requirement), and implementation costs associated with the List of Disclosure requirements. We assumed that costs associated with modifications to existing health IT systems, staff training costs associated with updating staff training materials, and costs to update consent forms would be one-time costs the first year the final rule is in effect and would not carry forward into future years. Staff training costs other than those associated with updating training materials are assumed to be ongoing annual costs to part 2 programs, also beginning in the first year that the final rule is in effect. The List of Disclosures costs are assumed to be ongoing annual costs to entities named on a consent form that disclose patient identifying information to their participants under the general designation. The List of Disclosures requirement, however, does not go into effect until two years after the final rule is in effect. Therefore, in years 1 and 2, the costs associated with the List of Disclosures provision are limited to implementation costs for entities that chose to upgrade their health IT systems in order to comply with the List of Disclosure requirements.

We estimate, therefore, that in the first year that the final rule is in effect, the costs associated with updates to 42 CFR part 2 would be $74,217,979. In year two, we estimate that costs would be $47,021,182. In years 3 through 10, we estimate the annual costs would be $14,835,444. Over the 10-year period 2015-2024, the total undiscounted cost of the proposed changes would be $239,922,716 in 2015 dollars

e, therefore, that in the first year that the final rule is in effect, the costs associated with updates to 42 CFR part 2 would be $74,217,979. In year two, we estimate that costs would be $47,021,182. In years 3 through 10, we estimate the annual costs would be $14,835,444. Over the 10-year period 2015-2024, the total undiscounted cost of the proposed changes would be $239,922,716 in 2015 dollars. When future costs are discounted at 3 percent or 7 percent per year, the total costs become approximately $220.9 million or $200.9 million, respectively.

Based on data from the 2013 National Survey of Substance Abuse Treatment Services (N-SSATS), we estimate that 12,034 hospitals, outpatient treatment centers, and residential treatment facilities are covered by part 2. N-SSATS is an annual survey of U.S. substance abuse treatment facilities. Data is collected on facility location, characteristics, and service utilization. Not all treatment providers included in N-SSATs are believed to be under the jurisdiction of the part 2 regulations. The 12,034 number is a subset of the 14,148 substance abuse treatment facilities that responded to the 2013 N-SSATS, and includes all federally operated facilities, facilities that reported receiving public funding other than Medicare and Medicaid, facilities that reported accepting Medicare, Medicaid, TRICARE, and/or Access to Recovery (ATR) voucher payments, or were SAMHSA-certified Opioid Treatment Programs

mber is a subset of the 14,148 substance abuse treatment facilities that responded to the 2013 N-SSATS, and includes all federally operated facilities, facilities that reported receiving public funding other than Medicare and Medicaid, facilities that reported accepting Medicare, Medicaid, TRICARE, and/or Access to Recovery (ATR) voucher payments, or were SAMHSA-certified Opioid Treatment Programs.

If an independently practicing clinician does not meet the requirements of paragraph (1) of the definition of Program (an individual or entity (other than a general medical facility or general medical practice) who holds itself out as providing and provides substance use disorder diagnosis, treatment or referral for treatment), they may be subject to 42 CFR part 2 if they constitute an identified unit within a general medical facility or general medical practice which holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment, or if their primary function in the facility or practice is the provision of such services and they are identified by the facility or practice as providing such services. Due to data limitations, it was not possible to estimate the costs for independently practicing providers covered by part 2 that did not participate in the 2013 N-SSATS. For example, data from the American Board of Addiction Medicine (ABAM) provides the number of physicians since 2000, who have active ABAM certification. However, there is no source for the number of physicians who have not participated in the ABAM certification process. In addition, it is not possible to determine which ABAM-certified physicians practice in a general medical setting rather than in a specialty treatment facility that was already counted in the N-SSATS data.

Several provisions in the Notice of Proposed Rulemaking (NPRM) reference other lawful holders of patient identifying information in combination with part 2 programs

BAM certification process. In addition, it is not possible to determine which ABAM-certified physicians practice in a general medical setting rather than in a specialty treatment facility that was already counted in the N-SSATS data.

Several provisions in the Notice of Proposed Rulemaking (NPRM) reference other lawful holders of patient identifying information in combination with part 2 programs. These other lawful holders must comply with part 2 requirements with respect to information they maintain that is covered by part 2 regulations. However, because this group is not clearly defined with respect to the range of organizations it may include, we are unable to include estimates regarding the number and type of these organizations and are only including part 2 programs in this analysis.

In addition to the part 2 programs described above, entities named on a consent form that disclose patient identifying information to their participants under the general designation must provide patients, upon request, a list of entities to which their information has been disclosed pursuant to a general designation. These entities primarily would include organizations that facilitate the exchange of health information ( e.g., HIEs), and also may include organizations responsible for care coordination ( e.g., ACOs, CCOs, and patient-centered medical homes (sometimes called health homes)). While these types of organizations were the primary focus of this provision on the consent form, other types of entities, such as research institutions, also may disclose patient identifying information to their participants ( e.g., clinical researchers) pursuant to the general designation on the consent form. Because there are no definitive data sources for this potential range of organizations, we are not associating List of Disclosures requests with any particular type of organization

orm, other types of entities, such as research institutions, also may disclose patient identifying information to their participants ( e.g., clinical researchers) pursuant to the general designation on the consent form. Because there are no definitive data sources for this potential range of organizations, we are not associating List of Disclosures requests with any particular type of organization. Instead, we chose to estimate the number of organizations that must respond to List of Disclosures requests based on the total number of requests each year.

II. Background

A. Significant Technology Changes

Since the promulgation of 42 CFR part 2, significant technology changes have impacted the delivery of health care. The Office of the National Coordinator for Health Information Technology (ONC) was established as an office within the Department of Health and Human Services (HHS) under Executive Order 13335 on April 27, 2004. Subsequently, on February 17, 2009, the Health Information Technology for Economic and Clinical Health Act (HITECH Act) of the American Recovery and Reinvestment Act of 2009 (ARRA) (Pub. L. 111-5) expanded the Department's health IT work, including the expansion of ONC's authority and the provision of federal funds for ONC's activities consistent with the

SAMHSA has played a role in encouraging the use of health IT by behavioral health (substance use disorders and mental health) providers. SAMHSA's efforts included collaborating with ONC to develop two sets of Frequently Asked Questions and convening a number of stakeholder meetings to provide guidance on the application of 42 CFR part 2 within HIE models. In addition, SAMHSA funded a one-year pilot project in 2012 with five state HIEs to support the exchange of health information among behavioral health and physical health providers. SAMHSA also worked with ONC and other federal agencies on several projects to support behavioral health and health information exchange

eetings to provide guidance on the application of 42 CFR part 2 within HIE models. In addition, SAMHSA funded a one-year pilot project in 2012 with five state HIEs to support the exchange of health information among behavioral health and physical health providers. SAMHSA also worked with ONC and other federal agencies on several projects to support behavioral health and health information exchange.

The Data Segmentation for Privacy (DS4P) initiative within ONC's Standards and Interoperability (S&I) Framework facilitated the development of standards to improve the interoperability of EHRs containing sensitive information that must be protected to a greater degree than other health information due to 42 CFR part 2 and similar state laws. The DS4P initiative met its two goals, which were to: Demonstrate how standards can be used to support current privacy policies for sharing sensitive health information across organizational boundaries; and develop standards that will enable sensitive electronic health information to flow more freely to authorized users while improving the ability of health IT systems to implement current privacy protection requirements for certain types of health care data, such as substance use disorder patient records. The S&I Framework is a collaborative community of contributors from the public and private sectors who are focused on providing the tools, services, and guidance to facilitate the electronic exchange of health information. The DS4P initiative involved 344 volunteers, including, but not limited to, federal and state government agencies, behavioral health providers, EHR and other IT companies, health information exchanges, patient advocacy groups, professional societies/associations, consultants, health systems, health insurers, and universities.

Through the DS4P initiative, federal and community stakeholders developed standards and guidelines for enabling data segmentation and managing patient consent preferences

ment agencies, behavioral health providers, EHR and other IT companies, health information exchanges, patient advocacy groups, professional societies/associations, consultants, health systems, health insurers, and universities.

Through the DS4P initiative, federal and community stakeholders developed standards and guidelines for enabling data segmentation and managing patient consent preferences. The technical approach outlined in the DS4P Implementation Guide (IG) is based on the experience of the six pilot projects and the solutions they developed to meet the DS4P project requirements. The DS4P IG is an American National Standards Institute (ANSI) approved standard. It was also voted on and approved at the highest level to become what Health Level 7 (HL7) calls a normative standard (a foundational part of the technology needed to meet the global challenge of integrating health care information). The HL7 balloting process included 155 stakeholders, including HL7 affiliates, vendors, consultants, payers, providers, non-profit organizations, and federal government representatives. The HL7 standard is the currently acceptable standard for data segmentation and consent management. In addition, it is in compliance with 42 CFR part 2.

The six DS4P IG use case pilot projects that were conducted in accordance with ONC's S&I Framework included the Department of Veterans Affairs (VA)/Substance Abuse and Mental Health Services Administration (SAMHSA) Pilot. The VA/SAMHSA Pilot implemented all the DS4P use cases and passed all conformance tests. The VA/SAMHSA Pilot was also the first application to show that managing consents and patient directives, as well as segmenting structured data in a patient record, can be done. SAMHSA used these DS4P standards to develop the application branded Consent2Share, an open-source health IT solution which assists in consent management and data segmentation

S4P use cases and passed all conformance tests. The VA/SAMHSA Pilot was also the first application to show that managing consents and patient directives, as well as segmenting structured data in a patient record, can be done. SAMHSA used these DS4P standards to develop the application branded Consent2Share, an open-source health IT solution which assists in consent management and data segmentation. Consent2Share validates that the DS4P IG can be used to build a production-based application to manage the patient consent lifecycle electronically. The Consent2Share software is currently being used by the Prince Georges County (Maryland) Health Department to manage patient consent directives while sharing substance use disorder information with an HIE. While this technology is not perfect, it provides a foundational standard and shows promise for sharing substance use disorder information while complying with 42 CFR part 2.

Notwithstanding these efforts, SAMHSA is aware that technology adoption is an ongoing process and the majority of current EHR and HIE applications may not have the capability to support the DS4P initiative. In addition, paper records are still used today in some part 2 programs and shared through facsimile (FAX). Despite SAMHSA's efforts to clarify the part 2 regulations through guidance and to demonstrate that exchange of sensitive health information can be accomplished through pilot projects that adhere to the regulations, some stakeholders continued to request modernization of 42 CFR part 2. These stakeholders are concerned that part 2, as currently written, continues to be a barrier to the integration of substance use disorder treatment and physical health care. For example, some substance use disorder treatment centers cannot participate in integrated care models because they have not implemented data segmentation and consent management functionalities necessary to comply with the part 2 rules

holders are concerned that part 2, as currently written, continues to be a barrier to the integration of substance use disorder treatment and physical health care. For example, some substance use disorder treatment centers cannot participate in integrated care models because they have not implemented data segmentation and consent management functionalities necessary to comply with the part 2 rules. Further, under the current regulations, the part 2 program director is the only individual authorized to release of information for scientific research purposes. In addition, under the current regulatory framework, absent consent, organizations that store patient health data, including data that are subject to part 2, do not have the authority to disclose part 2 data for scientific research purposes to qualified researchers or research organizations. This could hinder a full understanding of impacts of treatment for addiction and other health issues. Finally, some stakeholders continue to request modernization of the part 2 rules, in media and other public and private forums.

B. Statutory and Rulemaking History

The Confidentiality of Alcohol and Drug Abuse Patient Records regulations, 42 CFR part 2, implement section 543 of the Public Health Service Act, 42 United States Code (U.S.C.) § 290dd-2, as amended by section 131 of the Alcohol, Drug Abuse and Mental Health Administration Reorganization Act (ADAMHA Reorganization Act), Pub. L. 102-321 (July 10, 1992). The regulations were promulgated as a final rule on July 1, 1975 (40 FR 27802). In 1980, the Department invited public comment on 15 substantive issues arising out of its experience interpreting and implementing the regulations (45 FR 53). More than 450 public responses to that invitation were received and taken into consideration in the preparation of a 1983 NPRM (48 FR 38758). Approximately 150 comments were received in response to the NPRM and were taken into consideration in the preparation of the final rule released on June 9, 1987 (52 FR 21798)

ing out of its experience interpreting and implementing the regulations (45 FR 53). More than 450 public responses to that invitation were received and taken into consideration in the preparation of a 1983 NPRM (48 FR 38758). Approximately 150 comments were received in response to the NPRM and were taken into consideration in the preparation of the final rule released on June 9, 1987 (52 FR 21798).

