Policy Pulse: We Must Change Outdated Patient Health Record Privacy Regulations | The Kennedy Forum

Policy Pulse: We Must Change Outdated Patient Health Record Privacy Regulations

Published: February 6, 2018

As the opioid epidemic continues to take the lives of 115 Americans each day, The Kennedy Forum is working diligently to support individuals and families affected by substance use disorders (SUDs) and to promote legislative and regulatory changes that will improve SUD treatment and prevention. As part of this effort, we have been active in national discussions surrounding Code of Federal Regulations Title 42, also known as 42 CFR Part 2 and the underlying statute 42 U.S.C. 290dd- 2 (referred to as “Part 2”).

Health care consumers are familiar with HIPAA, the Health Insurance Portability and Accountability Act, which protects personal medical information. HIPPA applies to medical and surgical conditions, while the rules set forth in 42 CFR Part 2 regulate the way substance use disorder health records can (or cannot) be shared. Written and instituted in the 1970s, 42 CFR Part 2 was intended to provide extra safeguarding for SUD patients to prevent sensitive information from being used against those patients by employers and the criminal justice system. With this extra protection, lawmakers and others hoped SUD patients would be encouraged to seek treatment for their substance use and be protected against jeopardizing their reputations, risking their jobs, or suffering other negative repercussions. Since the ‘70s, however, effectiveness of 42 CFR Part has shifted from encouraging individuals to seek treatment to instead hindering the progression of SUD treatment.

The provisions of privacy stipulated in Part 2 are more stringent than those applied to other medical diseases, such as HIV or mental illnesses, by HIPPA. The privacy provisions pertaining to SUD health records (or just “Part 2 Privacy provisions”) severely limit the circumstances for the release of any identifiable information without the written consent of the patient. Consequently, providers are often not able to disclose a substance use disorder diagnosis or treatment history, even if sharing this information would benefit the patient.

Today, Part 2 inhibits SUD treatment providers’ ability to apply advancements in health care to SUD services. SUD patients are often excluded from the benefits of developments like coordinated treatment models, value-based payment innovations, and integrated care delivery systems that rely on collaboration between providers. Because providers are usually not able to lawfully share the medical records of mutual patients with an SUD diagnosis, these patients are often subjected to excessively disjointed care.

This ultimately leads to missed opportunities for identification, treatment, and relapse prevention for substance use disorder, and can result in additional and unnecessary expense. Moreover, this can lead well-intentioned providers to inadvertently prescribe adverse treatment to patients as a result of being unaware of key pieces of a patient’s medical history. For example, a doctor may prescribe opioids to someone who has sustained a serious injury and who has a history of opioid addiction because the provider is unable to see the patient’s complete medical record and is therefore unaware of the history of substance use.

Advocates have suggested that Part 2 be revised in order to bring its provisions closer in line with HIPAA. In response, the Substance Abuse and Mental Health Services Administration (SAMHSA) issued proposed updates to 42 CFR Part 2 in 2017. After seeking public comment, the 2017 proposed regulations were revised and released this past month as final rules. The final rules include the allowance for lawful holders to disclose a minimum amount of information necessary for purposes of payment, health care operations, and audits.

On Wednesday January 31st, The Kennedy Forum Policy Team attended a hearing hosted by SAMHSA during which stakeholders were able to express their thoughts on the final rules. Responses were mixed. Some don’t believe the new rules go far enough as they still don’t allow for the kind of provider-to-provider communication that occurs for medical and surgical services. SAMHSA has stated that as the law stands, the final rules create provisions that allow for the greatest amount of change without legislative action.

Other advocates believe that the revised rules go too far. Most in this camp are concerned that altering Part 2 and bringing it into alignment with HIPAA puts the confidentiality of SUD patients in serious jeopardy. However, this concern may be misplaced. Provisions included in HIPAA overlap with many of the safeguards of 42 CFR Part 2 that protect medical records from being inappropriately accessed or abused by outside organizations and by the criminal justice system. Unlike 42 CFR Part 2, HIPAA provides these protections while still allowing for the utilization of advancements in care coordination and collaboration.

The Kennedy Forum, along with more than 30 other national organizations in the Partnership to Amend 42 CFR Part 2, supports the effort to modernize the privacy regulations surrounding SUD. We are in favor of federal legislative changes and aspire to bring the sharing of SUD treatment information into alignment with the rest of medicine.

Lawmakers in favor of advancing updates to 42 CFR Part 2 have introduced the Overdose Prevention and Patient Safety Act in the House and the Protecting Jessica Grubb’s Legacy Act in the Senate. Draft versions of these bills attempt to allow providers to share information without patient consent in instances of treatment, payment, and healthcare operations in a way that is consistent with HIPAA. Additionally, these bills create stronger safeguards that go beyond those of HIPAA to prevent SUD medical records from being used in civil and criminal proceedings. Consequently, the proposed legislation would allow for coordination of care and successful treatment of SUD patients while ensuring that sensitive information cannot be legally used to harm those battling addiction.

It is time to bring SUD privacy requirements in line with 21st century realities while also establishing a firewall that will prevent discrimination. The Kennedy Forum is proud to stand with the Partnership to Amend 42 CFR Part 2 and to advocate for the equitable, modernized treatment and provision of SUDs.

The Kennedy Forum Policy Team

Tim Clement
Senior Policy Advisor

Torie M. Keeton
Research and Advocacy Advisor