SAMHSA Document on Confidentiality Regulations Raises Further Questions

With national health reform moving the field toward coordination of all aspects of an individual’s medical care via “patient-centered medical homes,” longstanding federal requirements that govern information about clients in addiction treatment have come under scrutiny over their potential effect on integrated care.

Information about clients in addiction treatment programs is protected by federal 42 CFR Part 2 regulations, which generally require that a client grant specific written permission for the release of personal information. The regulations also spell out circumstances under which patient information can be released without consent in cases of medical emergency, as well as terms for treatment providers that enter into agreements with billing companies and other service providers that require the sharing of patient-specific information.

As the introduction of electronic medical record systems allows health professionals to see the full picture of a patient’s medical history, those who have advanced these systems have questioned whether 42 CFR Part 2 poses an insurmountable obstacle to improving care coordination. The Substance Abuse and Mental Health Services Administration (SAMHSA) recently weighed in on this issue. Last month it released a “Frequently Asked Questions” document (PDF) affirming that the confidentiality regulations offer ample mechanisms for the appropriate exchange of substance abuse treatment information in “health information exchanges,” the entities that will be created to house and provide medical information to providers.

SAMHSA has scheduled an Aug. 4 stakeholders meeting in order to provide a forum for further clarification of the FAQs document and the role of 42 CFR Part 2 amid emerging technologies. “It is important for us to hear what people are saying,” says Sarah A. Wattenberg, a SAMHSA public health adviser.

Points of contention

The FAQs document, initially drafted by the Legal Action Center and finalized by SAMHSA staff in collaboration with the Office of the National Coordinator (ONC) for Health Information Technology, clarifies which providers are considered “covered programs” under 42 CFR Part 2. Federally assisted individuals and entities fall under the requirements; SAMHSA says these include entities receiving federal funding in any form as well as those authorized by the federal government to conduct business such as dispensing a controlled substance used in drug abuse treatment.

Eric Goplerud, Ph.D., director of Ensuring Solutions to Alcohol Problems and coordinator of a group that believes the confidentiality regulations need to be re-examined to facilitate care integration, says SAMHSA’s interpretation extends 42 CFR Part 2’s reach to include physicians with a Drug Enforcement Administration (DEA) license to prescribe buprenorphine for office-based opiate treatment, for example.

Catherine O’Neill, senior vice president at the Legal Action Center, says much of the recent concern about 42 CFR Part 2 that has been expressed in the addiction field stems from individuals “not understanding the mechanisms available to facilitate the exchange of information. Our opinion is that the regulations do give enough room to allow the appropriate exchange of electronic health records, including substance abuse treatment records.”

But Bertha K. Madras, Ph.D., a professor of psychobiology at Harvard Medical School and a former deputy director at the Office of National Drug Control Policy (ONDCP), criticizes the way in which the FAQs document was drawn up and says SAMHSA has not been inclusive enough in the process. “This is an interpretation done by a cohort of legal advisers who did not recruit professionals from the various medical groups for their input,” Madras says.

Madras believes SAMHSA’s interpretation of the confidentiality protections will cripple efforts to mainstream addiction treatment into medical care, forcing physicians to keep the details of screening and brief intervention efforts in separate medical records. “This enhances the vision that substance abuse needs to be stigmatized and kept in a separate category,” she says.

Rather than focus on curbing legitimate medical practices that can lead to better patient outcomes, Madras believes, the government should examine all potential misuses of health information and guarantee serious legal consequences for any violators. “If HIPAA doesn’t cover all of the potential consequences, then we need another layer,” Madras says.

HIPAA regulations generally permit the disclosure of protected health information without patient consent for the purposes of “treatment, payment, or health care operations.” The recovery advocacy community considers HIPAA protections grossly inadequate to individuals with a substance abuse treatment history, arguing that 42 CFR Part 2 and its use of consent as the main basis for sharing patient information must be preserved. “To change this paradigm carries huge risks for further disclosure and misuse of patient information, including by law enforcement,” O’Neill says.

The next steps

O’Neill explains that while the FAQs document is considered to be in final form, further guidance from SAMHSA could be forthcoming based on any comments received in the Aug. 4 stakeholders meeting.

“This was not intended to be a vehicle for changing the law or the interpretations of the law,” Wattenberg said, in reference to the process for drafting the document.

But Goplerud, who organized a July 21 meeting of the Patient Protection Coalition to review the FAQs document and work on a response, hopes SAMHSA will remain open to revising the language and maintaining a dialogue with clinicians and people in recovery. He sees the ultimate goal as one of furthering safe, effective care while protecting patient privacy.

“The FAQs show that you can’t get strong protections and better communication within the existing regulations,” Goplerud says.