42 CFR Part 2: What is Changing and What to Consider

The changes to 42 CFR Part 2 are an about-face from Congress's previous concerns regarding stigma and discrimination. But it will likely improve patient treatment and outcomes:

The Department of Health and Human Services (“HHS”) changes to the federal regulations governing the privacy of SUD treatment records may put patient privacy at greater risk. But it will likely improve patient treatment and outcomes because the changes de-silo addiction providers from the rest of the healthcare landscape.

What are the rules that I need to know:

• The statutory authority governing the privacy of SUD patient treatment records is 42 USC §290dd-2 (“Federal Statute”).
• The regulations giving effect to the federal statute are contained in 42 CFR Part 2 (“Part 2”). SUD treatment providers must follow these rules if they fall within the definition of a "federally assisted program."

What is the effect of the Federal Statute and Part 2:

• The Federal Statute and Part 2 provide stricter privacy rules than HIPPA because they require specific patient consent for each disclosure external to the provider and prohibit recipients from re-disclosing the received information.

Why do the Federal Statute and Part 2 exist:

• Congress adopted stricter privacy regulations in the Federal Statute and Part 2 because there were no broader privacy regulations at the time. Congress wished to protect people seeking treatment or treatment for SUD from discrimination and stigma.

Why are the Federal Statute and Part 2 Changing:

• The Federal Statute was amended under the CARES Act (See § 3221, subpart C, on page 95) to align closer with the Health Insurance Portability and Accountability Act ("HIPAA") because Congress felt that communication between Part 2 programs and the rest of the healthcare landscape needs to be easier.
• The Part 2 regulations are changing because the CARES Act amendments to the Federal Statute require HHS to amend the Part 2 regulations.

What is Changing:

• At the end of November, HHS issued its Notice of Proposed Rulemaking ("NPRM") to amend Part 2.
• Among many recommendations, the proposed changes would allow for (1) a general release permitting the disclosure of SUD records for treatment, payment, and healthcare operation purposes and (2) unconsented disclosures for public health emergencies.

What should I consider:

• Whether the potential that less restrictive confidentiality provisions will improve treatment efficiency and treatment outcomes is greater than the risk of unauthorized disclosure or access to SUD treatment records.
• Whether greater access and exchange of patient SUD data will lead to insurance carriers denying coverage for addiction treatment.

The COVID-Confidentiality Clash Highlighted the Need to Change the Federal Statute and Part 2:

I never imagined that two years after graduating with my public health degree, I would argue with a local health department about confidentiality rights during a pandemic. But here I was—in an awkward position of trying to help our health leaders while protecting patients' privacy and integrity.

In 2020, I worked as a compliance officer for a medium-sized addiction treatment provider and witnessed the COVID-confidentiality clash. My office received a letter from a local health department requesting a broad range of protected health information. The legion of demands included patient names, addresses, prior health conditions, current diagnoses, COVID-19 symptoms, test outcomes, and more.

This demand may appear reasonable given the global shutdown and skyrocketing death rate; it was not. This demand was well beyond the scope of permissible disclosures under state and federal law because substance abuse treatment records are more protected than other protected health information.

But we must go back in time to understand why they are more protected.

The History of Federal Substance Use Disorder Confidentiality Laws:

In 1972, Congress passed the Drug Abuse Office and Treatment Act of 1972 (“Act”)—later codified in the Federal Statute—because drug abuse constituted a “serious and continuing threat to national health and welfare” and “...substantially contributes to crime.” And in President Nixon’s words, addiction is “our number one public enemy.”

The Act and Nixon's remarks encapsulate the language people seeking treatment feared—people with SUD were a “serious and continuing threat” that “substantially contributes to crime” and are "our number one public enemy." It is written evidence of the stigma surrounding SUD.

