Fannie Fang
Executive Editor
Loyola University Chicago School of Law, JD 2017

 

 On January 18, 2017, the Department of Health and Human Services (“HHS”) issued a final rule to update and improve the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, known as 42 CFR Part 2 (“Part 2”). The purpose of the update is to better align the regulations with the changes in the U.S. health care delivery system. The Part 2 regulations will facilitate information exchange within the health care industry by adding new provisions that allow qualified providers to exchange electronic patient information, while still addressing the privacy concerns for patients seeking treatment for a substance use disorder.

Background

The Confidentiality of Alcohol and Drug Abuse Patient Records regulations were first introduced in 1975. The regulations aimed to address the concerns of patients who believed that the disclosure of their identities could result in serious social consequences such as loss of employment. In addition, the disclosure may deter patients from seeking needed professional treatment. Specifically, the purpose of the regulations is to ensure that a patient receiving treatment for a substance use disorder is not made vulnerable by the creation of a patient record.

Since then, the U.S. health care delivery system has experienced significant changes that the Part 2 regulations did not foresee such as the development of an electronic infrastructure for managing and exchanging patient information. As a result, HHS felt the need to revise the Part 2 regulations to adapt to the current health care delivery system.

Final Rule of Part 2 Regulations

Under the final rule of Part 2 regulations, a number of new provisions have been added that gave flexibility in the rules regulating patient health information. For example, the final rule revised the research exception to permit data protected by Part 2 regulations to be disclosed to qualified personnel for the purpose of conducting scientific research. The research exception also permits disclosure of data to any other individual or entity that is in lawful possession of Part 2 data. However, the researchers must provide documentations that meet all the requirements related to other existing protections for human research. Another provision revised the rule to permit patients to use general designation such as “My Treating Providers” when giving consent to share their personal information. The patient can then provide a list of providers that are to be considered as his or her “treating providers.” This option speeds up the process for providers to gain access to patient health information. If a patient chooses to use this general disclosure designation, he or she can then also request a list of individuals and entities with whom their information has been shared.

Kana Enomoto, the HHS Deputy Assistant Secretary, stated that the Part 2 revisions “will further enhance health services research, integrated treatment, quality assurance and health information exchange activities while at the same time safeguarding the essential privacy rights of people seeking treatment for substance use disorders.” Several advocacy groups generally supported the revision, seeing them as an effort to “clear the way for integrated health care models that can provide a better, more cost-effective health care system and also empowers people to make key decisions about their health care.” Meanwhile, critics expressed concerns to the final rule, arguing that it would eliminate the right of patients to protect and control personal health information and introduce complexity, not simplification.

How will this affect compliance?

With this final rule, compliance officers will need to work in conjunction with privacy officers to develop and implement new policies and procedures that adapt to these new provisions. The final rule might be confusing and burdensome for some employees. Consequently, the compliance officer needs to ensure that these policies are easy to understand. Moreover, the compliance officer should create mandatory training and education programs to raise awareness of the final rule. This is important because the final rule could directly affect some employees’ daily tasks. While the final rule was updated to create space for increased information exchanges, some information is still prohibited from being shared. Therefore, employees must understand what types of information may be exchanged and learn what is prohibited in order to stay compliant with these regulations and avoid violations.