The Department published a NPRM again in the Federal Register (FR) on August 18, 1994 (59 FR 42561), which proposed a clarification of the definition of “Program” in the regulations. Specifically, the Department proposed to clarify that, as to general medical care facilities, these regulations cover only specialized individuals or units in such facilities that hold themselves out as providing and provide alcohol or drug abuse diagnosis, treatment, or referral for treatment and which are federally assisted, directly or indirectly. On May 5, 1995, the final rule was released (60 FR 22296).

SAMHSA posted a document in the Federal Register on May 12, 2014, (79 FR 26929) announcing a public Listening Session planned for June 11, 2014, to solicit feedback on the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, 42 CFR part 2. SAMHSA accepted written comments until June 25, 2014.

In the Federal Register notification for the public Listening Session (79 FR 26929), SAMHSA invited general comments, as well as comments on six key provisions of 42 CFR part 2: Applicability, Consent requirements, Re-disclosure, Medical emergency, QSO, and Research. In addition, SAMHSA solicited input on electronic prescribing and Prescription Drug Monitoring Programs (PDMPs), areas that could potentially impact part 2 programs. Approximately 1,800 individuals participated in the listening session, either in person or by phone. During the session, 112 oral comments were made, while another 635 written comments were submitted during the written comment period

In addition, SAMHSA solicited input on electronic prescribing and Prescription Drug Monitoring Programs (PDMPs), areas that could potentially impact part 2 programs. Approximately 1,800 individuals participated in the listening session, either in person or by phone. During the session, 112 oral comments were made, while another 635 written comments were submitted during the written comment period. The Listening Session comments are posted on the SAMHSA Web site at http://www.samhsa.gov/about-us/who-we-are/laws-regulations/public-comments-confidentiality-regulations. In general, commenters supported updating the regulations or opposed it. Some commenters proposed aligning 42 CFR part 2 with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulations. However, due to its targeted population, part 2 provides more stringent federal protections than most other health privacy laws, including HIPAA. We are choosing not to address any specific comments or summarize comments in detail in this proposed rule. However, all the feedback received from the Listening Session was considered and helped to inform the development of this NPRM. In addition, SAMHSA collaborated with its federal partner experts in developing this NPRM.

SAMHSA decided not to address issues pertaining to e-prescribing and PDMPs in this NPRM. SAMHSA concluded that the part 2 program e-prescribing and PDMPs are not ripe for rulemaking at this time due to the state of technology and because the majority of part 2 programs are not prescribing controlled substances electronically. SAMHSA intends to monitor developments in this area to see whether further action may be warranted in the future.

III. Provisions of This Proposed Rule

The intent of this NPRM is to propose revisions to key provisions of 42 CFR part 2 to modernize the regulations adopted in the June 1987 final rule and amended by the May 1995 final rule

are not prescribing controlled substances electronically. SAMHSA intends to monitor developments in this area to see whether further action may be warranted in the future.

III. Provisions of This Proposed Rule

The intent of this NPRM is to propose revisions to key provisions of 42 CFR part 2 to modernize the regulations adopted in the June 1987 final rule and amended by the May 1995 final rule. This modernization is necessary because behavioral health, including substance use disorder treatment, is essential to overall health; the costs of untreated substance use disorders, both personal and societal, are substantial; and there continues to be a need for confidentiality protections that encourage patients to seek treatment without fear of compromising their privacy.

Individuals seeking treatment for substance use disorders often are met with a host of negative reactions including discrimination and harm to their reputations and relationships. In addition, there is a potential for serious civil and criminal consequences for the disclosure of patient identifying information associated with substance use disorders beyond the health care context. We are mindful of the intent of the governing statute (42 U.S.C. 290dd-2) and regulations at 42 CFR part 2, which is to protect the confidentiality of substance abuse patient records so as not to make an individual receiving treatment for a substance use disorder in a part 2 program more vulnerable by virtue of seeking treatment than an individual with a substance use disorder who does not seek treatment. SAMHSA strives to facilitate information exchange within new and emerging health and health care models, which promote integrated care and patient safety, while respecting the legitimate privacy concerns of patients seeking treatment for a substance use disorder due to the potential for discrimination, harm to their reputations and relationships, and serious civil and criminal consequences

atment. SAMHSA strives to facilitate information exchange within new and emerging health and health care models, which promote integrated care and patient safety, while respecting the legitimate privacy concerns of patients seeking treatment for a substance use disorder due to the potential for discrimination, harm to their reputations and relationships, and serious civil and criminal consequences. SAMHSA also is mindful that any regulatory changes contemplated must be consistent with the authorizing legislation (42 U.S.C. 290dd-2) and its statutory intent.

This proposed rule also proposes editorial changes. SAMHSA deleted references to 42 U.S.C. 290ee-3 and 42 U.S.C. 290dd-3 in § 2.1, Statutory authority for confidentiality of drug abuse patient records, and § 2.2, Statutory authority for confidentiality of alcohol abuse patient records. Sections 290dd-3 and 290ee-3 were omitted by Public Law 102-321 and combined and renamed into Sections 290dd-2, Confidentiality of records. We also combined §§ 2.1 and 2.2 and propose to rename the new § 2.1 (Statutory authority for confidentiality of substance abuse patient records) and re-designate §§ 2.2-2.5. In addition, we deleted references to laws and regulations that have been repealed in § 2.21. Finally, we made editorial changes throughout the regulations to increase clarity and consistency.

Along with proposing substantive revisions to various sections of 42 CFR part 2, SAMHSA has proposed a number of technical, non-substantive changes for clarity and consistency that are reflected throughout the regulations. For the convenience of the public, SAMHSA is reprinting the text of 42 CFR part 2 in its entirety, which includes the proposed modifications incorporated into the existing provisions. SAMHSA, however, is only seeking comment on the proposed changes to the regulations that are discussed in the preamble of this NPRM. Sections of 42 CFR part 2 that have not been proposed for revision are not subject to review or comment under this NPRM.

A

is reprinting the text of 42 CFR part 2 in its entirety, which includes the proposed modifications incorporated into the existing provisions. SAMHSA, however, is only seeking comment on the proposed changes to the regulations that are discussed in the preamble of this NPRM. Sections of 42 CFR part 2 that have not been proposed for revision are not subject to review or comment under this NPRM.

A. Reports of Violations (§ 2.4)

1. Overview

In the current regulations, methadone programs are required to report violations of these regulations to the FDA.

2. Proposed Revisions

We propose to revise the requirement (§ 2.5(b)) of reporting violations of these regulations by a methadone program to the FDA. The authority over methadone programs (now referred to as opioid treatment programs) was transferred from the FDA to SAMHSA in 2001 (66 FR 4076). Suspected violations of 42 CFR part 2 by opioid treatment programs may be reported to the U.S. Attorney's Office for the judicial district in which the violation occurred, as well as the SAMHSA office responsible for opioid treatment program oversight.

B. Definitions (§ 2.11)

1. Overview

Certain defined terms in the current regulations are used inconsistently. SAMHSA also received inquiries regarding certain terms and how they apply to new health care models. In addition, the current regulations include definitions in four different sections (§§ 2.11, 2.12, 2.14 and 2.34).

2. Proposed Revisions

SAMHSA proposes to consolidate all of the definitions, with the exception the definition of the term “Federally assisted,” in a single section at § 2.11. SAMHSA proposes to retain the definition of the term “Federally assisted” in the Applicability provision at § 2.12 for the purpose of clarity because it is key to understanding the applicability of 42 CFR part 2. We encourage readers to review all of the definitions, since a clear understanding of the regulations builds on an understanding of the definitions and their inter-relationships.

a. New Definitions

i

to retain the definition of the term “Federally assisted” in the Applicability provision at § 2.12 for the purpose of clarity because it is key to understanding the applicability of 42 CFR part 2. We encourage readers to review all of the definitions, since a clear understanding of the regulations builds on an understanding of the definitions and their inter-relationships.

a. New Definitions

i. Part 2 Program

The current regulations define “Federally assisted” separately from the term “Program” but do not define the term “Part 2 program.” In addition, the terms “Program” and “federally assisted alcohol or drug abuse program” are used interchangeably. Therefore, SAMHSA proposes to define a “Part 2 program” as a federally assisted program (federally assisted as defined in § 2.12(b) and program as defined in § 2.11). See § 2.12(e)(1) for examples.

We proposed to retain the examples provided in § 2.12(e)(1) of the current regulations, with a clarification, because they explain the part 2 applicability and coverage.

SAMHSA proposes to replace the term “Program” with “Part 2 program,” where appropriate. For example, we propose to revise the definition of QSO, including replacing “Program” with “Part 2 program,” which is discussed in depth below (see Section III.B.2.b., Existing Definitions). We also propose to replace “Program” with “Part 2 program” in several other definitions, while making no additional changes.

ii. Part 2 Program Director

Because of the addition of the “Part 2 program” definition, we also are proposing to define a “Part 2 program director” as:

• In the case of a part 2 program which is an individual, that individual, and

• In the case of a part 2 program which is an entity, the individual designated as director or managing director, or individual otherwise vested with authority to act as chief executive officer of the part 2 program.

We propose to delete the definition of “Program director.”

iii

e a “Part 2 program director” as:

• In the case of a part 2 program which is an individual, that individual, and

• In the case of a part 2 program which is an entity, the individual designated as director or managing director, or individual otherwise vested with authority to act as chief executive officer of the part 2 program.

We propose to delete the definition of “Program director.”

iii. Substance Use Disorder

SAMHSA proposes to refer to alcohol abuse and drug abuse collectively as “Substance use disorder” and, when referring to the authorizing statute, use “substance abuse” since that is the term used in Title 42, United States Code, Section 290dd-2. SAMHSA also uses the term “substance abuse” when referencing information from other publications that use that term. SAMHSA proposes to use the term “Substance use disorder” to be consistent with recognized classification manuals, current diagnostic lexicon, and commonly used descriptive terminology, and, for consistency, proposes to revise the title of 42 CFR part 2 from “Confidentiality of Alcohol and Drug Abuse Patient Records” to “Confidentiality of Substance Use Disorder Patient Records.”

While SAMHSA proposes to delete the definitions of “Alcohol abuse” and “Drug abuse,” we continue to use the terms “Alcohol abuse” and “Drug abuse” when referring to 42 U.S.C. 290dd-3 and 42 U.S.C. 290ee-3 (omitted by Pub. L. 102-321 and combined and renamed into Section 290dd-2), respectively, because they are the terms used in the outdated statutes. See § 2.11 of the current regulations for definitions of the terms “Alcohol abuse” and “Drug abuse”.

SAMHSA proposes to define the term “Substance use disorder” in such a manner as to cover substance use disorders that can be associated with altered mental status that has the potential to lead to risky and/or socially prohibited behaviors, including, but not limited to, substances such as, alcohol, cannabis, hallucinogens, inhalants, opioids, sedatives, hypnotics, anxiolytics, and stimulants

”.

SAMHSA proposes to define the term “Substance use disorder” in such a manner as to cover substance use disorders that can be associated with altered mental status that has the potential to lead to risky and/or socially prohibited behaviors, including, but not limited to, substances such as, alcohol, cannabis, hallucinogens, inhalants, opioids, sedatives, hypnotics, anxiolytics, and stimulants. In addition, SAMHSA proposes to clarify that, for the purposes of these regulations, the definition excludes both tobacco and caffeine.

iv. Treating Provider Relationship

As noted in more detail in Section III.H., Consent Requirements, SAMHSA has heard a number of concerns from stakeholders regarding the current consent requirements in § 2.31 of the regulations. SAMHSA is proposing to revise the consent requirements to permit, in certain circumstances, a more general description of the individuals or entities to which a disclosure is made, but only if the individuals or entities have a treating provider relationship with the patient whose information is being disclosed. This change, therefore, creates a need to define a treating provider relationship.

