In two separate proposals, the Substance Abuse and Mental Health Services Administration (SAMHSA) last month proposed radical changes to the confidentiality of substance use disorder (SUD) treatment records under 42 CFR Part 2. Both were in a Notice of Proposed Rulemaking (NPRM) and were published in the Federal Register Aug. 26.
The federal government is proposing rollbacks on confidentiality, with one allowing law enforcement "fishing expeditions" into treatment centers and the other eliminating many of the consent provisions and allowing methadone patient information to go into PDMPs.
In two separate proposals, the Substance Abuse and Mental Health Services Administration (SAMHSA) last month proposed radical changes to the confidentiality of substance use disorder (SUD) treatment records under 42 CFR Part 2. Both were in a Notice of Proposed Rulemaking (NPRM) and were published in the Federal Register Aug. 26.
The longer general NPRM recommends revisions that would weaken protections against unauthorized disclosure of patient treatment records. Key to 42 CFR Part 2 is the requirement that patients consent to the release of their records. Treatment programs have complied with this regulation for its almost four decades of existence. The comment deadline for that NPRM is Oct. 25.
The short law enforcement NPRM applying to Section 2.63 got much less press but is far more drastic: It would allow law enforcement to access patient records in the event of a serious crime, even those records of patients not alleged to have committed a crime, and would redefine serious crime to include anything related to drugs. The comment deadline for this NRPM is Sept. 25.
"For the first time in the history of 42 CFR Part 2, the explanatory language in the preamble of the Section 2.63 extends its interpretation to drugs," said H. Westley Clark, M.D., J.D., dean's executive professor at Santa Clara University. "The historical language focused on serious crimes of violence or child abuse."
The preamble's explanatory language makes it clear that drug‐related crimes don't have to be committed by the patient. "In short, all patient records could be screened for evidence of wrongdoing by the patient, the Part 2 program or people the patient knows," said Clark. "Now HHS and DOJ want the courts to authorize using patient records to go on fishing expeditions in search of drug trafficking at or from Part 2 programs."
The preamble to the revision of Section 2.63 also uses as justification the growth of Part 2 programs in the wake of the opioid crisis, said Clark. "This makes it clear that buprenorphine clinicians are also the intended targets of this fishing expedition," he said.
Clark said it's surprising that only 30 days are given to respond to this law enforcement NPRM despite its dramatic expansion. In addition, HHS offers no data supporting the need for this expanded interpretation of the reach of Section 2.63, he said. There are only two justifications the government gives for leaving out the phrase "crimes allegedly committed by the patient," which was inserted in 2017, is that it was inserted erroneously. The other justification is the opioid epidemic.
The only justification offered is anecdotal and speculative. In fact, it is contended that HHS and DOJ have a basis for abandoning the 2017 insertion of the phrase "crimes allegedly committed by the patient." Yet no evidence from DOJ is presented.
However, 42 CFR Part 2 applies not only to opioid treatment programs, but to programs that treat all substance use disorders, including alcohol use disorders. Why this section wasn't included as part of the larger NPRM that revamps 42 CFR Part 2 is not clear.
"The Section 2.63 NPRM pretends to be a simple correction of the 2017 revision of Section 2.63," said Clark. "It is not." Clearly, he said, the reason that phrase was added in 2017 is "self‐evident" — that only the records of the patient who allegedly committed the serious crime should be opened up. In addition, there appears to be no objection by the public to the 2017 revision, noted Clark.
"Clinicians should be alarmed by this almost clandestine effort to broaden the interpretation of Section 2.63," he said.
The NPRM also contains provisions that would allow opioid treatment programs (OTPs, or methadone clinics) to put patient information into the prescription drug monitoring program (PDMP). In a 2011 "Dear Colleague Letter" from Clark, then director of SAMHSA's Center for Substance Abuse Treatment (CSAT), OTPs are instructed not to give any patient information to PDMPs, but to get information about their patients to avoid dangerous drug interactions). At the Aug. 22 stakeholder call in which HHS announced the forthcoming NPRMs, we asked SAMHSA administrator Elinore McCance‐Katz, M.D., Ph.D., if that "Dear Colleague Letter" would be rescinded. "Times change, Alison," she responded. ("It's gone," Clark ruefully told us after the call.)
For a decade, physicians have clamored to find out who was on methadone, as they didn't trust their patients to tell them. Well, now they can. But patients, represented by NAMA, don't like it, and neither do OTPs, the American Association for the Treatment of Opioid Dependence (AATOD) or Treatment Communities of America.
