The final rule "modernizing" the country's confidentiality regulation, which originally required treatment providers to obtain patients' consent in writing to the release of their substance use disorder (SUD) treatment information, was published last week. Consent for release of information would apply to a broad category of health care operations, care coordination and case management. And methadone patients could have their treatment information put into state data systems; since 2011, that has not been allowed. Finally, the freedom of law enforcement to place and use confidential informants inside treatment programs has been expanded.
The final rule for 42 CFR Part 2 codifies the proposal to allow OTPs to input patient information into PDMPs, greater use of confidential informants by law enforcement in treatment programs and easier release of patient information to vaguely defined categories.
The final rule "modernizing" the country's confidentiality regulation, which originally required treatment providers to obtain patients' consent in writing to the release of their substance use disorder (SUD) treatment information, was published last week. Consent for release of information would apply to a broad category of health care operations, care coordination and case management. And methadone patients could have their treatment information put into state data systems; since 2011, that has not been allowed. Finally, the freedom of law enforcement to place and use confidential informants inside treatment programs has been expanded.
This 54‐page final rule is, practically speaking, an interim final rule, as the Substance Abuse and Mental Health Services Administration (SAMHSA) will have to issue a new rulemaking to comply with the CARES Act, which takes effect April 1, 2021. The CARES Act eliminates consent except for the first time only (see "CARES Act eliminates most of 42 CFR Part 2," ADAW, April 6, https://onlinelibrary.wiley.com/doi/10.1002/adaw.32678).
The final rule, which was published in the Federal Register July 15 and available for viewing July 13, takes effect 30 days from publication —Aug. 14.
"Modernization" is the catchword of SAMHSA, which promulgates the regulation and proposed it last August. But it is still bad news for patients who want their information kept private, and want control over who sees it.
It's good news, however, for insurance companies, electronic health records systems, attorneys generals (who lobbied for it and are often involved in the prescription drug monitoring programs [PDMPs] in their state) and even for treatment organizations who lobbied for it, such as the American Society of Addiction Medicine and the National Association of Addiction Treatment Providers.
Last year, when Elinore McCance‐Katz, M.D., Ph.D., led a stakeholder call on the proposed revisions to 42 CFR Part 2, the regulation protecting the confidentiality of SUD treatment, she responded to our question about a 2011 dictum from SAMHSA, which she leads, prohibiting opioid treatment programs (OTPs) from putting patient information into the state's PDMP. "Times change, Alison," was all she said (see "SAMHSA proposes significant changes to 42 CFR Part 2," ADAW, Sept. 9, 2019; https://onlinelibrary.wiley.com/doi/10.1002/adaw.32473).
The Department of Health and Human Services (HHS), SAMHSA's parent agency, doesn't accept that patients say they won't seek treatment, or will taper off of methadone, if they can't be guaranteed confidentiality. In fact, quite the opposite: HHS says patients want this change.
"This reform will help make it easier for Americans to discuss substance use disorders with their doctors, seek treatment and find the road to recovery," said HHS Secretary Alex Azar in announcing the final rule last week. "President Trump has made the availability of treatment for Americans with substance use disorders, including opioid use disorder, a priority. Thanks to the valuable input of stakeholders, our final rule will make it easier for Americans to seek and receive treatment while lifting burdens on providers and maintaining important privacy protections."
The new rule doesn't completely align 42 CFR Part 2 with the Health Insurance Portability and Accountability Act (HIPAA), as some had wanted. It still requires that SUD treatment programs may only disclose patient‐identifying information with the individual's written consent, as part of a court order or under a few limited exceptions. But under the revised rule, health care providers, with patients' consent, will be able to more easily conduct such activities as quality improvement, claims management, patient safety, training and program integrity efforts.
"Coordinated care is a vital piece of President Trump's vision for a patient‐centric health care system, and regulatory reform is a key step toward promoting more coordinated care," said HHS Deputy Secretary Eric Hargan. "As part of our Regulatory Sprint to Coordinated Care, these changes are just the beginning of a comprehensive agenda for reforming regulations that govern the delivery and financing of American health care, with the ultimate goal of better care, and better health, at a lower cost."
