/ en Mon, 28 Apr 2025 03:08:28 -0500 Mon, 30 Jan 23 09:18:45 -0600 /lettercomment/2023-01-30-aha-comments-proposed-revisions-regulations-governing-confidentiality-substance-use-disorder-records <p>January 30, 2023</p> <p>Miriam E. Delphin-Rittmon, Ph. D.<br /> Assistant Secretary for Mental Health and Substance Use<br /> U.S. Department of Health and Human Services, Office for Civil Rights<br /> Hubert H. Humphrey Building, Room 509F<br /> 200 Independence Avenue SW<br /> Washington, DC 20201</p> <p>Dear Dr. Delphin-Rittmon:</p> <p>On behalf of our nearly 5,000 member hospitals, health systems and other health care organizations, and our clinician partners – including more than 270,000 affiliated physicians, 2 million nurses and other caregivers – and the 43,000 health care leaders who belong to our professional membership groups, the ���������� Association (AHA) appreciates the opportunity to comment on the proposed revisions to the regulations governing the confidentiality of substance use disorder (SUD) records, commonly known as 42 CFR Part 2 (“Part 2”). We appreciate that the Substance Abuse and Mental Health Services Administration (SAMHSA) is taking steps to align requirements under Part 2 regulations with those under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, as we and many other stakeholders have requested.</p> <p>The out-of-date, arbitrary and confusing regulations currently described in Part 2 fail to protect patient privacy and erect sometimes insurmountable barriers to providing coordinated, whole-person care to people with a history of SUD. The AHA has long advocated that the HIPAA requirements be the prevailing nationwide standard for protecting the privacy and security of all patient information. While by no means without its own regulatory impediments to the appropriate use and disclosure of patients’ personal health information (PHI) necessary to support clinical integration and population health improvement, the HIPAA Privacy Rule generally permits covered entities, like hospitals and other health care providers, to share PHI for purposes of treatment, payment and health care operations without having to obtain each individual patient’s authorization. <strong>Thus, we support SAMHSA’s proposal to align definitions as well as the requirement for only a single patient consent in perpetuity for appropriate use and disclosure</strong>. We appreciate that SAMHSA attempts to balance the streamlining of patient information sharing requirements with new patient rights and protections in order to ensure that improved care coordination does not pose a threat to individual privacy.</p> <p>However, the rule does not address the underlying separate regulatory structure governing Part 2 programs and patient information generated therein; this separation and accompanying requirement to segregate records pertaining to SUD information continues to stymie the integration of behavioral and physical health care because the patient data cannot be used and disclosed like all other health care data. Theoretically, because this rule would apply the same or similar protections and processes to all patient data, integration might be possible; realistically, though, health information technology does not exist or operate in a way that can distinguish between Part 2 and non-Part 2 data.</p> <p>We understand that SAMHSA lacks the authority to circumvent the existing statutory structure. As reform of the statute remains under the purview of the legislative branch, <strong>we urge SAMHSA to work with Congress to update the statutory framework to allow for meaningful integration of SUD and physical health care and to resolve the statutory conflicts that prevent full alignment of Part 2 with the HIPAA requirements that govern all other patient health information.</strong></p> <p>We also believe that there is still work SAMHSA can do to allow health care practitioners to provide whole-person care that is appropriately informed by the totality of relevant patient information. We urge the agency to provide additional clarity and guidance in the final rule regarding how to operationalize the changes adopted.