Although changes to 42 CFR Part 2 took place in recent months, the rule has always been top of mind for treatment centers. And now that legislation passed in June to align privacy for substance-use-disorder patients with HIPAA, the rule continues to make waves.
On June 20, the U.S. House passed the Overdose Prevention and Patient Safety Act, or HR 6082, which allows authorization to disclose—as long as it is in line with HIPAA—the records of patients with substance-use disorders without written patient consent to a covered entity for treatment and payment purposes, healthcare operations, and to a public health authority. In May, the House Energy and Commerce Committee passed a similar bill, HR 5795.
Corey Waller, chair of the American Society of Addiction Medicine’s Legislative Advocacy Committee, says that rolling 42 CFR Part 2 into HIPAA with added protections—and the bills that support this—is a the way to go.
“HR 5795 is a good option because it maintains the criminal justice protection,” he says. “It mandates training for people on how to maintain these records, and it adds criminal penalties if you release the records. Now if under 42 CFR Part 2 you release them, it’s only civil and no criminal.”
Deborah Reid, senior health policy attorney at the Legal Action Center, and her team strongly oppose HR 5795 because Reid says it doesn’t offer enough protection for certain patients.
“That bill basically is eliminating Part 2’s federal confidentiality protection for the disclosure of information and further disclosure of substance-use-disorder information for the purposes of treatment, payment and healthcare operations and it replaces it with a weaker HIPAA standard that has no patient consent,” she says, adding that while the bill offers some anti-discrimination provisions, it doesn’t protect people with disorders who are using illegal substances.
“It’s based on current civil-rights laws like the Americans with Disabilities Act or the Fair Housing Act. They don’t protect people who are using illegal substances against discrimination,” she says.
Pamela Greenberg, president and CEO of the Association for Behavioral Health and Wellness, says that legislation working to align Part 2 with HIPAA for covered entities will actually strengthen standards set forth in Part 2. The association is part of the Partnership to Amend 42 CFR Part 2, a coalition of more than 40 healthcare organizations committed to aligning Part 2 with HIPAA to allow appropriate access to patient information.
“One of the criticisms very early on as we talked about wanting to move to the HIPAA standard was what about these protections that exist in Part 2 that may not be as strong in HIPAA that ensure people’s substance-use-disorder records aren’t used against them in an employment or housing situation, or a child custody case?” she says. “In the legislation, we keep all of those protections and actually strengthen them.”
More change needed
Even so, sources say legislation to change 42 CFR Part 2 is moving along due to the rule’s antiquated regulations. Part 2 was introduced in the 1970s, and many believe it has since become outdated in today’s world of electronic health records and increasing need to provide services amid epidemics such as the opioid crisis.
Greenberg says Part 2 is a great hindrance when it comes to electronic health records because there is no good way to segment information.
“Electronic health record vendors are interested in seeing a change toward a HIPAA standard as well because most, if not all, electronic health records are not able to accommodate separation of the substance-use records from the rest of the medical records,” she says. “SAMHSA has tried with some version of a record, but my understanding is nobody is using it, and it’s costly and complicated. It didn’t end up being a good solution.”
And Waller says that in theory the recent changes SAMHSA made to Part 2 were to help improve the movement of information. But when information needs to be segmented and shared, the data within the system can become costly for the entities that own it. In turn, that can make those entities simply not want to own the information.
“The issue is re-disclosure. This is what scares hospitals off,” he says. “If I take on somebody’s Part 2 information and make it a part of the medical record, it’s now up to me to go find that patient again, if someone requests their medical record, to get a separate release of information.”
He says that can pose a problem if the patient is difficult to get in contact with because he or she doesn’t have a phone or might be homeless, for instance. He says if that information is released anyway, it goes against the regulations put in place by 42 CFR Part 2, which can be a costly decision.
“So even though you’re not a covered entity by yourself, you’re re-disclosing covered-entity data. That’s why hospitals are not willing to start a lot of internal programs because it costs millions of dollars to build electronic infrastructure to separately house addiction information,” Waller says. “And then when you separately house it, it still cuts off that piece of information from the people who really need it that are treatment providers.”
But even more detrimental than the cost of building an electronic infrastructure to accommodate the regulations of Part 2 is the harm that can come to patients when medical records can’t be shared with treatment providers, says Waller, who has experience with the negative effects of the rule.
Addiction professionals annually convene at the National Conference on Addiction Disorders to share what’s working: Clinicians hear from thought leaders on delivering treatment, while executives of behavioral healthcare organizations learn how to run more effective, more efficient, and ethically minded businesses.