A treating provider relationship begins when an individual seeks health-related assistance from an individual or entity who may provide assistance. However, the relationship is clearly established when the individual or entity agrees to undertake diagnosis, evaluation and/or treatment of the patient, or consultation with the patient, and the patient agrees to be treated, whether or not there has been an actual in-person encounter between the individual or entity and patient

d assistance from an individual or entity who may provide assistance. However, the relationship is clearly established when the individual or entity agrees to undertake diagnosis, evaluation and/or treatment of the patient, or consultation with the patient, and the patient agrees to be treated, whether or not there has been an actual in-person encounter between the individual or entity and patient. A treating provider relationship with a patient may be established by a health care provider or another member of a health care team as long as the relationship meets the definition of “Treating provider relationship.”

A treating provider relationship means that, regardless of whether there has been an actual in-person encounter:

• A patient agrees to be diagnosed, evaluated and/or treated for any condition by an individual or entity, and

• The individual or entity agrees to undertake diagnosis, evaluation and/or treatment of the patient, or consultation with the patient, for any condition.

The term “agrees” as used in the definition does not necessarily imply a formal written agreement. An agreement might be evidenced, among other things, by making an appointment or by a telephone consultation.

v. Withdrawal Management

SAMHSA proposes to update the terminology in § 2.34. We propose to delete the definition of “Detoxification treatment” and replace it with the definition of the currently acceptable term, “Withdrawal management.” We also propose to move this definition from § 2.34 to § 2.11 to consolidate definitions in one section of the regulations.

b. Existing Definitions

SAMHSA proposes to update terminology in existing definitions to accurately convey the meaning of terms and increase the understandability of the proposed rule. In addition, SAMHSA proposes to consolidate all but one of the defined terms in § 2.11.

i. Central Registry

SAMHSA proposes to update the terminology in § 2.34 and move this

We are proposing to revise the definition to incorporate currently accepted terminology.

ii

ogy in existing definitions to accurately convey the meaning of terms and increase the understandability of the proposed rule. In addition, SAMHSA proposes to consolidate all but one of the defined terms in § 2.11.

i. Central Registry

SAMHSA proposes to update the terminology in § 2.34 and move this

We are proposing to revise the definition to incorporate currently accepted terminology.

ii. Disclose or Disclosure

We propose to define only one word, “Disclose,” since it is implied that the same definition applies to other forms of the word. We also propose to update terminology and make the definition clearer.

iii. Maintenance Treatment

SAMHSA proposes to update the terminology in § 2.34 and move this definition from § 2.34 to § 2.11 to consolidate definitions.

iv. Member Program

SAMHSA proposes to update the terminology in § 2.34 and move this definition from § 2.34 to § 2.11 to consolidate definitions.

v. Patient

To emphasize that the term “Patient” refers to both current and former patients, SAMHSA proposes to revise the definition to provide that a patient is any individual who has applied for or been given diagnosis, treatment, or referral for treatment for a substance use disorder at a part 2 program. Patient includes any individual who, after arrest on a criminal charge, is identified as an individual with a substance use disorder in order to determine that individual's eligibility to participate in a part 2 program. This definition includes both current and former patients.

vi. Patient Identifying Information

SAMHSA proposes to clarify that “Patient,” as used in this definition, is a defined term in § 2.11. In addition, SAMHSA deleted the words “and speed.” If the information could identify the patient, the speed with which it identifies the patient is not relevant.

vii. Person

The current definition of “Person” includes both individuals and entities. For the purpose of this proposed regulation, SAMHSA considers an “individual” to be a human being

in this definition, is a defined term in § 2.11. In addition, SAMHSA deleted the words “and speed.” If the information could identify the patient, the speed with which it identifies the patient is not relevant.

vii. Person

The current definition of “Person” includes both individuals and entities. For the purpose of this proposed regulation, SAMHSA considers an “individual” to be a human being. SAMHSA proposes to revise the definition of “Person” to clearly indicate that “Person” is also referred to as individual and/or entity.

viii. Program

SAMHSA is proposing to make the following changes to the “Program” definition. First, because the current definition of “Program” includes both the terms “general medical care facility” and “general medical facility,” and because these terms are used interchangeably, we are proposing to consistently use the term “general medical facility.”

Second, more substance use disorder treatment services are occurring in general health care and integrated care settings, which are typically not covered under the current regulations. Providers who in the past offered only general or specialized health care services (other than substance use disorder services) now, on occasion, provide substance use disorder treatment services, but only as incident to the provision of general health care. Therefore, SAMHSA proposes to make clear that paragraph (1) of the definition of “Program” would not apply to “general medical facilities” and “general medical practices.” However, paragraphs (2) and (3) of the definition of “Program” would apply to “general medical facilities” and “general medical practices.” Finally, SAMHSA is proposing to move the reference to examples from the definition of “Program” to the definition of “Part 2 program” because 42 CFR part 2 would apply only to “Part 2 programs” as defined in the proposed regulations

general medical practices.” However, paragraphs (2) and (3) of the definition of “Program” would apply to “general medical facilities” and “general medical practices.” Finally, SAMHSA is proposing to move the reference to examples from the definition of “Program” to the definition of “Part 2 program” because 42 CFR part 2 would apply only to “Part 2 programs” as defined in the proposed regulations.

The inclusion of general medical practices with general medical facilities is consistent with SAMHSA's intention to ensure confidentiality protections and access to treatment for individuals whose identity as substance use disorder patients would be compromised if records of the specialized programs from which they seek treatment were not covered by these regulations while not unnecessarily imposing requirements on general medical facilities or practices in an overly broad manner.

Consistent with the definition of “Program”:

1. If a provider is not a general medical facility or general medical practice, then the provider meets the part 2 definition of a “Program” if it is an individual or entity who holds itself out as providing, and provides substance use disorder diagnosis, treatment, or referral for treatment.

2. If the provider is an identified unit within a general medical facility or general medical practice, it is a “Program” if it holds itself out as providing, and provides, substance use disorder diagnosis, treatment or referral for treatment.

3. If the provider consists of medical personnel or other staff in a general medical facility or general medical practice, it is a “Program” if its primary function is the provision of substance use disorder diagnosis, treatment, or referral for treatment and is identified as such specialized medical personnel or other staff by the general medical facility or general medical practice

treatment.

3. If the provider consists of medical personnel or other staff in a general medical facility or general medical practice, it is a “Program” if its primary function is the provision of substance use disorder diagnosis, treatment, or referral for treatment and is identified as such specialized medical personnel or other staff by the general medical facility or general medical practice.

While the term “general medical facility” is not defined at 42 CFR 2.11 (Definitions), hospitals, trauma centers, or federally qualified health centers would generally be considered “general medical facilities.” Therefore, primary care providers who work in such facilities would only be covered by the part 2 definition of a “Program” if: (1) They work in an identified unit within such general medical facility that holds itself out as providing, and provides, substance use disorder diagnosis, treatment or referral for treatment, or (2) the primary function of the providers is substance use disorder diagnosis, treatment or referral for treatment and they are identified as providers of such services by the general medical facility.

In addition, a practice comprised of primary care providers could be considered a “general medical practice.” As such, an identified unit within that general medical practice that holds itself out as providing and provides substance use disorder diagnosis, treatment, or referral for treatment would be considered a “Program” as defined in § 2.11 of these regulations. In addition, medical personnel or staff within that general medical practice whose primary function is the provision of substance use disorder services and who are identified as such providers by the general medical practice would qualify as a “Program” under the definition in these part 2 regulations.

Finally, “Holds itself out” is currently not defined in § 2.11, Definitions

these regulations. In addition, medical personnel or staff within that general medical practice whose primary function is the provision of substance use disorder services and who are identified as such providers by the general medical practice would qualify as a “Program” under the definition in these part 2 regulations.

Finally, “Holds itself out” is currently not defined in § 2.11, Definitions. SAMHSA has previously published guidance relative to the term and proposes to add an explanation of “Holds itself out” to the Preamble discussion in § 2.12, Applicability. Consistent with that guidance, “Holds itself out” means any activity that would lead one to reasonably conclude that the individual or entity provides substance use disorder diagnosis, treatment, or referral for treatment including but not limited to:

• Authorization by the state or federal government ( e.g. licensed, certified, registered) to provide, and provides, such services,

• Advertisements, notices, or statements relative to such services, or

• Consultation activities relative to such services.

As is the case throughout these regulations, understanding all defined terms is important. In the case of the definition of “Program” and how it

ix. Qualified Service Organization

A qualified service organization (QSO) is an individual or entity (see definition of “Person,” above) that provides a service to a part 2 program consistent with a qualified service organization agreement (QSOA). A QSOA is a two-way agreement between a part 2 program and the individual or entity providing the desired service. Under the current statutory authority, patient records pertaining to substance abuse may be shared only with the prior written consent of the patient or under a few limited exceptions that are specifically enumerated in 42 U.S.C. 290dd-2

ualified service organization agreement (QSOA). A QSOA is a two-way agreement between a part 2 program and the individual or entity providing the desired service. Under the current statutory authority, patient records pertaining to substance abuse may be shared only with the prior written consent of the patient or under a few limited exceptions that are specifically enumerated in 42 U.S.C. 290dd-2. However, § 2.12(c)(4) indicates that these restrictions on disclosure do not apply to communications between a part 2 program and a QSO regarding information needed by the QSO to provide services to the part 2 program consistent with the QSOA. Accordingly, SAMHSA has consistently articulated in applicable guidance that a QSO would be permitted to disclose the part 2 information to a contract agent if it needs to do so in order to provide the services described in the QSOA, and as long as the agent only discloses the information back to the QSO or the part 2 program from which the information originated. If a disclosure is made by the QSO to an agent acting on its behalf to perform the service, both the QSO and the agent are bound by the part 2 regulations, and neither organization can disclose the information except as permitted by part 2 and SAMHSA's interpretive guidance.

Recognizing the importance of population health management, SAMHSA proposes to revise the definition of QSO to include population health management in the list of examples of services a QSO may provide. Population health management refers to increasing desired health outcomes and conditions through monitoring and identifying individual patients within a group. To achieve the best outcomes, providers must supply proactive, preventive, and chronic care to all of their patients, both during and between encounters with the health care system. For patients with substance use disorders, who often have comorbid conditions, proactive, preventive, and chronic care is important to achieving desired outcomes

ring and identifying individual patients within a group. To achieve the best outcomes, providers must supply proactive, preventive, and chronic care to all of their patients, both during and between encounters with the health care system. For patients with substance use disorders, who often have comorbid conditions, proactive, preventive, and chronic care is important to achieving desired outcomes.

Any QSOA executed between a part 2 program and an organization providing population health management services would be limited to the office or unit responsible for population health management in the organization ( e.g., the ACO, CCO, patient-centered medical home (sometimes called health home), or managed care organization), not the entire organization and not its participants ( e.g., case managers, physicians, addiction counselors, hospitals, and clinics). Once a QSOA is in place, 42 CFR part 2 permits the part 2 program to communicate information from patients' records to the organization providing population health management services as long as it is limited to information needed by the organization to provide such services to the part 2 program. An organization providing population health management services may disclose part 2 information that it has received from a part 2 program to its participants (other than the originating part 2 program) only if the patient signs a part 2-compliant consent form agreeing to those disclosures.

SAMHSA's proposal to add population health management to the list of examples of the services that may be offered by a QSO is consistent with the Affordable Care Act (Patient Protection and Affordable Care Act of 2010 (Pub. L. 111-148)) and the HHS Strategic Plan FY 2014-2018 which includes the goals of improving health care and population health through meaningful use of health IT. We believe this revision would benefit patients' health, safety, and quality of life while maintaining the confidentiality protections that attach to the part 2 program's patient records

nt Protection and Affordable Care Act of 2010 (Pub. L. 111-148)) and the HHS Strategic Plan FY 2014-2018 which includes the goals of improving health care and population health through meaningful use of health IT. We believe this revision would benefit patients' health, safety, and quality of life while maintaining the confidentiality protections that attach to the part 2 program's patient records.