</p> <p>For example, even though SAMHSA issued a rule to clarify existing requirements under Part 2 in 2019,<strong> the field continues to lack clarity in the definition of a “Part 2” versus a “non-Part 2 provider</strong>.” The statute defines Part 2 providers as alcohol and drug treatment programs that receive federal funds in any form, including Medicare or Medicaid funding or via their tax-exempt status, and “hold themselves out as providing” alcohol or drug abuse diagnosis, treatment or referral for treatment. However, the phrase “hold themselves out” is not well defined in the proposed regulations.</p> <p>In the regulation, SAMHSA exempts general medical facilities and medical practices from information sharing restrictions, but simultaneously limits that exemption for Part 2 providers. In other words, general facilities and practices are excluded from the scope of the Part 2 regulation, and thereby from complying with the significant regulatory constraints imposed on sharing a patient’s behavioral health data, but only if they do not “hold themselves out” as providing SUD diagnosis, treatment or referral for treatment and the “primary function” of their medical personnel or other staff is not the provision of, and they are not identified as providing, such services. Yet, many general facilities and providers not only offer these services but make their availability known to their communities. Thus, in practice, general medical facilities and practices actually may not be exempt—depending on interpretations of “hold themselves out” and “primary function.” <strong>We believe that further clarification on who is included in these definitions is needed</strong>.</p> <p>In the current care environment, where there is expanding emphasis on integration and coordination of behavioral health care with physical health care and where the prevailing location for delivery of that care is the general medical facility or medical practice, Part 2 requirements are likely to be interpreted by providers as applying to many more treatment settings and providers. <strong>We, therefore, urge SAMHSA to address this topic in the final rule and issue detailed guidance about how providers should determine whether they are “holding themselves out,” or whether the “primary function of their medical personnel or other staff is the provision of and they are identified as providing” the enumerated services</strong>. In other words, SAMHSA should provide definitions as to what “holding oneself out as providing” specifically entails — is this designation limited to organizations that advertise drug treatment services, or does it extend to those who are known to locals as providing these services? Does it extend to any organization that has billed for or provided referrals for such services? Without such clarity, the progress that this rule would make in streamlining information-sharing processes to improve care coordination may be moot.</p> <p>For organizations that clearly consider themselves to be Part 2 providers, the need to segregate patient records regarding SUD has proven an enormous technical challenge. Even the most sophisticated electronic health record (EHR) modules lack the capability of automatically flagging or separating Part 2 records; in other words, there is currently no protocol for protecting SUD treatment information while integrating behavioral health records within current EHR systems. We believe that this capability is possible, and with some of the regulatory barriers out of the way if provisions in this rule are finalized, would mean that providers would better be able to access relevant information when clinically appropriate and necessary. However, SAMHSA has not addressed these health IT issues in the proposed rule.</p> <p>The agency does propose to extend HIPAA enforcement penalties for information breaches; <strong>without providing guidance, support and time for Part 2 providers to modify and enhance their health IT and EHR capabilities, it is unreasonable to hold them to information protection standards beginning in 2024</strong>. We thus recommend that SAMHSA work with the Office of the National Coordinator as well as the health IT vendor community to develop plans, certification criteria and support resources to ensure that patient information is meaningfully protected and providers have the resources to put these protections in place without undue burden.</p> <p>We also recommend that SAMHSA introduce a phase-in period for enforcement, as the complex nature of compliance with Part 2 regulations is already a deterrent to take on patients with SUD without threat of monetary penalty. Providers are willing and committed to provide coordinated, whole-person care; they need the technical tools and capabilities to be able to do it.