"The adoption of this rule means Americans will be better able to receive integrated and coordinated care in the treatment of their substance use disorders," said McCance‐Katz. "We are grateful to the individuals and organizations that contributed their input to the rule‐making process. This is great news for our nation's families and communities."
McCance‐Katz, a psychiatrist, added that the change "will strengthen the nation's efforts to reduce opioid misuse and abuse and to support patients and their families confronting substance use disorders." And she added that the change "will make it easier for primary care clinicians to treat individuals with substance use disorders."
Making it easier to share information will lead to better care for those with SUDs, said McCance‐Katz. "Although well‐intentioned, the nondisclosure of critical, lifesaving information the previous rule permitted is itself stigmatizing," she said. Other organizations' support for the changes is detailed in a July 15 press release from the "Coalition to Protect 42 CFR Part 2," which is spearheaded by the managed care trade association ABHW, and include ASAM. No organization posted this on their website by press time so we have posted it here exclusively for ADAW readers.
For a list of the changes in the final rule, go to https://
H. Westley Clark, M.D., J.D., who wrote the 2011 "Dear Colleague Letter" prohibiting OTPs from disclosing patient information to PDMPs as director of SAMHSA's Center for Substance Abuse Treatment (CSAT), has been one of the most vocal opponents of any weakening of confidentiality.
"These new regulations, combined with the comments from SAMHSA, suggest that the Trump administration has decided that the primary goal of encouraging those with SUDs to enter treatment is no longer valid," said Clark. "In addition, SAMHSA fails to acknowledge that it does not have the capacity to monitor violations of 42 USC 290 dd‐2 [the law implementing 42 CFR Part 2] or 42 CFR Part 2."
SAMHSA neither collects comprehensive data on violations of 42 CFR Part 2 nor publishes a compilation of case law addressing 42 USC 290dd‐2 or 42 CFR Part 2. "Thus, all of SAMHSA's assurances about the balancing of interests between patients and providers are disingenuous," said Clark, who says he is not criticizing SAMHSA. "I simply disagree with them."
SAMHSA noted that a few commenters said this proposal is particularly concerning given the simultaneous proposal by SAMHSA (at 84 FR 44568) to remove the phrase "allegedly committed by the patient" from §2.63 of the regulations. SAMHSA pointed out that these commenters argued that, coupled together, the changes would allow the regulations to become a tool of prosecution and not recovery. This is part of allowing law enforcement into treatment centers by placing an informant there, now for 12 months instead of just six, and without any indication that the patient committed any wrongdoing.
SAMHSA dismissed these concerns by noting: "[T]he authorizing statute (42 U.S.C. 290dd‐2) and the regulations promulgated thereunder (42 CFR part 2) contain various safeguards against misuse of these provisions." Further, §2.13(a) of the regulations specifically provides that "[t]he patient records subject to the regulations in this part may be disclosed or used only as permitted by the regulations in this part and may not otherwise be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any federal, state, or local authority."
But Clark pointed out that SAMHSA is not the agency that has the statutory authority to enforce 42 USC 290dd‐2 or even its own regulations (42 CFR Part 2) — the Department of Justice does. "Keep in mind that the Department of Justice wants to weaken 42 CFR Part 2 and not to uphold substance use disorder confidentiality regulations," he said, noting that SAMHSA has no power or authority to compel the Department of Justice (DOJ) to present data, information or evidence of the violations of 42 USC 290dd‐2 or 42 CFR Part 2.
SAMHSA should have put into place a monitoring system as an interim process to transition to the CARES Act provisions, rather than moving forward with the current unnecessary changes to the existing regulations, said Clark.
"In truth, DHHS should have pulled back this new rule and pursued the new regulations required by the CARES Act, which amends 42 USC 290dd‐2(b). As the SAMHSA responses to this new rule reveal, an alignment of provisions will be necessary anyway, especially given that the CARES Act provisions go into effect by April 2021 whether new additional regulations are promulgated or not," Clark observed.
"Will SUD treatment programs have the resources, knowledge and training to implement these new regulations in 30 days and then again by April 1, 2021, when the new CARES Act regulations are due?" asked Clark. "In addition, will patients be told the truth about the new regulations so that they can make informed decisions about whether they want to be in those treatment programs?