SAMHSA also proposes to revise the term “medical services” as listed in the examples of permissible services offered by a QSO to clarify that it is limited to “medical staffing services.” SAMHSA proposes to make this revision to emphasize that QSOAs should not be used to avoid obtaining patient consent. Accordingly, a QSOA could be used by a part 2 program to contract with a provider of on-call coverage services (previously clarified in guidance) or other medical staffing services but could not be used to disclose John Doe's patient identifying information to his primary care doctor for the purpose of treatment (other than that provided under a QSOA for medical staffing services). However, an individual or entity who is prohibited from providing treatment to an individual patient under a QSOA, may still meet the requirements of having a treating provider relationship (based on the definition in § 2.11) with respect to the Consent Requirements in § 2.31. Likewise, care coordination was not added to the list of examples of permissible services offered by a QSO because care coordination has a patient treatment component.

x. Records

Consistent with the goal of modernizing the regulations, SAMHSA proposes to revise the definition of “ Records ” to include any information, whether recorded or not, received or acquired by a part 2 program relating to a patient. For the purpose of these regulations, records include both paper and electronic records.

xi. Treatment

As part of its effort to modernize these regulations, SAMHSA is proposing to delete the term, “management,” from the “Treatment” definition

revise the definition of “ Records ” to include any information, whether recorded or not, received or acquired by a part 2 program relating to a patient. For the purpose of these regulations, records include both paper and electronic records.

xi. Treatment

As part of its effort to modernize these regulations, SAMHSA is proposing to delete the term, “management,” from the “Treatment” definition. In today's health care environment, “management” has a much broader meaning than it did when the regulations were last revised.

c. Terminology Changes

In addition to proposing changes to several definitions, we propose the following terminology changes. These changes are intended to ensure consistency in the use of terms throughout the regulations, and to increase the understandability of the proposed rule.

The current regulations use a variety of terms to refer to law enforcement ( e.g., “office,” “agency or official,” and “authorities”) as well as using related terms ( e.g., “persons or individuals within the criminal justice system”. We propose to consistently refer to law enforcement as “law enforcement agencies or officials.” In addition, the current regulations use the terms “organization” and “entity.” Neither term is defined but “entity” is included in both the definition of “Program” and “Person.” For this reason, we propose to use the term “entity” instead of “organization” wherever possible. Finally, because we have revised the definition of “Patient” to clarify that it includes both current and former patients, we have revised the grammar, where appropriate.

For the purposes of this regulation, we also propose that the term “written” include both paper and electronic documentation. In addition, we propose to use the phrase “part 2 program or other lawful holder of patient identifying information” to refer to a part 2 program or other individual or entity that is in lawful possession of patient identifying information

the grammar, where appropriate.

For the purposes of this regulation, we also propose that the term “written” include both paper and electronic documentation. In addition, we propose to use the phrase “part 2 program or other lawful holder of patient identifying information” to refer to a part 2 program or other individual or entity that is in lawful possession of patient identifying information. A

A patient who has obtained a copy of their records or a family member who has received such information from a patient would not be considered a “lawful holder of patient identifying information” in this context. As stated in § 2.23(a), the regulations do not prohibit a part 2 program from giving a patient access to their own records, including the opportunity to inspect and copy any records that the part 2 program maintains about the patient. The part 2 program is not required to obtain a patient's written consent or other authorization under these regulations in order to provide such access to the patient or their legal representative.

C. Applicability (§ 2.12)

1. Overview

The 1987 regulations (52 FR 21798) limited the applicability of 42 CFR part 2 to specialized programs, ( i.e., to those federally assisted programs that hold themselves out as providing and which actually provide alcohol or drug abuse diagnosis, treatment, and referral for treatment). HHS took the position that limiting the applicability to specialized programs would simplify the administration of the regulations without significantly affecting the incentive to seek treatment provided by the confidentiality protections. Applicability to specialized programs lessened the adverse economic impact on a substantial number of facilities that provided substance use disorder care only as an incident to the provision of general medical care.

2

cialized programs would simplify the administration of the regulations without significantly affecting the incentive to seek treatment provided by the confidentiality protections. Applicability to specialized programs lessened the adverse economic impact on a substantial number of facilities that provided substance use disorder care only as an incident to the provision of general medical care.

2. Proposed Revisions

SAMHSA considered options for defining what information is covered by 42 CFR part 2, including the option of defining covered information based on the type of substance use disorder treatment services provided instead of the type of facility providing the services. SAMHSA, however, rejected that approach because more substance use disorder treatment services are occurring in general health care and integrated care settings, which typically are not covered under the current regulations. Providers who in the past offered only general or specialized health care services (other than substance use disorder services) now, on occasion, provide substance use disorder treatment services, but only as incident to the provision of general health care.

As discussed in Section III.B.2.b., Existing Definitions, we propose to revise the definition of “Program” to align it more closely with current health care delivery models. SAMHSA proposes to make clear that paragraph (1) of the definition of “Program” would not apply to “general medical facilities” and “general medical practices.” However, paragraphs (2) and (3) of the definition of “Program” would apply to “general medical facilities” and “general medical practices.”

SAMHSA also proposes to include the term “Part 2 program,” as discussed in Section III.B.2.a.i. The definition of “Program” in § 2.11 did not explicitly include “Federally assisted as defined in § 2.12(b)”

medical facilities” and “general medical practices.” However, paragraphs (2) and (3) of the definition of “Program” would apply to “general medical facilities” and “general medical practices.”

SAMHSA also proposes to include the term “Part 2 program,” as discussed in Section III.B.2.a.i. The definition of “Program” in § 2.11 did not explicitly include “Federally assisted as defined in § 2.12(b)”. As a result, we are proposing to add a definition of “Part 2 program.” We propose to define the term and to use the term “Part 2 program,” where appropriate, throughout the proposed regulations.

This approach is consistent with the approach taken in 1987 because it essentially limits the applicability of 42 CFR part 2 to specialized programs, which simplifies the administration of the regulations without significantly affecting the incentive to seek treatment provided by the confidentiality protections. We do not foresee that the exclusion from part 2 coverage of health care providers who work in general medical practices and provide substance use disorder treatment services as incident to the provision of general health care would act as a deterrent to individuals seeking assistance for substance use disorders.

In addition, in the current regulation, § 2.12(d)(2)(iii), restrictions on disclosures apply to individuals or entities who have received patient records directly from part 2 programs. SAMHSA proposes to revise § 2.12(d)(2)(iii) so that restrictions on disclosures also apply to individuals or entities who receive patient records directly from other lawful holders of patient identifying information. This change is consistent with the discussion of “other lawful holder of patient identifying information” in the preamble discussion in Terminology Changes in Section III.B.2.c. and the proposed inclusion of this term in other sections of this NPRM

on disclosures also apply to individuals or entities who receive patient records directly from other lawful holders of patient identifying information. This change is consistent with the discussion of “other lawful holder of patient identifying information” in the preamble discussion in Terminology Changes in Section III.B.2.c. and the proposed inclusion of this term in other sections of this NPRM. Patient records subject to these regulations include patient records maintained by part 2 programs as well as those records in the possession of “other lawful holders of patient identifying information.”

D. Confidentiality Restrictions and Safeguards (§ 2.13)

1. Overview

Currently, 42 CFR part 2 does not include a way for patients to determine to whom their records have been disclosed.

2. Proposed Revisions

As discussed in Section G., Consent Requirements (§ 2.31), SAMHSA proposes to permit, in certain circumstances, the inclusion of a general designation in the “To Whom” section of the consent form. Specifically, in the case of an entity that does not have a treating provider relationship with the patient whose information is being disclosed, SAMHSA proposes to permit the designation of the name(s) of theentity(-ies) and a general designation of an individual or entity participant(s) or a class of participants that must be limited to those participants who have a treating provider relationship with the patient whose information is being disclosed. An entity without a treating provider relationship includes, for example, an entity that facilitates the exchange of health information ( e.g., HIE). The consent form, therefore, could designate the HIE (an entity that does not have a treating provider relationship with the patient whose information is being disclosed) and “my treating providers” (a general designation of a class of individual and/or entity participants with a treating provider relationship with that same patient)

hat facilitates the exchange of health information ( e.g., HIE). The consent form, therefore, could designate the HIE (an entity that does not have a treating provider relationship with the patient whose information is being disclosed) and “my treating providers” (a general designation of a class of individual and/or entity participants with a treating provider relationship with that same patient). Under this proposal, the consent form could not, however, include the general function “HIE” without specifying the name of the HIE entity used by the treating provider. Under this proposal, merely listing a function is not sufficient for consent because it would not sufficiently identify the recipient of the patient identifying information. Since SAMHSA is proposing to allow a general designation in the circumstances discussed above, we are proposing that, upon request, patients who have included a general

SAMHSA is proposing to require that the list of disclosures include a list of the entities to which the information was disclosed pursuant a general designation. However, if entities that are required to comply with the List of Disclosures requirement wish to include individuals on the list of disclosures, in addition to the required data elements which are outlined in § 2.13(d)(2)(ii), nothing in this proposed rule prohibits it.

SAMHSA considered requiring both individuals and entities to be included on the list of disclosures but, after reviewing the Health Information Technology Privacy Committee's recommendations, decided to require, at a minimum, a list of entities. These recommendations addressed the HITECH requirement that HIPAA covered entities and business associates account for disclosures for treatment, payment, and health care operations made through an EHR

d entities to be included on the list of disclosures but, after reviewing the Health Information Technology Privacy Committee's recommendations, decided to require, at a minimum, a list of entities. These recommendations addressed the HITECH requirement that HIPAA covered entities and business associates account for disclosures for treatment, payment, and health care operations made through an EHR. The Committee recommended, “that the content of the disclosure report be required to include only an entity name rather than a specific individual as proposed in the NPRM.” In addition, the report noted that the Organization for Economic Cooperation and Development (OECD) principles, the Fair Credit Reporting Act, and the Privacy Act of 1974 do not require that the names of individuals be provided.

SAMHSA proposes that individuals who received patient identifying information pursuant to the general designation on a consent form should be included on the List of Disclosures based on an entity affiliation, such as the name of their practice or place of employment. Patients who wish to know the name of the individual to whom their information was disclosed may ask the entity on the List of Disclosures to provide that information, however, 42 CFR part 2 would not require the entity to comply with a patient's request.

In order to allow time to develop, test, and implement advanced technology to more efficiently comply with this requirement, SAMHSA is proposing that the List of Disclosures requirement become effective two years after the effective date of the final rule. Some entities may be able to comply with this requirement without developing and implementing new technologies. In addition, entities that use and disclose primarily paper records could easily implement a system, if one does not already exist, such as a sign-out/sign-in log, that could be used to generate such a list

equirement become effective two years after the effective date of the final rule. Some entities may be able to comply with this requirement without developing and implementing new technologies. In addition, entities that use and disclose primarily paper records could easily implement a system, if one does not already exist, such as a sign-out/sign-in log, that could be used to generate such a list. SAMHSA anticipates that there will be few requests based on the relatively small number of accounting requests that most covered entities have received to date under the HIPAA Accounting for Disclosures rule, according to some anecdotal reports.

SAMHSA is proposing that patient requests for a list of entities to which their information has been disclosed must be in writing and limited to disclosures made within the past two years. Consistent with the preamble discussion of terminology (§ 2.11, Definitions), “written” includes both paper and electronic documentation. A request letter addressed to the entity that disclosed the information might include language such as: “I am writing to request a list of the entities to which my information has been disclosed within the past two years. This request is consistent with 42 CFR 2.13, which also includes the requirements for your response. Thank you for your assistance.”

In addition, SAMHSA is proposing that entities named on the consent form that disclose information to their participants under the general designation (entities without a treating provider relationship that serve as intermediaries) must respond to requests for a list of disclosures in 30 or fewer calendar days of receipt of the request. Responses sent to the patient electronically may be sent by encrypted transmission ( e.g., email), or by unencrypted email at the request of the patient, so long as the patient has been informed of the potential risks associated with unsecured transmission

onship that serve as intermediaries) must respond to requests for a list of disclosures in 30 or fewer calendar days of receipt of the request. Responses sent to the patient electronically may be sent by encrypted transmission ( e.g., email), or by unencrypted email at the request of the patient, so long as the patient has been informed of the potential risks associated with unsecured transmission. Patients should be notified that there may be some level of risk that the information in an unencrypted email could be read by a third party. If patients are notified of the risks and still prefer unencrypted email, the patient has the right to receive the information in that way, and entities are not responsible for unauthorized access of the information while in transmission to the patient based on the patient's request.