</p> <p>The AHA appreciates the balance that SAMHSA is attempting to strike between protections for patient information and avenues to appropriately share information for coordinated care. We think that many of the proposed changes, particularly the proposal to allow for a single collection of patient consent for use and disclosure rather than individual consents for each instance of use or disclosure, will greatly ease barriers between providers and care coordination, as will the allowance for health insurers to access information as part of treatment, payment and operations. Similarly, as we have urged before, the proposal to allow disclosures of de-identified information for public health purposes is likely to help improve population health efforts. We recognize that SAMHSA is looking to offset the seeming “relaxation” of the standards by creating new patient rights and protections, such as the right to request an accounting of all disclosures and right to revoke consent at any time. While we support these patient rights, we believe the agency is overemphasizing the social harms that disclosing this clinical information creates, at the risk of medical harms and overdose deaths that are a consequence of poor care coordination.</p> <p>We encourage SAMHSA to provide guidance on precisely what is expected of providers as they incorporate processes to respect these patient rights if the provisions are finalized as proposed. For example, SAMHSA could provide a template for the accounting of disclosures that includes the level of detail necessary. We also look forward to the accompanying rules on non-discrimination regarding Part 2 programs and SUD information, which we hope will provide additional protections for patients from discrimination based on their health care treatments.</p> <p>Again, we thank you for your consideration of our comments. Please contact me if you have questions or feel free to have a member of your team contact Caitlin Gillooley, director of policy, at <a href="mailto:mailto:cgillooley@aha.org">cgillooley@aha.org</a> or 202-626-2267.</p> <p>Sincerely,</p> <p>/s/</p> <p>Ashley Thompson<br /> Senior Vice President<br /> Public Policy Analysis and Development</p> Mon, 30 Jan 2023 09:18:45 -0600 42 CFR-Part 2, Confidentiality Regulations for SUD /special-bulletin/2022-11-30-hhs-proposes-overhaul-information-sharing-requirements-addiction-treatment <div class="container"> <div class="row"> <div class="col-md-8"> <p>In a <a href="https://www.federalregister.gov/public-inspection/2022-25784/confidentiality-of-substance-use-disorder-patient-records">notice of proposed rulemaking </a>released Nov. 28, the Department of Health & Human Services (HHS)’s Office for Civil Rights and the Substance Abuse and Mental Health Services Administration proposed to modify certain provisions of part 2 of title 42 of the Code of Federal Regulations, commonly known as 42 CFR Part 2 (or Part 2), to align requirements for patient records regarding treatment for substance use disorder (SUD) with those in effect under the Health Insurance Portability and Accountability Act (HIPAA)’s Privacy Rule.</p> <p>These modifications were required by the Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020; other proposals, while not expressly required by the CARES Act, seek to improve or clarify existing regulations in the spirit of the legislation’s intent. Even before the legislation’s passage, AHA, along with the Partnership to Amend 42 CFR Part 2, has for several years advocated for these changes.</p> <p>The proposed amendments would: modify and add new patient rights regarding consent and redisclosure of patient records, prohibitions on discrimination, and Notice of Privacy Practices under HIPAA; streamline requirements for patient consent for use and disclosure of Part 2 records; and create within HHS new enforcement authority.</p> <h3>What You Can Do</h3> <ul> <li>Share this bulletin with the appropriate members of your leadership teams</li> <li>Review <a href="/topics/42-cfr-part-2-confidentiality-regulations-sud">previous work</a> from AHA on 42 CFR Part 2, including our 2020 <a href="/lettercomment/2020-04-28-aha-others-urge-hhs-expedite-revising-rule-42-cfr-part-2-provisions-cares">letter</a> to HHS regarding implementation of the related CARES Act provisions</li> <li>Submit to HHS comments on the rule by Jan. 31, 2023, at <a href="http://www.regulations.gov/">www.regulations.gov</a></li> </ul> <div class="panel-body"> <h3><span>Key Highlights</span></h3> <p>CMS’ policies will:</p> <ul> <li>Increase Medicare hospital OPPS rates by a net 3.8% in CY 2023 compared to 2022.