If your hospital is still struggling to comply with the final rule on Confidentiality of Substance Use Disorder Patient Records under 42 CFR Part 2, you’re certainly not alone. But don’t get lax on your compliance efforts. You could face severe penalties.
Snapshot: This complicated rule provides special privacy protections to patients seeking treatment for substance abuse, hospital compliance expert Sue Dill Calloway explains in her webinar, “Confidentiality of Substance Use Disorder Patient Records: Complying with 42 CFR Part 2.” The final rule requires healthcare providers who are treating a patient with a substance use disorder to, in certain circumstances: report violations, complete special consent forms, and ensure consent for treatment of minors.
Enjoy More Leeway with Info-Sharing
The U.S. Department of Health and Human Services (HHS) Substance Abuse and Mental Health Services Administration (SAMHSA) finalized the rule on Confidentiality of Substance Use Disorder Patient Records in early 2018. The final rule included three key revisions to the proposed rule.
One revision involves disclosures allowed with written consent. When a patient consents to his substance use disorder information being disclosed for payment or healthcare operations purposes, the recipient listed on the consent form may share that information with contractors, subcontractors, and legal representatives as necessary, according to the Legal Action Center.
Bonus: The final rule also included a list of examples of permissible payment and healthcare operations activities in the preamble but not in the regulatory text, stated the American Health Lawyers Association. And the rule includes a provision addressing contracts and other legal instruments that would ensure the contractor, subcontractor, or legal representative agrees to be fully bound by Part 2 provisions upon receipt of the patient-identifying information.
Identify the ‘Lawful Holders’
Another important revision in the final rule addresses audits and evaluations. Previously, regulations allowed only Part 2 programs (typically, specialty substance use disorder treatment programs) to disclose protected substance use disorder information without patient consent for audits and evaluations.
Good news: But under the final rule, “lawful holders” (other individuals and entities which have lawfully received protected information) may also disclose substance use disorder information for certain types of audits and evaluations. And this information may be shared with auditors’ and evaluators’ contractors, subcontractors, and legal representatives as needed.
Lawful holders would include contractors, subcontractors, and legal representatives who are helping to conduct audits and evaluations on behalf of federal, state, and local governments, including Medicare, Medicaid, or Children’s Health Insurance Program (CHIP) audits and evaluations.
Don’t Fret Over EHR Limitations
Finally, the rule will assist electronic health record (EHR) users by allowing use of an abbreviated notice of prohibition on re-disclosure that’s more easily accommodated in the EHR text fields, according to Healthcare Informatics. Many health information technology (IT) systems have a standard maximum 80-character limit in the free text space, so the longer standard notice would not fit into this space.
Downside: Overall, commenters on the proposed rule version asked SAMHSA to better align the regulation with the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act. But in addressing those comments, SAMHSA stressed that although it attempted to align the final rule’s revisions with HIPAA and HITECH as much as possible, the final rule should be “separate and distinct from HIPAA, the HITECH Act, and their implementing regulations.”
Further, this final rule aims to provide more stringent federal protections than HIPAA and other health privacy laws to specifically protect individuals with substance use disorder who could face discrimination and legal consequences if their information is improperly used or disclosed, according to SAMHSA.
Bottom line: To comply with the final rule on substance use disorder data, make sure you have the latest information to comply and avoid penalties, advises Sue Dill Calloway in her webinar, “Confidentiality of Substance Use Disorder Patient Records: Complying with 42 CFR Part 2.” Understand the changes regarding disclosures, audits and evaluations, and consent forms, so you don’t make any missteps in your compliance efforts.