Before using an unsecured method to respond to a request for a list of disclosures, an entity should take certain precautions, such as checking an email address for accuracy before sending it or sending an email alert to the patient for address confirmation to avoid unintended disclosures. Patients may also request that the entity communicate with them by an alternative means or at an alternative location. Responses sent by mail may be sent by United States Postal Service first class mail, an equivalent service, or a service with additional security features ( e.g., tracking). The response must include the name of the entity to which each disclosure was made, the date of the disclosure, and a brief description of the information disclosed. The brief description of the information disclosed must have sufficient specificity to be understandable to the patient. An example of a brief description of the information disclosed is a copy of the written request for disclosure. This requirement to provide a list of disclosures cannot be satisfied by providing patients with a list (or web address) of entities that potentially could receive their patient identifying information

mation disclosed must have sufficient specificity to be understandable to the patient. An example of a brief description of the information disclosed is a copy of the written request for disclosure. This requirement to provide a list of disclosures cannot be satisfied by providing patients with a list (or web address) of entities that potentially could receive their patient identifying information.

This proposed revision would facilitate patients' participation in advances in the health care delivery system by increasing their confidence that they could be informed, upon request, of who received their information pursuant to a general designation on the consent form.

In addition, confirming the identity of an individual who is not and has never been a patient while remaining silent on the identity of an actual patient could, by inference, compromise patient privacy. For example, if a reporter is inquiring about five individuals and only Mr. Smith is not and never has been a patient, by confirming that Mr. Smith is not and never has been a patient and remaining silent on the other four individuals, the part 2 program could enable the reporter to conclude that the other four individuals either are patients or have been patients. Therefore, SAMHSA is proposing to remove the concept from § 2.13(c)(2) that the regulations do not restrict a disclosure that an identified individual is not and never has been a patient. If confirming the identity of an individual who is not and never has been a patient, caution should be used so as not to make an inadvertent disclosure with respect to one or more other individuals. This proposed rule does not prohibit entities that receive a request for information about an individual from refusing to disclose any information regardless of whether the individual is or ever has been a patient(s).

E. Security for Records (§ 2.16)

1. Overview

Currently, the Security for Written Records section in § 2.16 addresses the maintenance, disclosure, access to, and

2

ndividuals. This proposed rule does not prohibit entities that receive a request for information about an individual from refusing to disclose any information regardless of whether the individual is or ever has been a patient(s).

E. Security for Records (§ 2.16)

1. Overview

Currently, the Security for Written Records section in § 2.16 addresses the maintenance, disclosure, access to, and

2. Proposed Revisions

SAMHSA is proposing to modernize this section to address both paper and, in light of the steady increase in the adoption of health IT, electronic records. Specifically, SAMHSA proposes to revise the heading by deleting the word “written” so that it now reads: Security for Records. SAMHSA also proposes to clarify that this section requires both part 2 programs and other lawful holders of patient identifying information to have in place formal policies and procedures for the security of both paper and electronic records. These formal policies and procedures are intended to ensure protection of patient identifying information when records are exchanged electronically using health IT as well as when they are exchanged using paper records. The formal policies and procedures must reasonably protect against unauthorized uses and disclosures of patient identifying information and protect against reasonably anticipated threats or hazards to the security of patient identifying information. The formal policies and procedures must address, among other things, the sanitization of hard copy and electronic media, which is addressed in the preamble discussion of Disposition of Records by Discontinued Programs (§ 2.19)

zed uses and disclosures of patient identifying information and protect against reasonably anticipated threats or hazards to the security of patient identifying information. The formal policies and procedures must address, among other things, the sanitization of hard copy and electronic media, which is addressed in the preamble discussion of Disposition of Records by Discontinued Programs (§ 2.19). Suggested resources for part 2 programs and other lawful holders developing formal policies and procedures include materials from the HHS Office for Civil Rights ( e.g., Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule ), and the National Institute of Standards and Technology (NIST) ( e.g., the most current version of the Special Publication 800-88, Guidelines for Media Sanitization ).

The proposed regulations provide further guidance for these policies and procedures. Finally, we are proposing to replace language in other sections of the proposed rule with a reference to the policies and procedures established under § 2.16, where applicable.

F. Disposition of Records by Discontinued Programs (§ 2.19)

1. Overview

As with § 2.16, the Disposition of Records by Discontinued Programs section in the current regulations do not address electronic records.

2. Proposed Revisions

SAMHSA proposes to modernize this section to address both paper and electronic records. Specifically, we propose to address the disposition of both paper and electronic records by discontinued programs, and add requirements for sanitizing paper and electronic media. By sanitizing paper or electronic media, we mean to render the data stored on the media non-retrievable

ds.

2. Proposed Revisions

SAMHSA proposes to modernize this section to address both paper and electronic records. Specifically, we propose to address the disposition of both paper and electronic records by discontinued programs, and add requirements for sanitizing paper and electronic media. By sanitizing paper or electronic media, we mean to render the data stored on the media non-retrievable. Sanitizing electronic media is distinctly different from deleting electronic records and may involve clearing (using software or hardware products to overwrite media with non-sensitive data) or purging (degaussing or exposing the media to a strong magnetic field in order to disrupt the recorded magnetic domains) the information from the electronic media. If circumstances warrant the destruction of the electronic media prior to disposal, destruction methods may include disintegrating, pulverizing, melting, incinerating, or shredding the media. Because failure to ensure total destruction of patient identifying information may lead to the unauthorized disclosure of sensitive information regarding a patient's substance use disorder history, SAMHSA expects the process of sanitizing paper (including printer and FAX ribbons, drums, etc.) or electronic media to be permanent and irreversible, so that there is no reasonable risk that the information may be recovered. This result is best achieved by sanitizing the paper or electronic media in a manner consistent with the most current version of the NIST Special Publication 800-88, Guidelines for Media Sanitization. SAMHSA also is proposing to reference the formal security policies and procedures for both paper and electronic records established under § 2.16.

G. Notice to Patients of Federal Confidentiality Requirements (§ 2.22)

1. Overview

Currently, § 2.22 lists the requirements of a notice to patients of the federal confidentiality requirements, including giving the patient a summary in writing of the federal law and regulations

eference the formal security policies and procedures for both paper and electronic records established under § 2.16.

G. Notice to Patients of Federal Confidentiality Requirements (§ 2.22)

1. Overview

Currently, § 2.22 lists the requirements of a notice to patients of the federal confidentiality requirements, including giving the patient a summary in writing of the federal law and regulations. As with other sections in the current regulations, this section requires that the notice to patients be in writing, but does not address electronic formats.

2. Proposed Revisions

SAMHSA proposes to continue to require that patients be given a summary in writing of the federal law and regulations. Consistent with the Preamble discussion in Terminology Changes in Section III.B.2.c., the term “written” includes both paper and electronic documentation. We, therefore, propose to permit the notice to patients to be either on paper or in an electronic format. SAMHSA also proposes to require the statement regarding the reporting of violations to include contact information for the appropriate authorities. The reporting of any violation of these regulations may be directed to the U.S. Attorney for the judicial district in which the violation occurs and the report of any violation of these regulations by an opioid treatment program may also be directed to the SAMHSA office responsible for opioid treatment program oversight (see § 2.4 of the proposed rule). SAMHSA is considering whether to issue guidance at a later date that includes a sample notice.

Although it is not a proposed requirement, SAMHSA encourages the part 2 program to be sensitive to the cultural composition of its patient population when considering whether the notice should also be provided in a language(s) other than English ( e.g., Spanish).

H. Consent Requirements (§ 2.31)

1. Overview

SAMHSA has heard a number of concerns from individuals regarding the current consent requirements of 42 CFR part 2

requirement, SAMHSA encourages the part 2 program to be sensitive to the cultural composition of its patient population when considering whether the notice should also be provided in a language(s) other than English ( e.g., Spanish).

H. Consent Requirements (§ 2.31)

1. Overview

SAMHSA has heard a number of concerns from individuals regarding the current consent requirements of 42 CFR part 2. In particular, stakeholders expressed concern that the current requirements for sharing patient records covered by part 2 deter patients from participating in HIEs, ACOs, CCOs, and similar organizations. While technical solutions for managing consent collection, such as data segmentation, are possible, they are not widely incorporated into existing systems.

2. Proposed Revisions

SAMHSA examined the consent requirements in § 2.31 to explore options for facilitating the sharing of information within the health care context while ensuring the patient is fully informed and the necessary protections are in place. As a result, we propose several changes to this section. First, we propose to revise the section heading from “Form of written consent” to “Consent requirements.” SAMHSA also proposes to make revisions in three sections of the consent form requirements: The “To Whom” section, the “Amount and Kind” section, and the “From Whom” section. SAMHSA also is proposing to require a part 2 program or other lawful holder of patient identifying information to obtain written confirmation from the patient

As mentioned in Section III.C.2.a., New Definitions, SAMHSA is proposing to include a new definition of “Treating provider relationship” in § 2.11. Finally, as a result of these proposed revisions, we renumbered the subsections accordingly.

a. To Whom

i

posing to require a part 2 program or other lawful holder of patient identifying information to obtain written confirmation from the patient

As mentioned in Section III.C.2.a., New Definitions, SAMHSA is proposing to include a new definition of “Treating provider relationship” in § 2.11. Finally, as a result of these proposed revisions, we renumbered the subsections accordingly.

a. To Whom

i. Overview

Section 2.31(a)(2) of the current regulations requires that a consent form include the name or title of the individual or the name of the organization to which disclosure is to be made as part of the patient's written consent to the disclosure of their records regulated by 42 CFR part 2. The intent of the specificity required in the “To Whom” section was for the patient to be able to identify, at the point of consent, exactly who they are authorizing to receive their information.

Some stakeholders have reported that the requirement in 42 CFR 2.31(a)(2) for the name of the individual or organization that will be the recipient of the patient identifying information makes it difficult to include programs covered by the regulations in organizations that facilitate the exchange of health information or coordinate care ( e.g., HIEs, ACOs, and CCOs). These organizations have a large and growing number of participants and may not have consent management capabilities. Under the current regulations, if a new participant joins an HIE, ACO, CCO, or other similar entity after a consent is signed, and a patient later goes to that new participant for treatment, part 2 would require that the new participant obtain the patient's consent to receive the patient's information. Because of the reported burdens associated with the collection of updated consent forms whenever new participants join one of these organizations, some stakeholders have indicated that they are currently not including substance use disorder treatment information in their systems.

ii

, part 2 would require that the new participant obtain the patient's consent to receive the patient's information. Because of the reported burdens associated with the collection of updated consent forms whenever new participants join one of these organizations, some stakeholders have indicated that they are currently not including substance use disorder treatment information in their systems.

ii. Proposed Revisions

SAMHSA is proposing to move the current § 2.31(a)(2), “To Whom,” to § 2.31(a)(4). In the following discussion of the “To Whom” section of the consent form and in the regulatory text, SAMHSA makes a distinction between individuals and entities who have a treating provider relationship with the patient and those who do not. As discussed in § 2.11, SAMHSA proposes to define the term “Treating provider relationship” to provide that regardless of whether there has been an actual in-person encounter, (a) a patient agrees to be diagnosed, evaluated and/or treated for any condition by an individual or entity and (b) the individual or entity agrees to undertake diagnosis, evaluation and/or treatment of the patient, or consultation with the patient, for any condition.

Based on this definition, SAMHSA considers an entity to have a treating provider relationship with a patient if the entity employs or privileges one or more individuals who have a treating provider relationship with the patient.

SAMHSA is continuing to permit the name(s) of the individual(s) to whom a disclosure is to be made to be designated in the “To Whom” section of the consent form ( e.g., Jane Doe, MD; John Doe; or George Jones, JD). Because SAMHSA also is proposing to allow, in certain circumstances, a general designation, we propose to eliminate the current option of designating only a title of an individual ( e.g., Chief of Pediatrics at Lakeview County Hospital). SAMHSA also proposes to revise the requirements for designating the name of an entity, as discussed below

rm ( e.g., Jane Doe, MD; John Doe; or George Jones, JD). Because SAMHSA also is proposing to allow, in certain circumstances, a general designation, we propose to eliminate the current option of designating only a title of an individual ( e.g., Chief of Pediatrics at Lakeview County Hospital). SAMHSA also proposes to revise the requirements for designating the name of an entity, as discussed below.

In the case of an entity that has a treating provider relationship with the patient whose information is being disclosed, SAMHSA is proposing to permit the designation of the name of the entity without requiring any further designations (as is required for an entity that does not have a treating provider relationship with the patient whose information is being disclosed, see below). For example, the consent form could specify any of the following names of entities: Lakeview County Hospital, ABC Health Care Clinic, or Jane Doe & Associates Medical Practice.