</li> <li> Finalize payment for 340B hospitals at average sales price (ASP) plus 6% for CY 2023 given the unanimous favorable Supreme Court decision.</li> <li>Defer the proposal for a remedy for the unlawful 340B policy for CYs 2018-2022 until sometime before next year’s CY 2024 OPPS payment rule.</li> <li>Establish, beginning on Jan. 1, 2023, the Rural Emergency Hospital (REH) model, a new provider type for eligible critical access hospitals and small rural hospitals. The rule finalized proposals related to model payment, covered services, conditions of participation and quality measurement.</li> <li>Exempt rural sole community hospitals (SCHs) from the site-neutral clinic visit cuts, and instead pay for clinic visits furnished in grandfathered (excepted) off-campus provider-based departments (PBDs) of these hospitals at the full OPPS rate.</li> <li>Continue payment for remote behavioral health services beyond the end of the public health emergency (PHE) permanently.</li> <li>Require prior authorization for an additional service category — facet joint injections and nerve destruction.</li> <li>Revise the IPO list to remove 11 services and add eight services.</li> <li>Add four procedures to the ASC CPL.</li> </ul> </div> </div> --> <h3>Summary of Major Provisions</h3> <p>In this proposed rule, HHS seeks to revise, delete, replace or add regulatory language to the Part 2 regulations to align them with those under HIPAA, as well as to improve clarity or readability. The agency notes that it will issue a separate rule on CARES Act provisions related to antidiscrimination prohibitions.</p> <p>The following summarizes proposed amendments that would make substantive changes to rights or requirements, but does not list all proposed provisions, i.e., this summary excludes provisions that would make editorial or typographical updates rather than policy changes.</p> <p><strong>Definitions.</strong> HHS proposes to add thirteen defined regulatory terms and modify the definitions of ten existing terms referenced in the Part 2 regulations. Most of these terms and definitions would be based on existing HIPAA regulatory terms and definitions; others would be modified for clarity and consistency. Generally, the agency proposes to define “HIPAA” and “HIPAA regulations” as encompassing statutory and regulatory provisions pertaining to privacy, security, breach notification and enforcement standards with respect to protected health information only; the definition would exclude other HIPAA standards not relevant to the rule (for example, standard electronic transitions or code sets).</p> <p><strong>Patient Rights.</strong> In order to protect against inappropriate use or disclosure of Part 2 records, HHS also proposes new patient rights, restrictions on redisclosures and protections against use of Part 2 records in legal proceedings. Specifically, the agency would:</p> <ul> <li>create the right to an accounting of disclosures using a standard that mirrors the HIPAA Privacy Rule;</li> <li>create the right to request restrictions on otherwise permitted disclosures;</li> <li>require Part 2 programs to establish a process to receive complaints of Part 2 violations, prohibit these programs from taking adverse action against patients who file complaints, and prohibit these programs from requiring individuals to waive their right to file a complaint as a condition of service;</li> <li>and expand and clarify prohibitions on the use of Part 2 records in legal proceedings without court order or patient consent.</li> </ul> <p><strong>Consent for Redisclosure.</strong> HHS proposes to streamline requirements to obtain patient consent to disclose Part 2 records. Specifically, the agency would permit:</p> <ul> <li>Part 2 programs to use and disclose Part 2 records for the purposes of all future treatment, payment and health care operations based on a single patient consent, rather than obtaining consent upon each disclosure (patients would have the right to revoke this consent in writing); and</li> <li>redisclosure of Part 2 records in any manner permitted under the HIPAA Privacy Rule (with some exceptions).</li> </ul> <p><strong>Enforcement.