At the time of the Act, HIPAA was not yet adopted. Thus, the Act included privacy provisions (see §408, page 15) limiting when records may be disclosed with and without patient consent. Those protections existed after a patient died—a demonstration of Congress’s intent to protect patient confidentiality.

And In 1975, HHS operationalized the Act by publishing Part 2. And around the same time, some states, like Pennsylvania, passed laws (see §1690.108, page 8) and regulations adding additional restrictions.

In effect, federal and some state legislatures disregarded care coordination in favor of protecting patient anonymity:

Part 2 required providers to obtain specific written consent from the patient to disclose their records to any person or entity outside the program, regardless of the purpose of the disclosure. Also, Part 2 prohibited the recipients of SUD treatment information from redisclosing the treatment records. Nor did it allow for the unconsented disclosure of treatment records for public health emergencies.

This is in contrast to the later adopted HIPAA, which does not require specific consent for each entity, nor prohibit the re-disclosure of protected health information, and allows for unconsented disclosures in public health emergencies.

Going Back to the COVID-Confidentiality Clash:

Thus, during COVID, SUD providers had to determine if COVID-19 constituted a “medical emergency,” thereby allowing the disclosure of patient SUD records to public health authorities because there was no regulatory mechanism for public health disclosures.

So, here I was, with my public health degree, frustrating a public health department's public health response because a pandemic may or may not constitute a “bona fide medical emergency,” and public health officials could or could not be considered “medical personnel” within the meaning of the exception.?

We found that it did not fit within the exception.

The Practical Changes under HHS's NPRM:

Among many recommendations, HHS's proposed changes would notably allow for the following:

1. A general release permitting the disclosure of SUD records for treatment, payment, and healthcare operation purposes, and
2. Unconsented disclosures for public health emergencies.?

The below example illustrates the current practical implications of the Federal Statute and Part 2:

If a SUD treatment provider needed to disclose a patient’s SUD treatment records to a patient’s primary care physician and oncologist for treatment purposes, the provider had to obtain a patient's specific written consent for each entity. If the primary care physician wished to disclose the records subsequently, they also needed to obtain specific consent.

The below example illustrates the practical implications of the Federal Statute and Part 2 under HHS's proposed amendments:

Part 2 providers can use a single prior consent for all future uses of their SUD records related to treatment, payment, and healthcare operation purposes. And disclosures for public health emergencies are permitted.?

Some States with Stricter SUD Confidentiality Laws are Following Suit:

Pennsylvania seems to have followed Congress's lead by amending its SUD confidentiality rules to align closer with HHS’s recommendations and prohibiting its administrative agencies from creating additional regulations governing the confidentiality of SUD records.

The below example illustrates the practical implications of Pennsylvania's stricter SUD confidentiality laws:

If a SUD treatment provider needed to disclose a patient’s SUD treatment records to a patient’s primary care physician, probation officer, and insurance company for treatment and payment purposes, respectively, the provider had to obtain a patient's specific written consent for each entity.

But SUD treatment information released to judges, probation or parole officers, insurance companies, or government officials were restricted to the following: "(1) Whether the client is or is not in treatment; (2)?The prognosis of the client; (3) The nature of the project; (4)?A brief description of the progress of the client; (5)??A short statement as to whether the client has relapsed into drug, or alcohol abuse and the frequency of such relapse." 4 Pa. Code § 255.5(b).

The below example illustrates the practical implications of the Federal Statute and Part 2 under HHS's proposed amendments:

Part 2 providers can use a single prior consent for all future uses of their SUD records related to treatment, payment, and healthcare operation purposes. And disclosures for public health emergencies are permitted.?

Thus, Pennsylvania’s regulation restricting the type of information permitted to be disclosed to “judges, probation or parole officers… or government officials” is ineffective.?

Weighing the Benefits of HHS's NPRM Against the Risks of Weakening the Federal Statute and Part 2:

The loosening of restrictions is a double-edged sword because it begs the question if efficiency is more important than risks of harm:

The risk of harm from unauthorized disclosure or access to SUD treatment records is significant and severe.