In the case of an entity that does not have a treating provider relationship with the patient whose information is being disclosed and is a third-party payer that requires patient identifying information for the purpose of reimbursement for services rendered to the patient by the part 2 program, SAMHSA proposes to permit the designation of the name of the entity ( e.g., Medicare).

In the case of an entity that does not have a treating provider relationship with the patient whose information is being disclosed and is not covered by § 2.31(a)(4)(iii) ( i.e., the provision regarding third-party payers), SAMHSA proposes to permit the designation of the name(s) of the entity(-ies) and at least one of the following: (1) The name(s) of an individual participant(s); (2) the name(s) of an entity participant(s) that has a treating provider relationship with the patient whose information is being disclosed; or (3) a general designation of an individual or entity participant(s) or a class of participants that must be limited to those participants who have a treating provid

y(-ies) and at least one of the following: (1) The name(s) of an individual participant(s); (2) the name(s) of an entity participant(s) that has a treating provider relationship with the patient whose information is being disclosed; or (3) a general designation of an individual or entity participant(s) or a class of participants that must be limited to those participants who have a treating provider relationship with the patient whose information is being disclosed. Examples of an entity without a treating provider relationship include an entity that facilitates the exchange of health information ( e.g., HIE) or a research institution. The consent form, therefore, could designate the HIE (an entity that does not have a treating provider relationship with the patient whose information is being disclosed) and Drs. Jones and Smith, and County Memorial Hospital (all participants in the HIE with a treating provider relationship with that same patient). Likewise, the consent form could designate the HIE (an entity that does not have a treating provider relationship with the patient whose information is being disclosed) and “my treating providers” (a general designation of an individual or entity) participant(s) or a class of individual and/or entity participants with a treating provider relationship with the patient whose information is being disclosed).

In the case of a research institution, a “participant” could be a clinical researcher with a treating provider relationship with the patient whose information is being disclosed, or a general researcher who does not have a treating provider relationship with the patient whose information is being disclosed. The clinical researcher could be included as “my treating provider” in a general designation on the consent form, whereas the general researcher would have to be named on the consent form. Alternatively, a research institution could obtain patient identifying information without consent if it meets the requirements in § 2.52

vider relationship with the patient whose information is being disclosed. The clinical researcher could be included as “my treating provider” in a general designation on the consent form, whereas the general researcher would have to be named on the consent form. Alternatively, a research institution could obtain patient identifying information without consent if it meets the requirements in § 2.52.

If a general designation is used, the entity must have a mechanism in place to determine whether a treating provider relationship exists with the patient whose information is being disclosed.

Improving the quality of substance use disorder care depends on effective collaboration of mental health, substance use disorder, general health care, and other service providers in coordinating patient care. However, the composition of a health care team varies widely among entities. Because SAMHSA wants to ensure that patient identifying information is only disclosed to those individuals and entities on the health care team with a need to know this sensitive information, we are limiting a general designation to those individuals or entities with a treating provider relationship. Patients may further designate their treating providers as “past,” “current,” and/or “future” treating providers. In addition, a patient may designate, by name, one or more individuals on their health care team with whom they do not have a treating provider relationship.

SAMHSA proposes to balance the flexibility afforded by the general designation in the “To Whom” section by adding a new confidentiality safeguard: List of Disclosures (§ 2.13(d)). The List of Disclosures provision allows patients who have included a general designation in the “To Whom” section of their consent form to request and be provided a list of entities to which their information has been disclosed pursuant to the general designation

fforded by the general designation in the “To Whom” section by adding a new confidentiality safeguard: List of Disclosures (§ 2.13(d)). The List of Disclosures provision allows patients who have included a general designation in the “To Whom” section of their consent form to request and be provided a list of entities to which their information has been disclosed pursuant to the general designation. In addition, when using a general designation, a statement must be included on the consent form noting that, by signing the consent form, the patient confirms their understanding of the List of Disclosures provision.

Many new integrated care models rely on interoperable health IT and these proposed changes are expected to support the integration of substance use disorder treatment into primary and other specialty care, improving the patient experience, clinical outcomes, and patient safety while at the same time ensuring patient choice, confidentiality, and privacy.

The following table provides an overview of the options permitted when completing the designation in the “To Whom” section of the proposed consent form.

Designating Individuals and Organizations in the “To Whom” Section of the Consent Form

42 CFR 2.31 Individual or entity to whom disclosure is to be made Treating provider relationship with patient whose information is being disclosed Primary designation Additional designation (a)(4)(i) Individual Yes Name of individual(s) (e.g., Jane Doe, MD) None. (a)(4)(i) Individual No Name of individual(s) (e.g., John Doe) None. (a)(4)(ii) Entity Yes Name of entity (e.g., Lakeview County Hospital) None. (a)(4)(iii) Entity No Name of entity that is a third-party payer as specified under § 2.31(a)(4)(iii) (e.g., Medicare) None. (a)(4)(iv) Entity No Name of entity that is not covered by § 2.31(a)(4)(iii) (e.g., HIE, or research institution) At least one of the following: 1. The name(s) of an individual participant(s) (e.g. Jane Doe, MD, or John Doe). 2

f entity (e.g., Lakeview County Hospital) None. (a)(4)(iii) Entity No Name of entity that is a third-party payer as specified under § 2.31(a)(4)(iii) (e.g., Medicare) None. (a)(4)(iv) Entity No Name of entity that is not covered by § 2.31(a)(4)(iii) (e.g., HIE, or research institution) At least one of the following: 1. The name(s) of an individual participant(s) (e.g. Jane Doe, MD, or John Doe). 2. The name(s) of an entity participant(s) with a treating provider relationship with the patient whose information is being disclosed (e.g., Lakeview County Hospital). 3. A general designation of an individual or entity participant(s) or a class of participants limited to those participants who have a treating provider relationship with the patient whose information is being disclosed (e.g., my current and future treating providers). SAMHSA is seeking public comment on an alternative approach to the proposed required elements for the “To Whom” section of the consent form. The current part 2 required elements for the “To Whom” section of written consent are the name or title of the individual or the name of the organization to which the disclosure is to be made. The term “organization” is not defined in the current regulations, but SAMHSA has interpreted the term narrowly in guidance to mean that information can be sent to a lead organization but the information cannot flow from the lead organization to organization members or participants. Historically, that meant that all members or participants of an organization would need to be listed on the consent form and a new consent form would need to be obtained each time a new provider joined the organization.

SAMHSA's alternative approach reflects the same policy goal as the proposed regulation text ( i.e., allowing more flexibility in the “To Whom” section of the consent form) while attempting to simplify the language that would appear on the consent form. This alternative approach would not change the existing language in the “To Whom” section of the consent form

information is being disclosed but that serves as an intermediary in implementing the patient consent. It permits these organizations to further disclose patient identifying information to its members or participants that have a treating provider relationship with the patient. It also allows the patient to specify further instructions for re-disclosure to the organization's members or participants.

In all instances, patient identifying information should only be disclosed to those individuals and organizations in accordance with the purpose stated by the patient on the signed consent form and only to those individuals with a need to know this sensitive information.

SAMHSA is seeking public comment on the advantages and disadvantages of this alternative approach as compared to SAMHSA's proposed approach. If commenters believe the definition of “organization” in the alternative approach should be broader, please include proposals for alternate or additional required elements for the consent form that facilitate the sharing of information within the health care context while ensuring the patient is fully informed of the individuals and organizations that potentially could receive their patient identifying information and that the necessary protections are in place.

To consider this alternative approach, SAMHSA would require resolution of several issues. Therefore, SAMHSA is also seeking public comment on the following questions:

(1) To allow patients to determine which specific members or participants are authorized to receive their information from an organization that serves an intermediary in paragraph (c) of the proposed organization definition in SAMSHA's alternative approach, what additional elements would need to be required on the consent form?

, SAMHSA is also seeking public comment on the following questions:

(1) To allow patients to determine which specific members or participants are authorized to receive their information from an organization that serves an intermediary in paragraph (c) of the proposed organization definition in SAMSHA's alternative approach, what additional elements would need to be required on the consent form?

(2) How would the List of Disclosures requirement be applied under a broad definition of organization? Should the requirement be applied only to paragraph (c) of the proposed organization definition in SAMHSA's alternative approach or should different safeguards replace or supplement the List of Disclosures requirement?

b. Amount and Kind

i. Overview

Section 2.31(a)(5) currently requires the consent to include how much and what kind of information is to be disclosed. Because we are proposing to allow the “To Whom” section of the consent form to include a general designation under certain circumstances, we want patients to be aware of the information they are authorizing to disclose when they sign the consent form.

ii. Proposed Revisions

SAMHSA is proposing to move the current § 2.31(a)(5), “Amount and Kind,” to § 2.31(a)(3) and revise the provision to require the consent form to explicitly describe the substance use disorder-related information to be disclosed. The types of information that might be requested include diagnostic information, medications and dosages, lab tests, allergies, substance use history summaries, trauma history summary, employment information, living situation and social supports, and claims/encounter data. The designation of the “Amount and Kind” of information to be disclosed must have sufficient specificity to allow the disclosing program or other entity to comply with the request

ude diagnostic information, medications and dosages, lab tests, allergies, substance use history summaries, trauma history summary, employment information, living situation and social supports, and claims/encounter data. The designation of the “Amount and Kind” of information to be disclosed must have sufficient specificity to allow the disclosing program or other entity to comply with the request. For example, the description may include: “medications and dosages, including substance use disorder-related medications,” or “all of my substance use disorder-related claims/encounter data.” Examples of unacceptable descriptions would be “all of my records” (does not address the substance use disorder-related information to be disclosed) and “only my substance use disorder records my family knows about” (lacks specificity).

c. From Whom

i. Overview

Section 2.31 currently requires the specific name or general designation of the program or person permitted to make the disclosure. In 1987, the requirement for the “From Whom” section of the consent form was broadened to the current requirement to permit a patient to consent to either a disclosure from a category of facilities or from a single specified program.

ii. Proposed Revisions

SAMHSA is proposing to move the current § 2.31(a)(1), “From Whom,” to § 2.31(a)(2). Because SAMHSA is now allowing, in certain instances, a general designation in the “To Whom” section of the consent form, we propose to require the “From Whom” section of the consent form to specifically name the part 2 program(s) or other lawful holder(s) of the patient identifying information permitted to make the disclosure. This revision would avoid any unintended consequences of including general designations in both the “From Whom” and “To Whom” sections. For example, the patient may be unaware of possible permutations of combining the two broad designations to which they are consenting, especially if these designations include future unnamed treating providers.

d. New Requirements

i

ted to make the disclosure. This revision would avoid any unintended consequences of including general designations in both the “From Whom” and “To Whom” sections. For example, the patient may be unaware of possible permutations of combining the two broad designations to which they are consenting, especially if these designations include future unnamed treating providers.

d. New Requirements

i. Overview

Currently, the consent requirements do not include any requirement that the patient confirms their understanding of the information on the consent form.

ii. Proposed Revisions

As discussed in the proposed revisions to the “To Whom” section, SAMHSA proposes to add two new requirements related to the patient's signing of the consent form. The first would require the part 2 program or other lawful holder of patient identifying information to include a statement on the consent form that the patient understands the terms of their consent. The second would require the part 2 program or other lawful holder of patient identifying information to include a statement on the consent form that the patient understands their right, pursuant to § 2.13(d), to request and be provided a list of entities to which their

I. Prohibition on Re-disclosure (§ 2.32)

1. Overview

There is confusion on the part of some providers as to how much of a patient's record is subject to 42 CFR part 2, which often leads to a decision to protect the entire record.

2. Proposed Revisions

SAMHSA proposes to clarify that the prohibition on re-disclosure provision (§ 2.32) only applies to information that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder, such as indicated through standard medical codes, descriptive language, or both, and allows other health-related information shared by the part 2 program to be re-disclosed, if permissible under the applicable law

(§ 2.32) only applies to information that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder, such as indicated through standard medical codes, descriptive language, or both, and allows other health-related information shared by the part 2 program to be re-disclosed, if permissible under the applicable law. For example, if an individual receives substance use disorder treatment from a part 2 program and also receives treatment for a health condition such as high blood pressure, the individual's record would include information unrelated to their substance use disorder (i.e., high blood pressure). Part 2 does not prohibit re-disclosure of the information related to the high blood pressure as long as it does not include information that would identify the individual as having or having had a substance use disorder.

