Until last month, the applicable federal regulations governing confidentiality of patient records for substance abuse disorders had been in place since 1987—the same year President Reagan told Gorbachev to “tear down this wall” and Windows 2.0 was introduced. SAMHSA recently published its long-awaited final rules which are scheduled to take effect on February 17, 2017.
The following are the highlights of these new regulations, and what treatment centers need to know about them.
Do the regulations apply to me?
If you answer any of the following questions “yes,” then the new regulations apply to you:
- Are you a part 2 program? Part 2 programs are defined as federally assisted programs which provide substance use disorder diagnosis, treatment, or referral to treatment. A “program” is one which focuses on substance disorder diagnosis, treatment or referral, but can also apply to anyone within a general medical facility (such as a hospital) which provides the same services. A program is considered “federally assisted” if it is conducted directly or indirectly by a federal agency, receives federal financial assistance directly or indirectly through a state or local government, or receives income tax deductions for contributions to the program or tax exempt status by the Internal Revenue Service.
- Do you have patient identifying information from a part 2 program? The regulations also apply expressly to a “lawful holder of the patient identifying information,” third party payers and other individuals or entities who receive patient records from one of these sources.
- Does your state regulatory authority adopt the federal confidentiality rules? Many state regulatory authorities have expressly adopted the federal confidentiality rules and require compliance with those rules for state-regulated treatment centers. If your state does so, then you must comply with the confidentiality regulations even if you are not a “part 2 program.”
Do the regulations change patient confidentiality requirements for most treatment centers?
Probably not. Generally, the confidentiality regulations restrict disclosure of information which would identify a patient with a substance use disorder and information obtained by a program for the purpose of treating a substance use disorder, making a diagnosis for that treatment or making a referral for that treatment. The regulations provide that patient records may only be disclosed in accordance with the regulations, and all disclosures must be limited to information necessary to carry out the purposes of the disclosure.
Acknowledging the presence of a patient at your treatment center is also restricted under the regulations. Most treatment centers already have protections in place which should satisfy the confidentiality requirements in the new regulations. The regulations do make clear, however, that compliance with the new regulations is unconditional and applies whether or not the program believes that the requesting party already has the requesting information, has other ways to get it, is a law enforcement agency or government official, has obtained a subpoena, or asserts any other justification for a disclosure contrary to the regulations.
Do I have to change patient record release forms and procedures?
Probably. The new regulations require the consent form to say, among other things, how much and what type of information may be released by the treatment center to others. If your current release form does not include this option, the form will need to be changed.
In addition, under the new regulations, the treatment center now has the option to allow the patient to adopt a general designation of to whom information can be disclosed. For example, where the former regulation required the specific identification of each person to whom records could be disclosed, the new regulation permits a general designation, such as to “all my treatment providers.” If this provision is added to the form, then the patient is entitled, upon written request, to a list of all entities to which information was provided within the preceding two years.
Under what circumstances can I release records without patient consent?
The regulations provide that patient identifying information may be disclosed to medical personnel without patient consent to meet a bona fide medical emergency in which prior informed consent cannot be obtained. Likewise, information may be disclosed for research purposes under limited circumstances, and for audits and evaluations, also under limited circumstances.
The new regulations contain an entire section dealing with court orders, which generally require a specific court order authorizing the disclosure as well as a subpoena compelling the disclosure. Before you release any patient records without patient consent, you will need to review the new regulations.
Do I have to notify patients of this new regulation change?
Yes. Each program is required to communicate to patients that federal law and regulations protect confidentiality of patient records, and provide a written summary in writing of the federal law and regulations. The notice may be in written or electronic form.
Am I required to have written policies and procedures in effect regarding security of patient records?