But the risks of inadequate treatment are greater because inadequate treatment can lead to death, and death is more significant than any other type of harm that could be suffered from unauthorized disclosure or access. ?

On the one hand, stricter regulations can become obstacles to efficiency, better patient outcomes, and public well-being because they limit a Part 2 provider's ability to communicate with other treating providers.

Stricter regulations can hinder efficiency because they require Part 2 providers to navigate a patchwork of conflicting laws as a provider must consider HIPAA, the Federal Statute, Part 2, and any applicable state law.

Also, stricter regulations can worsen patient outcomes because they silo addiction professionals from working with other treatment team members as they cannot always disclose information necessary for the subsequent provider.

Finally, stricter regulations can dampen the efficiency of public health interventions because they limit a Part 2 provider's ability to disclose information in times of crisis—like COVID-19.

Separately, as HHS believes (without providing a reason), more stringent regulations can perpetuate negative stereotypes about people living with SUD. Finally, the non-sharing of information can hinder public health responses.?

But on the other hand, looser regulations seem contrary to the confidentiality provisions' main point (see page 37) because they risk unauthorized disclosure or access to patient information.

First, weaker regulations limit the legal arsenal providers can leverage against overreaching public health exception data requests.

Second, the whole point of stricter regulations was to ensure patients were not made more vulnerable through disclosures. But a single consent for treatment, payment, or healthcare operation purposes runs the risk of the unnecessary re-disclosure of patient SUD information because non-Part 2 programs, contractors, or business associates may not have the expertise to handle such sensitive information. Not to mention that the single consent is valid until a patient revokes their consent (see item 20 on page 15). Thus, weaker regulations increase the risk of a breach or unnecessary access to historically sensitive information.

Breaches or unnecessary access to SUD treatment information can lead to patient discrimination, prosecution, and loss of employment or child custody (see page 37). And breaches are serious issues to consider and can impact millions of people.

However, it would be onerous to argue that public health exceptions are unnecessary when COVID has resulted in over 1,000,000 deaths. And with emerging contaminants in street opioids, like xylazine in Tranq Dope, data is needed to inform prompt and effective public health interventions.

Also, the amendments to the Federal Statute protect individuals living with SUD by creating some of the most robust anti-discrimination provisions (see section §3221(i) on page 97) for people living with SUD—even more significant than the Rehabilitation Act of 1973, Americans with Disabilities Act (ADA), the Affordable Care Act, and the Fair Housing Act. Admittedly, this is limited to actors who discriminate against an individual living with SUD "on the basis of information received by such [a Part 2] entity." And for the first time, Part 2 is now equipped with breach provisions.

Yet, whether greater access and exchange of patient SUD data will lead to insurance carriers denying coverage for addiction treatment remains an open question, and only time will tell.

Benefits of HHS's NPRM Weigh Heavier than the Risks of Weakening the Federal Statute and Part 2 Because it Furthers a Public Health Aim of Our Legal System:

The stakes could not be higher when treating a person living with SUD.

In arguing in favor of amending the Federal Statute, Earl Francis Blumenauer (D-OR 3rd District) said, "there has been no argument that this provision has cost lives. The failure in emergency rooms, other circumstances, for people to not be able to get the full picture of a patient's condition ends up sometimes with tragic consequences. We have yet to hear any reason why we shouldn't coordinate. . . There have been examples where people have died because the medical providers did not have the full picture of the patient. This legislation will fix it."

In 2021, there were 107,622 drug overdose deaths. All 107,622 drug overdose deaths were preventable with effective treatment. And it seems reasonable to infer that the Federal Statute and Part 2, although they had their time, are not helping the situation.

Therefore, it is reasonable to conclude HHS’s recommendations are furthering a public health aim of improving and promoting health, safety, and well-being by tearing down barriers to effective communication—an essential element to effective treatment.