SAMHSA Proposes First Revisions to Substance Abuse Medical Record Privacy Rules in Almost Three Decades

These proposed changes mark the first time the regulations have been subject to revision since 1987. The rules already provide more stringent protections for substance abuse treatment records than exist for other medical records under most health privacy laws, including the Health Insurance Portability and Accountability Act (HIPAA). The proposed revisions are part of an effort to modernize the regulations to facilitate information exchange within new integrated health care models that rely on the sharing of health care information, while still addressing the privacy concerns of patients seeking treatment for a substance abuse disorder. SAMHSA will accept comments on the proposed rules until April 11, 2016.

Major provisions of the proposed rules are described below.

Electronic Records

SAMHSA modernizes the focus of the regulations by addressing electronic records throughout the rules. In addition, SAMHSA proposes requirements for formal policies and procedures regarding the security of electronic health records, as well as for sanitizing electronic records. The proposed rules also permit patients to receive notice of their federal confidentiality rights by means of electronic documentation.

Consent Requirements

SAMHSA proposes important changes related to the requirements for patient consent to disclosures. Most notably, the proposed rules permit the use of broader descriptions of to whom a disclosure may be made. While the current rules require patients to specifically designate the name or title of the individual or the name of the organization to whom disclosures can be made, the proposed rules allow general designations such as “my current and future treating providers.” However, the proposed rules require that consent documents specify the particular Part 2 Program or lawful holder of the patients’ information that is permitted to make the disclosure. Also, a consent form must specifically identify the amount and kind of substance use disorder information to be disclosed, cautioning that a description such as “All of my records” or “only my substance use disorder records my family knows about” lack the specificity needed to meet this requirement.

Finally, covered programs and other lawful holders of patient identifying information would be required to obtain patients’ written confirmation that the patients understand the terms of their consent and their right to obtain, upon request, a list of disclosures.

List of Disclosures

The current regulations delineate no method by which patients can determine to whom records have been disclosed. Under the proposed rules, patients who have made general designations have a right to a listing of entities, but not specific individuals, to whom their information has been disclosed during the past two-year period.

Prohibition on Re-Disclosure

The regulations require that each disclosure made by a Part 2 Program or other lawful holder of the patient information include a statement prohibiting the recipient from re-disclosing any patient information that would identify the patient as having a substance use disorder. SAMHSA clarifies in the proposed rule that the prohibition on re-disclosure of substance abuse information does not apply to the entire patient record. Rather, the prohibition applies only to information that would identify, directly or indirectly, an individual with a substance use disorder. SAMHSA points out that re-disclosures of illnesses stemming from drug or alcohol abuse and medications used to treat substance use disorders might suggest that the individual has a substance use disorder, and therefore re-disclosures of this information would be prohibited unless the disclosure is expressly permitted by the patient in writing or otherwise permitted by the rule.

Research

The proposed regulations also broaden the circumstances in which disclosures are permitted for research purposes. Currently, only Part 2 Program directors are authorized to disclose patient identifying information for research. SAMHSA proposes permitting disclosures by any Part 2 program entity or lawful holder of patient information for research purposes, if the researcher has documentation indicating compliance with HIPAA and/or the Federal Policy for the Protection of Human Subjects (the “Common Rule”), which provides protections to individuals who participate in most research funded or conducted by the federal government. SAMHSA proposed this revision based on its belief that the HIPAA and Common Rule protections provide adequate safeguards for patient confidentiality due to the required review by Institutional Review Boards. (Institutional Review Boards, or “IRBs,” review and approve human research projects for compliance with requirements imposed by the Office of Human Research Protections, HIPAA, and the Common Rule (when applicable).)

Deadline for Comments: April 11, 2016

As noted above, SAMHSA is accepting comments on the proposed rules until April 11, 2016. Part 2 Programs and others subject to the rules should review the proposed revisions carefully to determine how they might impact operations and whether they should submit comments. Participants in integrated healthcare models especially should determine whether the new rules would achieve the stated goals of facilitating information exchange within these networks.