AHA Comments on Proposed Revisions to the Regulations Governing the Confidentiality Of Substance Use Disorder Records

January 30, 2023

Miriam E. Delphin-Rittmon, Ph. D.
Assistant Secretary for Mental Health and Substance Use
U.S. Department of Health and Human Services, Office for Civil Rights
Hubert H. Humphrey Building, Room 509F
200 Independence Avenue SW
Washington, DC 20201

Dear Dr. Delphin-Rittmon:

On behalf of our nearly 5,000 member hospitals, health systems and other health care organizations, and our clinician partners – including more than 270,000 affiliated physicians, 2 million nurses and other caregivers – and the 43,000 health care leaders who belong to our professional membership groups, the American Hospital Association (AHA) appreciates the opportunity to comment on the proposed revisions to the regulations governing the confidentiality of substance use disorder (SUD) records, commonly known as 42 CFR Part 2 (“Part 2”). We appreciate that the Substance Abuse and Mental Health Services Administration (SAMHSA) is taking steps to align requirements under Part 2 regulations with those under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, as we and many other stakeholders have requested.

The out-of-date, arbitrary and confusing regulations currently described in Part 2 fail to protect patient privacy and erect sometimes insurmountable barriers to providing coordinated, whole-person care to people with a history of SUD. The AHA has long advocated that the HIPAA requirements be the prevailing nationwide standard for protecting the privacy and security of all patient information. While by no means without its own regulatory impediments to the appropriate use and disclosure of patients’ personal health information (PHI) necessary to support clinical integration and population health improvement, the HIPAA Privacy Rule generally permits covered entities, like hospitals and other health care providers, to share PHI for purposes of treatment, payment and health care operations without having to obtain each individual patient’s authorization. Thus, we support SAMHSA’s proposal to align definitions as well as the requirement for only a single patient consent in perpetuity for appropriate use and disclosure. We appreciate that SAMHSA attempts to balance the streamlining of patient information sharing requirements with new patient rights and protections in order to ensure that improved care coordination does not pose a threat to individual privacy.

However, the rule does not address the underlying separate regulatory structure governing Part 2 programs and patient information generated therein; this separation and accompanying requirement to segregate records pertaining to SUD information continues to stymie the integration of behavioral and physical health care because the patient data cannot be used and disclosed like all other health care data. Theoretically, because this rule would apply the same or similar protections and processes to all patient data, integration might be possible; realistically, though, health information technology does not exist or operate in a way that can distinguish between Part 2 and non-Part 2 data.

We understand that SAMHSA lacks the authority to circumvent the existing statutory structure. As reform of the statute remains under the purview of the legislative branch, we urge SAMHSA to work with Congress to update the statutory framework to allow for meaningful integration of SUD and physical health care and to resolve the statutory conflicts that prevent full alignment of Part 2 with the HIPAA requirements that govern all other patient health information.

We also believe that there is still work SAMHSA can do to allow health care practitioners to provide whole-person care that is appropriately informed by the totality of relevant patient information. We urge the agency to provide additional clarity and guidance in the final rule regarding how to operationalize the changes adopted.

For example, even though SAMHSA issued a rule to clarify existing requirements under Part 2 in 2019, the field continues to lack clarity in the definition of a “Part 2” versus a “non-Part 2 provider.” The statute defines Part 2 providers as alcohol and drug treatment programs that receive federal funds in any form, including Medicare or Medicaid funding or via their tax-exempt status, and “hold themselves out as providing” alcohol or drug abuse diagnosis, treatment or referral for treatment. However, the phrase “hold themselves out” is not well defined in the proposed regulations.

In the regulation, SAMHSA exempts general medical facilities and medical practices from information sharing restrictions, but simultaneously limits that exemption for Part 2 providers. In other words, general facilities and practices are excluded from the scope of the Part 2 regulation, and thereby from complying with the significant regulatory constraints imposed on sharing a patient’s behavioral health data, but only if they do not “hold themselves out” as providing SUD diagnosis, treatment or referral for treatment and the “primary function” of their medical personnel or other staff is not the provision of, and they are not identified as providing, such services. Yet, many general facilities and providers not only offer these services but make their availability known to their communities. Thus, in practice, general medical facilities and practices actually may not be exempt—depending on interpretations of “hold themselves out” and “primary function.” We believe that further clarification on who is included in these definitions is needed.