</strong> The agency proposes to extend enforcement mechanisms created and implemented through HIPAA and the HITECH Act to Part 2 violations. Specifically, HHS would create enforcement authority for itself to impose civil monetary penalties for violations.</p> <p><strong>Standards.</strong> HHS also proposes to apply existing standards under HIPAA and HITECH to Part 2 programs, including standards for:</p> <ul> <li>breach notification;patient notice of confidentiality; and</li> <li>de-identification of data for research.</li> </ul> <p>HHS also would update the HIPAA Privacy Rule Notice of Privacy Practices requirements to address uses and disclosures of Part 2 records.</p> <p><strong>Effective and Compliance Dates.</strong> Finalized provisions will be effective 60 days after the publication of the final rule. However, the compliance date – the date by which entities subject to the rule must establish and implement policies and practices to achieve compliance – would not occur until 22 months after the effective date. In other words, even if all provisions are finalized as proposed, current Part 2 regulations will remain in effect until 2025.</p> <h2>Further Questions</h2> <p>If you have further questions, please contact Caitlin Gillooley, AHA’s director of behavioral health and quality policy, at <a href="cgillooley@aha.org">cgillooley@aha.org</a> or 202-626-2267.</p> </div> <div class="col-md-4"> <p class="text-align-center"><a href="/system/files/media/file/2022/11/2022-11-30_SB_HHS_Proposed_Overhaul_SUD_Treatment_Information_Sharing.pdf" target="_blank"><img alt="Cover Special Bulletin: HHS Proposes Overhaul of Information-Sharing Requirements for Addiction Treatement, November 30, 2022" data-entity-uuid="" src="/sites/default/files/2022-11/sb-cares-42cfrpart2.png" /></a></p> </div> </div> </div> Wed, 30 Nov 2022 11:17:24 -0600 42 CFR-Part 2, Confidentiality Regulations for SUD /advisory/2020-07-15-samhsa-issues-final-rule-substance-use-treatment-information-sharing <div class="container"> <div class="row"> <div class="col-md-8"> <p class="text-align-center"><a class="btn btn-primary btn-wide" href="/system/files/media/file/2020/07/samhsa-issues-final-rule-substance-use-treatment-information-sharing-advisory-7-15-20.pdf"><i aria-hidden="true" class="fa fa-download"><span class="sr-only">dl icon</span></i>Sign in to Download the Regulatory Advisory:<br /> SAMHSA Issues Final Rule on Substance Use Treatment Information Sharing</a></p> <p> </p> <p>The Substance Abuse and Mental Health Services Administration (SAMHSA) July 13 issued a <a href="https://www.federalregister.gov/documents/2020/07/15/2020-14675/confidentiality-of-substance-use-disorder-patient-records">final rule</a> to amend sections of the Code of Federal Regulations (CFR) that dictate restrictions on how federally assisted alcohol or drug abuse programs may use and share patient information. The effective date of the rule is Aug. 14.<br />  </p> </div> <div class="col-md-4"> <div class="panel module-typeC"> <div class="panel-heading"> <h3 class="panel-title">Key Takeaways</h3> </div> <div class="panel-body"> <p>The rule finalizes proposals to:</p> <ul> <li>Clarify that treatment records created by non-part 2 providers</li> <li>Allow opioid treatment programs to enroll in and submit data to prescription drug monitoring programs (PDMPs).</li> <li>Allow patients to consent to disclosure of treatment records to an entity without naming a specific person as recipient.</li> </ul> </div> </div> </div> </div> </div> Wed, 15 Jul 2020 14:41:06 -0500 42 CFR-Part 2, Confidentiality Regulations for SUD /lettercomment/2020-04-28-aha-others-urge-hhs-expedite-revising-rule-42-cfr-part-2-provisions-cares <p>AHA, others make an urgent request that the Department of Health and Human Services (HHS) issue a rule as soon as possible on the 42 CFR Part 2 (Part 2) provisions in the Coronavirus Aid, Relief, and Economic Safety Act (CARES Act).</p> Tue, 28 Apr 2020 14:30:33 -0500 42 CFR-Part 2, Confidentiality Regulations for SUD /lettercomment/2019-10-25-aha-comments-samhsas-proposed-rule-confidentiality-substance-use-disorder <p class="MsoNormal">The AHA recognizes that SAMHSA is statutorily constrained in making structural amendments to the regulations under 42 CFR Part 2; however, because the proposed rule would not change the basic framework of Part 2, which significantly impedes the robust sharing of patient information necessary for effective clinical integration, we continue to urge full alignment of the Part 2 regulation with the HIPAA regulation as the proper and effective solution to eliminating barriers to the sharing of patient information.