The SAMHSA NPRM, despite its drastic weakening of confidentiality, is not as severe as proposals to make 42 CFR Part 2 like the Health Insurance Portability and Accountability Act (HIPAA), which only gives patients the right to see their own information, and doesn't require them to consent to the release of their records. Under SAMHSA's NPRM, the consent requirement would be maintained but greatly weakened, with no rules governing redisclosure, and with consent only having to go to a general organization and not to a specific person. As it is, HIPAA allows the release of records without consent for the vaguely defined "health care operations."
The Campaign to Protect Patient Privacy Rights maintains weakening existing protections will only prevent people who need SUD treatment from entering care out of fear that their private health information would be used against them in harmful ways.
While the proposed new rule maintains patient consent in initial disclosure, it does not uphold consent in redisclosure, effectively leaving patients vulnerable to harm through unauthorized redisclosure after initial consent to a single provider.
"While the Legal Action Center strongly supports the need for coordinated flow of health information between providers, it must be done so with patient consent in disclosure and redisclosure. It is paramount that patient privacy remains a cornerstone of health care delivery and that Part 2 is maintained to safeguard individuals in SUD treatment from harm," said Paul Samuels, president and director of the Legal Action Center. He adds, "The confidentiality rule is not a hindrance to the facilitation of effective services, but a necessary protection for individuals who would otherwise be susceptible to a multitude of detrimental consequences if their SUD information was disclosed without their permission to potential employers, housing providers, law enforcement and more." "I will no longer be actively disclosing my SUD treatment history to doctors or medical staff....Additionally, for those working in OTPs, if this regulatory change passes, please do not start reporting your clients into the PDMP." Robert D. Ashford
"If the Trump administration wants to turn the tide on this national health epidemic, it should start with the premise that it can and must make the situation better by focusing on pragmatic, real‐world solutions that improve clinical coordination and patient outcomes," said Clark. "With over 90% of people with substance use disorders not currently accessing treatment, weakening the current protections for patient privacy contained in Part 2 will not fix what is broken. Instead, it will drive even more people away from substance use disorder treatment and penalize the over 20 million people in recovery from substance use disorders."
"In the midst of the worst opioid epidemic in our nation's history, we cannot afford to have patients fearful of seeking treatment because they do not have faith that their confidentiality will be protected," said Mark Parrino, AATOD president. "Patients are already anxious about the proposed new rule and the threat of opioid treatment programs sharing their sensitive health information through their state prescription drug monitoring programs, which may be accessible to entities like law enforcement, who could then use the information to prosecute patients."
"I will no longer be actively disclosing my SUD treatment history to doctors or medical staff," said Robert D. Ashford, a person in long‐term recovery and Ph.D. candidate at the University of the Sciences. "I do not want my life insurance or health insurance rates to go up. I also don't want my SUD treatment history to be part of the EHR when there are hundreds of HIPAA breaches every year. Additionally, for those working in OTPs, if this regulatory change passes, please do not start reporting your clients into the PDMP. Law enforcement has regular access to such databases, and stigma is alive and well unfortunately. Your patients deserve privacy and protection while engaged in your care."
"Many of us would not have gone to treatment or accepted services if we thought that our information would have been shared with other entities without our permission," said Patty McCarthy Metcalf, executive director of Faces & Voices of Recovery. "We would not have put our careers, reputation or families at risk of stigma and discrimination if we were not assured that information about our substance use disorder was safe and would only be shared with our consent."
"For pregnant and parenting women, this rule change could be particularly disastrous," said Lynn Paltrow, executive director of National Advocates for Pregnant Women. "Many women across the country face punitive and counterproductive state action, including arrest, if their pregnancies and substance dependency problems are not kept confidential. Fear of exposure, arrest and other punitive state action have repeatedly been shown to discourage women from seeking health care during pregnancy and when giving birth. A commitment to maternal, fetal and child health requires that the Part 2 protections remain in effect."
State Opioid Response (SOR) grants are announced, coming from the $1.5 billion allocated by Congress for fiscal year 2019. The Substance Abuse and Mental Health Services Administration (SAMHSA) is distributing $930 million a year, each year for three years, for these grants. States have considerable leeway into how to use the money, and can use it for recovery and other programs, not just treatment. Below is the state‐by‐state distribution as announced by SAMHSA last week.