"Keep in mind that the CARES Act does not repeal the existing 42 USC 290dd and that these new regulations only amend the previous 42 CFR Part 2. Within the SAMHSA response to these new regulations, SAMHSA acknowledges that it will have to promulgate yet another round of regulations to conform to the CARES Act provisions, further taxing the resources of SUD programs big and small."
Clark views SAMHSA's strategy as one that is oriented toward extended‐release naltrexone (Vivitrol) instead of buprenorphine or methadone, both of which would be reported into the PDMP. This would "force patients who suffer from opioid use disorders who value their privacy and confidentiality to choose naltrexone over buprenorphine or methadone," he said. "Private providers who offer naltrexone for opioid use disorder treatment do not fall under 42 CFR Part 2, are generally not subject to PDMPs and, if the patient is paying out of pocket, may not be subject to HIPAA."
And regardless of what HHS says about patients supporting the changes, patient organizations say they don't. "Individuals in recovery are gravely concerned about the stripping away of SUD patient civil rights in the recent Part 2 updated rule," said Zachary C. Talbott, chief clinical officer of ReVIDA Recovery Centers, president of the National Alliance for Medication Assisted Recovery (NAMA Recovery), and president of the Alcoholism and Drug Abuse Certification Board of Georgia. " NAMA Recovery was only one of several organizations that represents individuals in recovery, and our comments were excluded from the official comments summary published earlier this year," Talbott told ADAW last week "The opioid crisis continues to worsen, and the allowance of OTPs uploading patient identifying information into PDMPs without patient consent will only further contribute to the crisis." Talbott lays the blame squarely on the federal government. "SAMHSA leadership has continued this administration's assault on vulnerable populations, and they should be ashamed."
Mark Parrino, president of the American Association for the Treatment of Opioid Dependence (AATOD), told ADAW he interprets the final rule as "allowing OTPs to make discretionary determinations based on the interests that the patients will express to OTP personnel." He thinks OTPs will respect the patient's wishes. "If the patient does not want their information to be shared, the OTP would respect the interests of the patient and would not input such data," he said. "It is also important to keep in mind that PDMPs are interested in medication that would be dispensed for take‐home purposes and would not be interested in collecting data with regard to the administration of on‐site dosages."
The Legal Action Center had not yet released its analysis of the final rule, and Parrino was eagerly awaiting that. But in the meantime, he said individual PDMPs would likely have their own interpretations of how the rule would apply to OTPs. "This could become a state‐by‐state issue," he said. "Ultimately, given AATOD's long‐standing policy in preserving the patients' right to confidential care and given the concerns of the patient advocacy organizations, we will plan on collaborating with such groups [NAMA Recovery, Faces & Voices of Recovery] as we provide guidance to the programs in our field. We will also work collaboratively with the Legal Action Center in providing such guidance. Our intent is not to undermine federal policy recommendations, but it is also not our intent to undermine the need to protect patient privacy when the patient expects us to do just that."
And the Legal Action Center did provide some answers on the PDMP issue last week to ADAW:
Nearly all states have laws that require certain entities to input information to the state's PDMP. Depending on the way the state law works, OTPs may be required by state law to input to the PDMP, and the changes to Part 2 now permit them to comply with this state law. Patient consent must be obtained before 42 CFR Part 2 programs can input information into the PDMP. Whether and how the state law requires OTPs to input the data into the OTP will determine what OTPs do. However, OTPs can guarantee that they will not put patient info into the PDMP without patient consent, as that would violate 42 CFR Part 2.
From an administrative law perspective, there is no step needed to formally revoke CSAT's 2011 Dear Colleague letter. A rulemaking takes precedence over informal guidance. However, the arguments in the Dear Colleague letter remain salient. There is still a prohibition against law enforcement using 42 CFR Part 2‐protected records to criminally investigate or prosecute a patient, and so it is unclear how PDMPs will be able to appropriately protect Part 2 records from law enforcement access or use that violates the prohibition on use.
As for buprenorphine and office‐based opioid treatment prescribers, most do not fall under 42 CFR Part 2, according to the Legal Action Center. Furthermore, the pharmacy, not the prescribing physician, would report information to the PDMP. It is dispensing, not prescribing, that the PDMP tracks.
