Proposed Revisions to Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2)
Members,
I wanted to make you aware of proposed rule from HHS related to the Confidentiality of Substance Use Disorder Patient Records, or 42 CFR Part 2. The proposed revisions are intended to bring Part 2 into better alignment with HIPAA, improve patient care coordination, and strengthen patient protections, and include the proposed changes listed below (among others). The rule was just published to the federal register on 12/2, and will be open for public comment for 60 days.
Proposed changes include:
I wanted to make you aware of proposed rule from HHS related to the Confidentiality of Substance Use Disorder Patient Records, or 42 CFR Part 2. The proposed revisions are intended to bring Part 2 into better alignment with HIPAA, improve patient care coordination, and strengthen patient protections, and include the proposed changes listed below (among others). The rule was just published to the federal register on 12/2, and will be open for public comment for 60 days.
Proposed changes include:
- Permit Part 2 programs to use and disclose Part 2 records based on a single prior consent signed by the patient for all future uses and disclosures for treatment, payment, and health care operations.
- Permit Part 2 programs to disclose Part 2 records without patient consent to public health authorities provided the information is de-identified
Please go take a look and consider submitting comments by Jan 31,2023 here: https://www.federalregister.gov/d/2022-25784
Comments & Events
Sarah Scott
Thanks, Danielle, for raising this opportunity for the community. Access to treatment data is critical for surveillance of the SUD Continuum of Care presented by CDC during the other week’s Strategy 3 Webinar: Innovative Surveillance Lessons Learned, Year 3 Data Products, and Goals for Year 4. As you all know, these data are often inaccessible due to the distinctive privacy rules for different types of providers. These updates help to remove some of the regulatory barriers and ambiguity that hinders monitoring our communities’ linkage to and retention in MOUD and other treatment programs and improve operability of HIEs.
Anyone can submit comments to these proposed rule changes and comments in support of the rule can help ensure that proposed changes are not watered down or removed. From our work supporting the development the SUD continuum of care, we believe these proposed changes help support public health surveillance and overdose prevention. Specifically:
- We support the proposed changes to permit Part 2 programs to use and disclose Part 2 records on a single prior patient consent. This change will better support coordinated case management between Part 2 treatment providers and other clinical and support and ancillary service providers. The fluidity in which patients move in and out of treatment and frequency of interactions with non-Part 2 clinical providers supports reducing the frequency of patient consent for record disclosure. Part 2 could further align with the HIPAA privacy rule by notifying patients of permitted disclosures related to treatment, payment, health care operations, and public health surveillance and mandated reporting. Part 2 programs would require signed consent for any other disclosure.
- We propose the change permitting Part 2 programs to disclose de-identified records to public health authorities without patient consent should be modified to remove the provision that data are de-identified. The change should read: Permit Part 2 programs to disclose Part 2 records without patient consent to public health authorities. The distinction between Part 2 programs and other health care providers regarding individually identifiable data being shared with public health authorities for surveillance and response should be eliminated. Limiting Part 2 programs to only disclose de-identified data to public health authorities contradicts state, tribal, local, and territorial public health authority. Public health authority permits data collection necessary for public health surveillance. Identifiable data are necessary to link patients to other data sources, monitor progress through the continuum of care, and evaluate effective overdose prevention and SUD treatment interventions. Some states may also require reporting of overdoses, opioid use disorder, or other SUD diagnoses. Public health agencies are adequately prepared to maintain privacy and confidentiality of sensitive patient data.