For more information, go to https://
Source: Department of Health and Human Services
SOR Year 1 SOR Supplement SOR Year 2 TOTAL Alabama $13,744,136.00 $7,174,439.00 $13,744,136.00 $34,662,711.00 Alaska $4,027,823.00 $2,102,524.00 $4,027,823.00 $10,158,170.00 American Samoa $250,000.00 $130,500.00 $250,000.00 $630,500.00 Arizona $20,269,303.00 $10,580,576.00 $20,269,303.00 $51,119,182.00 Arkansas $5,171,376.00 $2,699,458.00 $5,171,376.00 $13,042,210.00 California $69,841,479.00 $36,457,252.00 $69,841,479.00 $176,140,210.00 Colorado $15,093,156.00 $7,878,627.00 $15,093,156.00 $38,064,939.00 Connecticut $11,129,713.00 $5,809,710.00 $11,129,713.00 $28,069,136.00 Delaware $12,594,583.00 $6,574,372.00 $12,594,583.00 $31,763,538.00 District of Columbia $21,126,788.00 $11,028,183.00 $21,126,788.00 $53,281,759.00 Federated States of Micronesia $250,000.00 $130,500.00 $250,000.00 $630,500.00 Florida $50,056,851.00 $26,129,676.00 $50,056,851.00 $126,243,378.00 Georgia $19,881,735.00 $10,378,266.00 $19,881,735.00 $50,141,736.00 Guam $250,000.00 $130,500.00 $250,000.00 $630,500.00 Hawaii $4,036,648.00 $2,107,130.00 $4,036,648.00 $10,180,426.00 Idaho $4,111,165.00 $2,146,028.00 $4,111,165.00 $10,368,358.00 Illinois $28,989,372.00 $15,132,452.00 $28,989,372.00 $73,111,196.00 Indiana $18,147,223.00 $9,472,850.00 $18,147,223.00 $45,767,296.00 Iowa $4,418,025.00 $2,306,209.00 $4,418,025.00 $11,142,259.00 Kansas $4,047,286.00 $2,112,683.00 $4,047,286.00 $10,207,255.00 Kentucky $31,477,846.00 $16,431,436.00 $31,477,846.00 $79,387,128.00 Maine $4,422,797.00 $2,308,700.00 $4,422,797.00 $11,154,294.00 Maryland $33,169,407.00 $17,314,430.00 $33,169,407.00 $83,653,244.00 Massachusetts $35,879,685.00 $18,729,196.00 $35,879,685.00 $90,488,566.00 Michigan $27,914,639.00 $14,571,442.00 $27,914,639.00 $70,400,720.00 Minnesota $8,870,906.00 $4,630,613.00 $8,870,906.00 $22,372,425.00 Mississippi $7,635,172.00 $3,985,560.00 $7,635,172.00 $19,255,904.00 Missouri $18,364,038.00 $9,586,028.00 $18,364,038.00 $46,314,104.00 Montana $4,030,370.00 $2,103,853.00 $4,030,370.00 $10,164,593.00 Nebraska $4,030,457.00 $1,000,000.00 $4,030,457.00 $9,060,914.00 Nevada $7,219,593.00 $3,768,628.00 $7,219,593.00 $18,207,814.00 New Hampshire $22,982,608.00 $11,996,921.00 $22,982,608.00 $57,962,137.00 New Jersey $21,566,035.00 $11,257,470.00 $21,566,035.00 $54,389,540.00 New Mexico $5,307,273.00 $2,770,397.00 $5,307,273.00 $13,384,943.00 New York $36,831,809.00 $19,226,204.00 $36,831,809.00 $92,889,822.00 North Carolina $23,033,316.00 $12,023,391.00 $23,033,316.00 $58,090,023.00 North Dakota $4,020,043.00 $2,098,462.00 $4,020,043.00 $10,138,548.00 Northern Mariana Islands $250,000.00 $130,500.00 $250,000.00 $630,500.00 Ohio $55,790,598.00 $29,122,692.00 $55,790,598.00 $140,703,888.00 Oklahoma $7,650,315.00 $3,993,464.00 $7,650,315.00 $19,294,094.00 Oregon $7,872,110.00 $4,109,241.00 $7,872,110.00 $19,853,461.00 Palau $250,000.00 $‐ $250,000.00 $500,000.00 Pennsylvania $55,928,733.00 $29,194,799.00 $55,928,733.00 $141,052,265.00 Rhode Island $12,595,087.00 $6,574,635.00 $12,595,087.00 $31,764,809.00 South Carolina $14,254,324.00 $7,440,757.00 $14,254,324.00 $35,949,405.00 South Dakota $4,019,346.00 $2,098,099.00 $4,019,346.00 $10,136,791.00 Tennessee $18,543,089.00 $9,679,492.00 $18,543,089.00 $46,765,670.00 Texas $46,229,092.00 $24,131,586.00 $46,229,092.00 $116,589,770.00 Utah $7,958,628.00 $4,154,404.00 $7,958,628.00 $20,071,660.00 Vermont $4,020,896.00 $2,098,908.00 $4,020,896.00 $10,140,700.00 Virgin Islands $250,000.00 $130,500.00 $250,000.00 $630,500.00 Virginia $15,809,989.00 $8,252,814.00 $15,809,989.00 $39,872,792.00 Washington $21,573,093.00 $11,261,155.00 $21,573,093.00 $54,407,341.00 West Virginia $28,027,511.00 $14,630,361.00 $28,027,511.00 $70,685,383.00 Wisconsin $11,979,333.00 $6,253,212.00 $11,979,333.00 $30,211,878.00 Wyoming $4,015,297.00 $2,095,985.00 $4,015,297.00 $10,126,579.00