"While it is understandable that methadone patients are scared, they should know that patient consent is still required for the disclosure of information into a PDMP," the Legal Action Center team told ADAW in an email. (The organization conducted a SAMHSA‐supported webinar on the final rule on July 15; by that morning, registration was full and closed.)
Parrino isn't sure what will happen to the 2011 "Dear Colleague Letter" from CSAT ordering OTPs not to input patient information in the PDMP. "I do think the majority of patients receiving buprenorphine through a DATA 2000 practice understand that their prescription information has been incorporated into statewide prescription monitoring systems," he said. "We will continue to work with all of our associates as we prepare the field for the implementation of these new regulations."
"We are concerned about the constant ebbing away of protections for people with SUD," said Philip Rutherford, chief operating officer of Faces & Voices of Recovery. "We participated vigorously in the public comment component of the rule changes and were disappointed to see the SAMHSA changes summarily included in the CARES Act."
The problem isn't sharing information between health providers, which individual patients most likely would consent to. "We understand that there are absolutely situations where clinicians need access to patient records to provide clinical care, and we support those," said Rutherford. "Our concern is overzealous pursuit by law enforcement and second‐ and third‐party interests that the most recent changes allow. The constant refrain is that HIPAA protections will suffice, but we are skeptical of this given the documented, marginalized nature of some people with SUD and their ability to mount a complaint or follow through with a prosecution of a complaint. Obviously, this is a nuanced issue, but we believe, until stigma surrounding SUD is on par with stigma surrounding other chronic illnesses, it represents a lack of equity to allow access to SUD patient records without the consent Part 2 was designed to protect. Clearly some of this is discussion about the barn doors after the horse is already gone, but important nonetheless. Our constituency is particularly engaged on this one."
The Drug Enforcement Administration (DEA) and DOJ have mainly been interested in medications, said Clark. The ability to place informants within a program for one year rather than six months is a concession to law enforcement. "One question is whether information garnered by confidential informants or undercover agents is restricted to 'crimes' committed by the program staff," said Clark. "Can information mined from patient records be used against individuals outside of the programs? For instance, Mary buys her drugs from Sam and discloses that information to her treatment group. Sam is the neighborhood dealer, unbeknownst to the DEA or local law enforcement. Can that information be used to indict Sam but not Mary? Let's make Sam Mary's live‐in boyfriend, the father of her baby. Mary discloses that information to the group. Can that information be used against Sam? And, if Mary has never disclosed that information to anyone other than her group, how will Mary or Sam respond? In another scenario, Mary discloses the information to her group or therapist. George is in the group; George knows Mary from the neighborhood and hears Mary's disclosure. A confidential informant in the group reports the information to the DEA, who seek out Sam. Upon hearing that the 'law' is interested in finding Sam, George discloses to Sam that Mary talked about his drug 'dealing' or use."
Clark is not only a psychiatrist, but a lawyer. These are the kinds of scenarios that SUD programs will have to discuss and to think about, he said. And he suggests that treatment providers follow the DOJ/DEA weekly reports. "If I were them, I wouldn't be so cavalier about relaxing 42 USC 290dd‐2. As I've said all along, the previous law and rules protected the program as well as the patients."
Legal issues remain, said Clark. "This revised rule offers lawyers and consultants an eight‐month bonanza helping SUD programs gear up to accommodate this 'final rule' only to have to retool for the new regulations required by the CARES Act," he said. "In the meantime, the marketplace will rescue the rich and those in the middle class willing to sacrifice thousands of dollars to protect their privacy" (possibly you can pay for your own treatment and not have it be reported, although this does not apply to methadone and OTPs).
"Tort lawyers in search of new money‐making activities will join the HIPAA bar" — and there will be torts, as patients find that treatment records can be used against them in everything from custody to divorce to employment to incarceration cases, said Clark. "Of course, I may be 'Chicken Little' and nothing adverse may happen, he said. "However, I believe that erring on the side of patient autonomy is preferable to 'Oops, we made a mistake.'"
For the final rule, go to https://
By Alison Knopf
Reported by Author