However, illnesses that are brought about by drug or alcohol abuse may reveal that a patient has a substance use disorder. For example, cirrhosis of the liver or pancreatitis could reveal a substance use disorder. Also, if a prescription for a medication used for substance use disorder treatment is revealed without further clarification of a non-substance disorder use (e.g., methadone used for the treatment of cancer), it would suggest that the individual has a substance use disorder and also would be prohibited.

If data provenance (the historical record of the data and its origins) reveals information that would identify, directly or indirectly, and individual as having or having had a substance use disorder, the information would be prohibited from being re-disclosed. For example, if the treatment location is a substance use disorder treatment clinic, this information would identify an individual as having had a substance use disorder and is therefore prohibited

ts origins) reveals information that would identify, directly or indirectly, and individual as having or having had a substance use disorder, the information would be prohibited from being re-disclosed. For example, if the treatment location is a substance use disorder treatment clinic, this information would identify an individual as having had a substance use disorder and is therefore prohibited.

SAMHSA also proposed to clarify that the federal rules restrict any use of the information to criminally investigate or prosecute any patient with a substance use disorder, except as provided in § 2.12(c)(5).

J. Disclosures To Prevent Multiple Enrollments (§ 2.34)

1. Overview

In the current regulations, special rules are included for disclosures to prevent multiple enrollments in detoxification and maintenance treatment programs because these types of disclosure necessitate some adjustment of the basic written consent procedures in order to ensure maximum protection for patients. Under § 2.34, the timing, content, and use of the patient information is strictly limited in accordance with the purpose of the disclosure.

2. Proposed Revisions

SAMHSA proposes to modernize section § 2.34 by updating terminology and revising corresponding definitions. SAMHSA also proposes to consolidate definitions by moving definitions from this section to Definitions in § 2.11, as discussed in Section III.B., Definitions.

K. Medical Emergencies (§ 2.51)

1. Overview

SAMHSA is considering aligning the regulatory language with the statutory language regarding the medical emergency exception of 42 CFR part 2 (§ 2.51). The current regulations state that information may be disclosed without consent for the purpose of treating a condition which poses an immediate threat to the health of any individual and which requires immediate medical intervention. The statute, however, states that records may be disclosed “to medical personnel to the extent necessary to meet a bona fide medical emergency.”

2

part 2 (§ 2.51). The current regulations state that information may be disclosed without consent for the purpose of treating a condition which poses an immediate threat to the health of any individual and which requires immediate medical intervention. The statute, however, states that records may be disclosed “to medical personnel to the extent necessary to meet a bona fide medical emergency.”

2. Proposed Revisions

SAMHSA proposes to adapt the medical emergency exception to give providers more discretion to determine when a “bona fide medical emergency” (42 U.S.C. 290dd-2(b)(2)(A)) exists. The proposed language states that patient identifying information may be disclosed to medical personnel to the extent necessary to meet a bona fide medical emergency, in which the patient's prior informed consent cannot be obtained.

SAMHSA proposes to continue to require the part 2 program to immediately document, in writing, specific information related to the medical emergency. Before a part 2 program enters into an affiliation with an HIE, it should consider whether the HIE has the capability to comply with all part 2 requirements, including the capacity to immediately notify the part 2 program when its records have been disclosed pursuant to a medical emergency. To promote compliance, SAMHSA recommends that the notification include all the information that the part 2 program is required to document in the patient's records ( e.g., date and time of disclosure, the nature of the emergency). Similarly, SAMHSA recommends that the part 2 program consider whether the HIE has the technology, rules, and procedures to appropriately protect patient identifying information.

L. Research (§ 2.52)

1. Overview

Under the current regulations at § 2.52, only the program director (part 2 program director) may authorize the disclosure of patient identifying information for scientific research purposes to qualified personnel

that the part 2 program consider whether the HIE has the technology, rules, and procedures to appropriately protect patient identifying information.

L. Research (§ 2.52)

1. Overview

Under the current regulations at § 2.52, only the program director (part 2 program director) may authorize the disclosure of patient identifying information for scientific research purposes to qualified personnel. Part 2 data may be derived from a variety of sources, including federal or state agencies that administer Medicare, Medicaid, or Children's Health Insurance Program (CHIP), part 2 programs, or other individuals or entities that have lawfully obtained the information and may wish to facilitate a sharing of the information for purposes of scientific research that would ultimately benefit substance use disorder patients/beneficiaries.

Along with fifteen other federal departments and agencies, HHS has announced proposed revisions to the regulations for protection of human subjects in research (Common Rule). An NPRM was published in the Federal Register on September 8, 2015. In this part 2 NPRM, SAMHSA proposes certain revisions that are predicated on the current version of the Common Rule (45 CFR part 46, Protection of Human Subjects, promulgated in 1991). Although SAMHSA does not anticipate that the Common Rule provisions referenced in this part 2 NPRM will change substantially during the Common Rule rulemaking process, should conflicting policies be created, SAMHSA will take appropriate action ( e.g., issue an NPRM or technical correction).

2. Proposed Revisions

First, we propose to revise the section heading by deleting the word “activities” (§ 2.52, Research). SAMHSA also proposes to revise the research exception to permit data protected by 42 CFR part 2 to be disclosed to qualified personnel for the purpose of conducting scientific research by a part 2 program or any other individual or entity that is in lawful possession of part 2 data (lawful holder of part 2 data)

se to revise the section heading by deleting the word “activities” (§ 2.52, Research). SAMHSA also proposes to revise the research exception to permit data protected by 42 CFR part 2 to be disclosed to qualified personnel for the purpose of conducting scientific research by a part 2 program or any other individual or entity that is in lawful possession of part 2 data (lawful holder of part 2 data). For example, these lawful holders of part 2 data could include third-party payers, HIEs, ACOs, and CCOs. Qualified personnel are those individuals who meet the requirements specified in the Research provision to receive part 2 data for the purpose of conducting scientific research. SAMHSA examined the existing regulations that protect human subjects in research and concluded that, if those requirements were fulfilled, 42 CFR part 2 would ensure confidentiality protections consistent with the Congressional intent, while providing the expanded authority for disclosing patient identifying information.

Under 42 CFR part 2, part 2 programs or other lawful holders of part 2 data are permitted to disclose patient identifying information for research with patient consent, or without patient consent under limited circumstances. SAMHSA is proposing to allow patient identifying information to be disclosed for purposes of scientific research: (1) If the researcher is a HIPAA covered entity or business associate and provides documentation that the researcher obtained research participants' authorization, or a waiver of research participants' authorization by an Institutional Review Board (IRB) or privacy board, for use or disclosure of information about them for research purposes consistent with the HIPAA Privacy Rule, (45 CFR 164.512(i)); or (2) if the researcher is subject to just the HHS Common Rule (45 CFR part 46, subpart A) and provides documentation that the researcher is in compliance with the requirements of the HHS Common Rule, including requirements relating to informed consent or a waiver of consent (45 CFR 46.111 and

nformation about them for research purposes consistent with the HIPAA Privacy Rule, (45 CFR 164.512(i)); or (2) if the researcher is subject to just the HHS Common Rule (45 CFR part 46, subpart A) and provides documentation that the researcher is in compliance with the requirements of the HHS Common Rule, including requirements relating to informed consent or a waiver of consent (45 CFR 46.111 and 46.116); or (3) if the researcher is both a HIPAA covered entity or business associate and subject to the HHS Common Rule, the researcher has met the requirements of both (1) and (2).

IRBs that are designated by an institution under an assurance of compliance approved for Federalwide use (referred to as Federalwide Assurance, or FWA) by HHS Office for Human Research Protections (OHRP) under § 46.103(a) and that review research involving human subjects conducted or supported by HHS must be registered with HHS. The FWA is the assurance from an institution engaging in HHS-conducted or -supported human subjects research regarding compliance with 45 CFR part 46. An institution must have an FWA to receive HHS support for research involving human subjects, and the FWA has to designate an IRB registered with OHRP, whether it is an internal or external IRB.

A privacy board is a review body that may be established to act upon requests for a waiver or an alteration of the requirement under the HIPAA Privacy Rule to obtain an individual's authorization for uses and disclosures of protected health information for a particular research study. Like an IRB, a privacy board may waive or alter all or part of the HIPAA authorization requirements for a specified research project or protocol, provided certain conditions are met as provided in 45 CFR 164.512(i).

Currently, much research involving human subjects operates under the HHS Common Rule (45 CFR part 46, subpart A)

ures of protected health information for a particular research study. Like an IRB, a privacy board may waive or alter all or part of the HIPAA authorization requirements for a specified research project or protocol, provided certain conditions are met as provided in 45 CFR 164.512(i).

Currently, much research involving human subjects operates under the HHS Common Rule (45 CFR part 46, subpart A). These regulations, which apply to HHS-conducted or -supported research or to institutions that have voluntarily extended their FWA to apply to all research regardless of funding, include protections to help ensure confidentiality. Under this rule, IRBs determine that, when appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data before approving the research (45 CFR 46.111(a)(7)). IRBs can therefore address the requirements under the HIPAA Privacy Rule and the HHS Common Rule, which contain somewhat similar, but different sets of requirements. The proposed part 2 rules set out the requirements for a researcher conducting research with patient identifying information. Compliance with the HIPAA Privacy Rule and/or federal human subjects research protections, as set forth in the HHS Common Rule, where they apply, as well as the specific additional requirements in § 2.52(b) discussed below, is sufficient to meet the requirements for research disclosures under part 2.

SAMHSA also is proposing to address data linkages because the process of linking two or more streams of data opens up new research opportunities. For example, the practice of requesting data linkages from other data sources to study the longitudinal effects of treatment on patients is becoming widespread. SAMHSA is interested in affording patients protected by 42 CFR part 2 the same opportunity to benefit from these advanced research protocols while continuing to safeguard their privacy

e streams of data opens up new research opportunities. For example, the practice of requesting data linkages from other data sources to study the longitudinal effects of treatment on patients is becoming widespread. SAMHSA is interested in affording patients protected by 42 CFR part 2 the same opportunity to benefit from these advanced research protocols while continuing to safeguard their privacy.

We propose to permit researchers to request to link data sets that include patient identifying information if: (1) The data linkage uses data from a federal data repository; and (2) the project, including a data protection plan, is reviewed and approved by an IRB registered with OHRP in accordance with 45 CFR part 46. This permissible disclosure would allow a researcher to disclose patient identifying information to a federal data repository and permit the federal data repository to link the patient identifying information to data held by that repository and return the linked data file back to the researcher. It would also ensure that patient privacy is considered, that the disclosure and use of identifiable data is justified, and that the research protocol includes an appropriate data protection plan. SAMHSA is proposing to limit the data repositories from which a researcher may request data for data linkages purposes to federal data repositories because federal agencies that maintain data repositories have policies and procedures in place to protect the security and confidentiality of the patient identifying information that must be submitted by a researcher in order to link the data sets. For example, in addition to meeting requirements under the HIPAA Rules and/or the HHS Common Rule, as applicable, requests for “research identifiable files” data from CMS require a Data Use Agreement and are reviewed by CMS's Privacy Board. CMS also has internal policies to protect the privacy and security of data received from the researcher, including the retention and destruction of that data

. For example, in addition to meeting requirements under the HIPAA Rules and/or the HHS Common Rule, as applicable, requests for “research identifiable files” data from CMS require a Data Use Agreement and are reviewed by CMS's Privacy Board. CMS also has internal policies to protect the privacy and security of data received from the researcher, including the retention and destruction of that data. In addition, all federal agencies must comply with directives that protect sensitive data such as Office of Management and Budget Circular No. A-130, Appendix III— Security of Federal Automated Information and NIST Federal Information Processing Standard 200 entitled Minimum Security Requirements for Federal Information and Information Systems.

SAMHSA is soliciting public input regarding whether to expand the data linkages provision beyond federal data repositories, what confidentiality, privacy, and security safeguards are in place for those non-federal data repositories, and whether those safeguards are sufficient to protect the security and confidentiality of the patient identifying information.

We invite stakeholders to provide input and recommendations on the specific policies, procedures, and other safeguards that non-federal data

1. Data use agreements ( e.g., a data use agreement or contract between the researcher and the data repository with written provisions to uphold security and confidentiality of the data and provide for sanctions or penalties for breaches of confidentiality);

2. A review by a privacy board or other regulatory body(-ies);

3. Internal security and privacy protections (both physical and electronic) for the confidentiality and security of data, including the retention and destruction of data received for data linkage purposes ( e.g., a requirement to destroy, in a manner to render the data non-retrievable, all patient identifying information provided by the researcher for data linkage purposes after performing the match).