Part of the NPRM "would specify that audits or evaluations may include periodic activities to identify actions that an agency or third‐party payer entity can make, such as changing its policies or procedures to improve patient care and outcomes across Part 2 programs; targeting limited resources more effectively; or determining the need for adjustments to payment policies for the care of patients with SUD. This change would clarify that disclosures of patient records by a Part 2 program to an agency or third‐party payer entity are permitted for these purposes without patient consent." This would "permit patient identifying information to be disclosed to federal, state, and local government agencies, as well as their contractors, subcontractors, and legal representatives of such agencies, in the course of conducting audits or evaluations mandated by statute or regulation, if those audits or evaluations cannot be carried out using deidentified information."
This concerns Bill Stauffer, executive director of the Pennsylvania Recovery Organizations — Alliance and co‐chair of the public policy committee of Faces & Voices of Recovery. "Taken broadly, it is unclear how the patient could possibly maintain control over their information if patient‐identifying information would now be allowable under the proposed rule change and part of the periodic audit and evaluation process," Stauffer told ADAW. "A great deal of patient‐identifying data would now be permitted to be shared across government entities, their contractors and subcontractors without need for patient consent for things like payment determination and resource allocation. It is important to understand that, historically, such information has been used to limit care — not to extend it. One also wonders how secure it is, which is a particular concern now that patient‐identifying information would be permissible in the audit and evaluation processes."
"Those who oppose 42 CFR Part 2 see no contradiction in what they want and what patients want," Clark told us. "Advocates for change persist in refusing to acknowledge that talking to the patient is a solution to wanting to know how best to treat a patient. Direct patient communication is being subverted by the fantasy that open access to a patient's medical record is all that is needed, even when the evidence demonstrates that as more information pours into a patient's record, the less able the clinician can process that information."
There was once a way to incorporate consent into the electronic health record — something Clark had shepherded through when he was at CSAT. However, the SAMHSA Consent2Share platform is now abandoned. Still, there are confidentiality solutions like "automated metadata tagging or digital labeling of data elements," Clark said.
Why do electronic health records want so much information about patients? "Clearly, the issue isn't what information can be gotten from the EHR to benefit the patient, but what information can be gotten from the EHR that can identify the patient," said Clark. "That people with SUDs are not being considered in the balancing of interests suggests an agenda beyond treatment."
Ultimately, increased litigation against SUD treatment providers can be expected, if patient information is released and patients are harmed. Job loss, custody loss and more can all follow release of SUD treatment data.
- NPRM — Regulatory Information Number 0930‐AA30 : https://www.govinfo.gov/content/pkg/FR‐2019‐08‐26/pdf/2019‐17816.pdf. Deadline for submitting public comments: 5 p.m. on Sept. 25, 2019.
- NPRM — Regulatory Information Number 0930‐AA32 : https://www.govinfo.gov/content/pkg/FR‐2019‐08‐26/pdf/2019‐17817.pdf. Deadline for submitting public comments: 5 p.m. on Oct. 25, 2019.
By Alison Knopf
Reported by Author