In the current care environment, where there is expanding emphasis on integration and coordination of behavioral health care with physical health care and where the prevailing location for delivery of that care is the general medical facility or medical practice, Part 2 requirements are likely to be interpreted by providers as applying to many more treatment settings and providers. We, therefore, urge SAMHSA to address this topic in the final rule and issue detailed guidance about how providers should determine whether they are “holding themselves out,” or whether the “primary function of their medical personnel or other staff is the provision of and they are identified as providing” the enumerated services. In other words, SAMHSA should provide definitions as to what “holding oneself out as providing” specifically entails — is this designation limited to organizations that advertise drug treatment services, or does it extend to those who are known to locals as providing these services? Does it extend to any organization that has billed for or provided referrals for such services? Without such clarity, the progress that this rule would make in streamlining information-sharing processes to improve care coordination may be moot.

For organizations that clearly consider themselves to be Part 2 providers, the need to segregate patient records regarding SUD has proven an enormous technical challenge. Even the most sophisticated electronic health record (EHR) modules lack the capability of automatically flagging or separating Part 2 records; in other words, there is currently no protocol for protecting SUD treatment information while integrating behavioral health records within current EHR systems. We believe that this capability is possible, and with some of the regulatory barriers out of the way if provisions in this rule are finalized, would mean that providers would better be able to access relevant information when clinically appropriate and necessary. However, SAMHSA has not addressed these health IT issues in the proposed rule.

The agency does propose to extend HIPAA enforcement penalties for information breaches; without providing guidance, support and time for Part 2 providers to modify and enhance their health IT and EHR capabilities, it is unreasonable to hold them to information protection standards beginning in 2024. We thus recommend that SAMHSA work with the Office of the National Coordinator as well as the health IT vendor community to develop plans, certification criteria and support resources to ensure that patient information is meaningfully protected and providers have the resources to put these protections in place without undue burden.

We also recommend that SAMHSA introduce a phase-in period for enforcement, as the complex nature of compliance with Part 2 regulations is already a deterrent to take on patients with SUD without threat of monetary penalty. Providers are willing and committed to provide coordinated, whole-person care; they need the technical tools and capabilities to be able to do it.

The AHA appreciates the balance that SAMHSA is attempting to strike between protections for patient information and avenues to appropriately share information for coordinated care. We think that many of the proposed changes, particularly the proposal to allow for a single collection of patient consent for use and disclosure rather than individual consents for each instance of use or disclosure, will greatly ease barriers between providers and care coordination, as will the allowance for health insurers to access information as part of treatment, payment and operations. Similarly, as we have urged before, the proposal to allow disclosures of de-identified information for public health purposes is likely to help improve population health efforts. We recognize that SAMHSA is looking to offset the seeming “relaxation” of the standards by creating new patient rights and protections, such as the right to request an accounting of all disclosures and right to revoke consent at any time. While we support these patient rights, we believe the agency is overemphasizing the social harms that disclosing this clinical information creates, at the risk of medical harms and overdose deaths that are a consequence of poor care coordination.

We encourage SAMHSA to provide guidance on precisely what is expected of providers as they incorporate processes to respect these patient rights if the provisions are finalized as proposed. For example, SAMHSA could provide a template for the accounting of disclosures that includes the level of detail necessary. We also look forward to the accompanying rules on non-discrimination regarding Part 2 programs and SUD information, which we hope will provide additional protections for patients from discrimination based on their health care treatments.

Again, we thank you for your consideration of our comments. Please contact me if you have questions or feel free to have a member of your team contact Caitlin Gillooley, director of policy, at cgillooley@aha.org or 202-626-2267.

Sincerely,

/s/

Ashley Thompson
Senior Vice President
Public Policy Analysis and Development