Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="size-medium wp-image-5165 alignright" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2018/01/healthcare-iStock_000005330222_Large-300x200.jpg" alt="" width="300" height="200" />

On Jan. 3, 2018, the Substance Abuse and Mental Health Services Administration (SAMHSA) issued its <a href="https://www.federalregister.gov/documents/2018/01/03/2017-28400/confidentiality-of-substance-use-disorder-patient-records">final rule</a> regarding the Confidentiality of Substance Use Disorder Patient Records Part 2. These changes become effective Feb. 2, 2018.

As background, the Confidentiality of Substance Use Discover Patient Records Part 2 protects patient records maintained in connection with any activity related to substance use disorder education, treatment, rehabilitation, research, prevention or training. 42 C.F.R. Part 2. It applies to all programs that receive federal assistance and are designated as “part 2” programs, as well as to “lawful holders,” which are individuals and entities who lawfully receive information protected by the Confidentiality of Substance Use Disorder Patient Records Part 2. In an effort to maintain privacy protections for individuals seeking treatment for substance abuse disorders while providing greater flexibility reflective of the advances and integration in healthcare, the final rule address two elements: (1) abbreviated disclosure notices, and (2) who can use disclosure patient information and when.



Since 1983, the regulations required notice on the prohibition of re-disclosure of any patient information to accompany each disclosure with the patients’ written consent. The limitations imposed for free text within electronic health records make compliance with the provision difficult, if not at times impossible. Recognizing that the advances in technology make such a requirement outdated, the new rule allows for an abbreviated notice to accommodate the use of electronic records. Such a development seeks to encourage the electronic exchange of patient information among providers coordinating care for the patients.

Additionally, SAMHSA’s final rule permits any lawful holder of patient information to disclose the minimum necessary for payment and healthcare operations. The rule finalizes the scope and requirements for permitted disclosures to contractors, subcontractors and legal representatives, highlighting that such disclosure is never allowed for diagnosis, treatment or referral purposes. The change is reflective of the harm unauthorized disclosure of this information can cause patients, including loss of employment, housing and child custody, and other discrimination. The rule seeks to balance this with the legitimate needs of lawful holders of patient information to disclose the minimum necessary for payment or operational purposes. The final rule includes in its preamble examples of permissible activities that SAMHSA considers payment or healthcare operations activities, including, but not limited to, the following:
<ul>
 	<li>billing, claims management, collections, obtaining payment, claims filing and related healthcare data processing;</li>
 	<li>clinical professional support services, such as quality assessment and improvement initiatives;</li>
 	<li>patient safety activities;</li>
 	<li>training of non-healthcare professionals, students and healthcare professionals;</li>
 	<li>assessment or provider performance, health plan performance, or practitioner competencies;</li>
 	<li>accreditation, certification, licensing or credentialing;</li>
 	<li>activities related to health insurance or health benefits;</li>
 	<li>third-party liability coverage;</li>
 	<li>activities related to addressing fraud, waste and abuse;</li>
 	<li>conducting or arranging for medical review, legal services and auditing functions;</li>
 	<li>business planning and development;</li>
 	<li>business management and administrative activities;</li>
 	<li>customer services, such as provision of data analyses for policyholders;</li>
 	<li>resolution of internal grievances;</li>
 	<li>determinations of eligibility of coverage;</li>
 	<li>sale, transfer, merger, consolidation or dissolution of an organization;</li>
 	<li>risk adjusting; and</li>
 	<li>review of health services with respect to medical necessity, coverage under a health plan, appropriateness of care or justification of charges.</li>
</ul>
All lawful holders must have contracts in place with the contractors or subcontractors who carry out the payment and healthcare operations activities. The contracts must specify that the contractors and subcontractors will comply with the provisions of the Confidentiality of Substance Use Disorder Patient Records Part 2. To ensure compliance with this new rule, clients subject to the Confidentiality of Substance Use Disorder Patient Records Part 2 should review and update their policies and procedures and review any vendor agreements that may need to be updated.

While these updated regulations better align with the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act, we can expect to see more developments from SAMHSA as they continue to explore additional rulemaking to better protect a vulnerable population while adapting to the advancements in healthcare.

SAMHSA Updates Privacy Regulations to Reflect Advancements in Healthcare