</p> <p class="MsoNormal">While reform of the statute remains the purview of the legislative branch, we urge SAMHSA to prioritize educating Congress about the significant burdens the existing statutory framework imposes for the integration of SUD and physical health care, and to work with legislators to resolve the statutory conflicts that prevent full alignment of Part 2 with the HIPAA requirements that govern all other patient health information.</p> Fri, 25 Oct 2019 10:02:18 -0500 42 CFR-Part 2, Confidentiality Regulations for SUD <p>The Substance Abuse and Mental Health Services Administration (SAMHSA) Aug. 22 issued a <a href="https://s3.amazonaws.com/public-inspection.federalregister.gov/2019-17817.pdf">proposed rule</a> to amend sections of the Code of Federal Regulations (CFR) that dictate restrictions on how federally assisted alcohol or drug abuse programs may use and share patient information. Comments are due to SAMHSA by Oct. 25.</p> <p><strong>AHA TAKE:</strong><br /> <strong>While we appreciate that SAMHSA is taking steps to ease the burdens on providers who treat patients for substance use disorder (SUD), we will continue to encourage Congress to pursue legislation to change the basic framework for information sharing so that it aligns with requirements under the Health Insurance Portability and Accountability Act (HIPAA). </strong>For information on AHA’s position on 42 CFR part 2, see our recent <a href="/letter/2018-04-10-aha-reiterates-support-legislation-align-42-cfr-part-2-hipaa">comment letter</a> in support of congressional legislation to amend the statute.</p> Tue, 27 Aug 2019 10:22:14 -0500 42 CFR-Part 2, Confidentiality Regulations for SUD /testimony/2018-05-08-aha-statement-improving-coordination-and-quality-substance-use-disorder <p align="LEFT">AHA expresses strong support for legislation that would allow responsible sharing of patient substance use disorder (SUD) treatment information and prevent inappropriate and dangerous prescribing of opioids by amending 42 CFR Part 2 to align with the Health Insurance Portability and Accountability Act (HIPAA) for the purposes of treatment, payment and health care operations. </p> Tue, 08 May 2018 06:24:08 -0500 42 CFR-Part 2, Confidentiality Regulations for SUD /news/headline/2018-04-24-aha-others-urge-support-legislation-align-42-cfr-part-2-hipaa <p>The AHA and more than 40 health care organizations yesterday urged Congress to include legislation that would align 42 CFR Part 2 with the Health Insurance Portability and Accountability Act as part of legislation to address the opioid crisis. The groups sent letters to leaders of the <a href="/system/files/2018-05/PartnershipLettertoHELP.PDF">Senate Committee on Health, Education, Labor, and Pensions </a>and the <a href="/system/files/2018-05/PartnershipSignonLetterECFinal.pdf">House Committee on Energy & Commerce</a> urging them to include S. 1850/H.R.3545 in their efforts to address the opioid epidemic. “To provide the safest and highest quality care, clinicians in hospitals and health systems need access to patients’ complete medical information, including information about substance use disorders,” said AHA Executive Vice President Tom Nickels. “The importance of safe care for all patients in treatment for opioid use disorder cannot be overstated and 42 CFR Part 2 is a major barrier to safety for patients in treatment for opioid use disorder. Congress should update this law, which impedes the sharing of critical patient information that is necessary to deliver the most effective and efficient care.” The Senate HELP Committee completed markup of its opioid bills today, and the Energy and Commerce Committee Health Subcommittee is expected to markup more than 60 bills tomorrow.</p> Tue, 24 Apr 2018 14:59:25 -0500 42 CFR-Part 2, Confidentiality Regulations for SUD /lettercomment/2018-02-20-aha-comments-re-request-recommendations-policy-actions-address-opioid <p><a href="/node/18513">View letter here.</a> </p> Tue, 20 Feb 2018 10:21:21 -0600 42 CFR-Part 2, Confidentiality Regulations for SUD /lettercomment/2016-08-29-aha-sen-mcconnell-re-senate-vote-meaningful-mental-health-reform <p>AHA urges Senator Mitch McConnell to schedule a Senate vote on meaningful mental health reform legislation this fall.</p> Mon, 29 Aug 2016 00:00:00 -0500 42 CFR-Part 2, Confidentiality Regulations for SUD