4

nal security and privacy protections (both physical and electronic) for the confidentiality and security of data, including the retention and destruction of data received for data linkage purposes ( e.g., a requirement to destroy, in a manner to render the data non-retrievable, all patient identifying information provided by the researcher for data linkage purposes after performing the match).

4. Security and privacy protections (both physical and electronic) for receiving and linking data ( e.g., a requirement that transmission of data between the researcher and the data repository must occur through the use of secure methods and use the most current encryption technology, such as the most current version of the Advanced Encryption Standard (NIST Federal Information Processing Standards (FIPS 197)).

5. Internal confidentiality agreements for staff members who have access to patient identifying information and other confidential data;

6. Laws and regulations governing functions and operations, including those that address security and privacy;

7. Capability to perform data linkages according to recognized standards; and

8. Other relevant safeguards.

SAMHSA also is requesting public comment on the following three sets of questions:

First, should state government, local government, private, and/or other non-federal data repositories (please address separately) that meet the criteria above be permitted to conduct data linkages?

Second, are there additional or alternative criteria that should be included in the list above? Are there specific categories of data repositories that are already required to provide similar safeguards? When providing categories of data repositories, please describe the safeguards that are already in place for those entities

y) that meet the criteria above be permitted to conduct data linkages?

Second, are there additional or alternative criteria that should be included in the list above? Are there specific categories of data repositories that are already required to provide similar safeguards? When providing categories of data repositories, please describe the safeguards that are already in place for those entities.

Third, how could it be ensured that data repositories providing data linkages are in compliance with criteria or standards concerning confidentiality, privacy, and security safeguards? Are there any regulatory or oversight bodies (including non-governmental and governmental) that currently oversee compliance with criteria or standards concerning confidentiality, privacy, and security safeguards of data in non-federal repositories?

A researcher may report findings in aggregate form from patient information that has been rendered non-identifiable as long as there are assurances in place that the information cannot be re-identified and possibly serve as an unauthorized means to identify a patient, directly or indirectly, as having or having had a substance use disorder.

SAMHSA is proposing to require any individual or entity conducting scientific research using patient identifying information to meet additional requirements to ensure compliance with confidentiality provisions under part 2. Among these are a provision (§ 2.52(b)(1)) that requires researchers to be fully bound by these regulations and, if necessary, to resist in judicial proceedings any efforts to obtain access to patient records except as permitted by these regulations. This requirement means that researchers involved in a judicial proceeding are only required to disclose patient identifying information pursuant to a subpoena that is accompanied by a court order

t requires researchers to be fully bound by these regulations and, if necessary, to resist in judicial proceedings any efforts to obtain access to patient records except as permitted by these regulations. This requirement means that researchers involved in a judicial proceeding are only required to disclose patient identifying information pursuant to a subpoena that is accompanied by a court order. In addition, we have included a provision (§ 2.52(b)(2)) prohibiting researchers from re-disclosing patient identifying information except back to the individual or entity from whom that patient identifying information was obtained or as permitted under § 2.52(b)(4), the data linkages provision. With respect to this re-disclosure provision, an individual or entity from whom the patient identifying information was obtained does not refer to patients.

Finally, SAMHSA is proposing to address, in addition to the maintenance of part 2 data, the retention and disposal of such information used in research. SAMHSA is proposing to do so by expanding the provisions in § 2.16, Security for Records and referencing the policies and procedures established under § 2.16 in this section.

These proposed revisions would allow additional scientific research to be conducted that would facilitate continual quality improvement of part 2 programs and the important services they offer. In doing so, SAMHSA proposes to incorporate existing protections for human subjects research that are widely accepted.

M. Audit and Evaluation (§ 2.53)

1. Overview

Under the current Medicare or Medicaid audit or evaluation section at § 2.53, an audit or evaluation is limited to a civil investigation or administrative remedy by any federal, state, or local agency responsible for oversight of the Medicare or Medicaid program. It also includes administrative enforcement, against the program by the agency, or any remedy authorized by law to be imposed as a result of the findings of the investigation.

2

t or evaluation section at § 2.53, an audit or evaluation is limited to a civil investigation or administrative remedy by any federal, state, or local agency responsible for oversight of the Medicare or Medicaid program. It also includes administrative enforcement, against the program by the agency, or any remedy authorized by law to be imposed as a result of the findings of the investigation.

2. Proposed Revisions

First, we propose to revise the section heading by deleting the word “activities” (§ 2.53, Audit and Evaluation). SAMHSA also proposes to modernize this section to include provisions for governing both paper and electronic patient records. In addition, we propose to revise the requirements for destroying patient identifying information by citing the expanded Security for Records section (§ 2.16). Furthermore, we propose to update the Medicare or Medicaid audit or evaluation subsection title to include CHIP and, in subsequent language, refer to Medicare, Medicaid and CHIP (SAMHSA has always applied this section to CHIP and is proposing to explicitly refer to it in the proposed regulation text).

SAMHSA proposes to permit the part 2 program, not just the part 2 program director, to determine who is qualified to conduct an audit or evaluation of the part 2 program in paragraph (a)(2). SAMHSA also proposes to permit an audit or evaluation necessary to meet the requirements of a CMS-regulated ACO or similar CMS-regulated organization (including a CMS-regulated QE), under certain conditions. To ensure that patient identifying information is protected, the CMS-regulated ACO or similar CMS-regulated organization (including a CMS-regulated QE) that is the subject of, or is conducting, the audit or evaluation must have a signed Participation Agreement with CMS which provides that the CMS-regulated ACO or similar CMS-regulated organization (including a CMS-regulated QE) must comply with all applicable provisions of 42 U.S.C 290dd-2 and 42 CFR part 2.

IV

S-regulated ACO or similar CMS-regulated organization (including a CMS-regulated QE) that is the subject of, or is conducting, the audit or evaluation must have a signed Participation Agreement with CMS which provides that the CMS-regulated ACO or similar CMS-regulated organization (including a CMS-regulated QE) must comply with all applicable provisions of 42 U.S.C 290dd-2 and 42 CFR part 2.

IV. Collection of Information Requirements

Under the Paperwork Reduction Act of 1995 (PRA), agencies are required to provide a 60-day notice in the Federal Register and solicit public comment before a collection of information requirement is submitted to the Office of Management and Budget (OMB) for review and approval. Currently, the information collection is approved under OMB Control No. 0930-0092. In

Under the PRA, the time, effort, and financial resources necessary to meet the information collection requirements referenced in this section are to be considered in rule making. We explicitly seek, and will consider, public comment on our assumptions as they relate to the PRA requirements summarized in this section.

This proposed rule includes changes to information collection requirements, that is, reporting, recordkeeping or third-party disclosure requirements, as defined under the PRA (5 CFR part 1320). Some of the provisions involve changes from the information collections set out in the previous regulations. Information collection requirements are: (1) Section 2.13(d)—Disclosure: Requires entities named on a consent form that disclose patient identifying information to their participants under the general designation to make a disclosure, to each patient who requests a list of disclosures, in the form of a list of entities to which their information has been disclosed pursuant to the general designation, (2) Section 2.22—Disclosure: Requires each program to make public disclosure in the form of communication to each patient that federal law and regulations protect the confidentiality of each patient and include

o make a disclosure, to each patient who requests a list of disclosures, in the form of a list of entities to which their information has been disclosed pursuant to the general designation, (2) Section 2.22—Disclosure: Requires each program to make public disclosure in the form of communication to each patient that federal law and regulations protect the confidentiality of each patient and includes a written summary of the effect of this law and these regulations, (3) Section 2.51—Recordkeeping: This provision requires the program to document a disclosure of a patient record to authorized medical personnel in a medical emergency. The regulation is silent on retention period for keeping these records as this will vary according to state laws. It is expected that these records will be kept as part of the patients' health records. Annual burden estimates for these requirements are summarized in the table below:

Annualized Burden Estimates Annual number of respondents Responses per respondent Total responses Hours per response Total hour burden Hourly wage cost Total hour cost Disclosures 42 CFR 2.13 (d) 1 19,548 1 19,548 2 4.15 81,124 3 $36.9175 $2,994,895 42 CFR 2.22 4 12,034 155 5 1,861,693 .20 372,338.6 6 40.26 14,990,352 Recordkeeping 42 CFR 2.51 12,034 2 24,068 .167 4,019 7 34.16 137,289 Total 8 31,582 1,905,309 457,482 18,122,536 1 The number of entities required to generate a list of disclosures based on the number of estimated patient requests. Patient requests are based the total number of annual treatment admissions from SAMHSA's 2010-2012 Treatment Episode Data Set (TEDS) (see footnote 5). The estimated patient requests equal the average of the total number of requests for a 0.1% request rate and a 2% request rate. 2 The estimated time for developing a list of disclosures is 4 hours for entities collecting the information electronically using an audit log and 3 hours for entities that produce such a list from paper records

010-2012 Treatment Episode Data Set (TEDS) (see footnote 5). The estimated patient requests equal the average of the total number of requests for a 0.1% request rate and a 2% request rate. 2 The estimated time for developing a list of disclosures is 4 hours for entities collecting the information electronically using an audit log and 3 hours for entities that produce such a list from paper records. Because 90% of entities are estimated to collect the information electronically using an audit log and 10% are estimated to use paper records, the average weighted time to develop a list of disclosures is 3.9 hours [(0.9 × 4 hours) + (0.1 × 3 hours)]. Including the estimated 15 minutes to prepare each list of disclosures for mailing or transmitting, the total estimated time for providing a patient a list of disclosures is 4.15 hours (3.9 hours + 0.25 hours). 3 The weighted hourly rate for health information technicians, medical technicians and administrative staff who will be preparing the list of disclosures. The hourly rate is weighted to reflect the fact that health information and medical technicians, who will be generating the list of disclosures, have a higher wage rate than administrative staff and will contribute more hours to generating the list of disclosures. Bureau of Labor Statistics, U.S. Department of Labor, Occupational Employment Statistics [accessed June 3, 2015], Standard Occupations Classification codes (29-2071, 31-9092) [ www.bls.gov/oes/ ]. The hourly wage rate was multiplied by 2 to account for benefits and overhead costs. 4 The number of publicly funded alcohol and drug facilities based on SAMHSA's 2013 National Survey of Substance Abuse Treatment Services (N-SSATS). 5 The average number of annual treatment admissions from SAMHSA's 2010-2012 Treatment Episode Data Set (TEDS). 6 Bureau of Labor Statistics, U.S. Department of Labor, Occupational Employment Statistics [accessed July 16, 2015], Standard Occupations Classification code (21-1011) [ www.bls.gov/oes/ ]

g facilities based on SAMHSA's 2013 National Survey of Substance Abuse Treatment Services (N-SSATS). 5 The average number of annual treatment admissions from SAMHSA's 2010-2012 Treatment Episode Data Set (TEDS). 6 Bureau of Labor Statistics, U.S. Department of Labor, Occupational Employment Statistics [accessed July 16, 2015], Standard Occupations Classification code (21-1011) [ www.bls.gov/oes/ ]. The hourly wage rate was multiplied by 2 to account for benefits and overhead costs. 7 Bureau of Labor Statistics, U.S. Department of Labor, Occupational Employment Statistics [accessed July 16, 2015], Standard Occupations Classification code (43-0000) [ www.bls.gov/oes/ ]. The hourly wage rate was multiplied by 2 to account for benefits and overhead costs. 8 The combined total of the number of publicly funded alcohol and drug facilities and the number of entities required to generate a list of disclosures. As described in greater detail in Section VI., Regulatory Impact Analysis, the respondents for the collection of information under 42 CFR 2.22 and 2.51 are publicly (federal, state, or local) funded, assisted, or regulated substance use disorder treatment programs. The estimate of the number of such programs (respondents) is based on the results of the 2013 N-SSATS, and the average number of annual total responses is based on 2010-2012 information on patient admissions reported to the Treatment Episode Data Set (TEDS), approved under OMB Control No. 0930-0106 and OMB Control No. 0930-0335.

The respondents for the collection of information under 42 CFR 2.13(d) are entities named on the consent form that disclose information to their participants pursuant to the general designation

of annual total responses is based on 2010-2012 information on patient admissions reported to t

This text is long and has been trimmed here. Open the source document for the complete record.