HIPAA Proposed Rule to Update Substance Abuse Confidentiality Regulations

by  Wyn Staheli, Director of Content - innoviHealth
Apr 13th, 2016

On February, 9, 2016 HHS published proposed revisions (81 FR 6988) to the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, 42 CFR Part 2. These revisions were prompted by the need to update and modernize the regulations. The comment period ended on April 11, 2016. Please note that one of the proposed changes is to change the name of the regulation to "Confidentiality of "Substance Use Disorder Patient Records."

This portion of the law "Protects confidentiality of the identity, diagnosis, prognosis, or treatment of any patient records maintained in connection with the performance of any federally assisted program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation or research."

It is important to ensure that a patient receiving treatment for a substance use disorder is not made more vulnerable than a comparable individual who does NOT seek treatment.

WHY MAKE CHANGES?

Even though some rules were already in place, as mentioned earlier, there are many reasons necessitating a change. For example:

1. new payment models and integrated care, brought about by healthcare reform, require extensive sharing of information to coordinate patient care
2. electronic information exchange standards have changed
3. focus on quality/performance measures are now linked to payment models
4. there have been concerns about barriers to research which could improve patient care models
5. breach implications can be much higher for substance abuse patients such as discrimination, custody issues, incarceration and much more
6. current regulations are confusing and are considered burdensome by many

PATIENT CONSENT

Like other HIPAA regulations, there are limited exceptions for disclosure without the patient's direct consent such as:

• medical emergencies
• scientific research
• audits and evaluations
• child abuse reporting
• crimes on program premises or against program personnel
• court order
• communications with a qualified service organization (QSO) of information needed by the organization to provide services to the program.

Patient consent will be expanded to include:

• section to specify "to whom" information may be disclosed
• section to specify "from whom" information may be obtained
• require an explicit description of the amount and kind of substance use disorder treatment information which may be disclosed
• statement that the patient understands the terms of their consent
• provision for the patient to obtain, upon request, a list of those to whom their information has been disclosed

OTHER CHANGES

Auditing and Security will also be expanded with provisions which address both paper and electronic records. It should be noted that requirements for destroying records will fall under the expanded Section 2.16, Security for Records.

There are many other changes not included in this article, such as the proposed changes in the Definitions section. For more information, see the official proposed rule in the Federal Register.

FINAL RULE

Please note that this is the proposed rule and there could be revisions before the Final Rule is made. Substance abuse providers need to watch for further announcements regarding implementation requirements when the Final Rule is made. At this time it is unknown when that will happen.