On February 9, the Substance Abuse and Mental Health Services Administration (SAMHSA) issued a proposed rule that made changes to the Confidentiality of Alcohol and Drug Abuse Patient regulations (42 CFR Part 2). The purported goal was to modernize regulations that had not been updated since 1987. After more than 40 years, it is unquestionably time to modernize these outdated rules while still maintaining privacy (especially as it relates to law enforcement, employers, divorce attorneys or others seeking to use the information against the patient).
In addition to having broader coverage for treatment of substance use and mental health disorders, in large part due to the Affordable Care Act and the Mental Health Parity and Addiction Equity Act (MHPAEA), we now utilize patient-centered medical homes that integrate patient care and quality measures that require follow-up after hospitalization and care coordination. Today integrated and coordinated care is expected as the new norm for delivering best-practice, whole-person care. Additionally, we have electronic health records and stringent federal privacy and security regulations that were not in place when 42 CFR Part 2 (referred to as “Part 2”) was enacted. The Part 2 regulations were appropriate for a different time. The regulations now hinder safe, effective, high-quality substance use treatment. The proposed rule makes many steps in the right direction, yet it still leaves barriers to coordinated, integrated health care for some people seeking treatment for substance use disorders.
Part 2 is the federal regulation governing the confidentiality of specified drug and alcohol treatment and prevention records. These regulations limit the use and disclosure of patients’ substance use medical records from certain substance use treatment programs. The Part 2 regulations were originally authorized by the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act of 1970 and the Drug Abuse Prevention, Treatment, and Rehabilitation Act of 1972. These laws were consolidated in 1992 by the Alcohol, Drug Abuse, and Mental Health Administration Reorganization Act (PL 102-321). Based on these laws, Part 2 sets out protections against unauthorized disclosure of substance use records as a way to encourage people to seek treatment. The regulations were established to assure people with substance use problems that their information would not be shared without their very specific consent, other than under several circumscribed conditions detailed in the regulations.
Patient privacy is important, and it needs to be balanced with providing access to the same standard of care afforded to individuals with a medical illness. After all, isn’t this why we fought so hard for the MHPAEA? Doctors ask for a list of your medications, your allergies, your medical conditions and your previous surgeries for a reason: to ensure individualized quality health care without injury or harm to their patients. Don’t individuals with a substance use disorder deserve the same protections? Shouldn’t a doctor prescribing pain medications know whether or not his or her patient is being treated for an opioid addiction? Shouldn’t a primary care provider know that his or her patient has cirrhosis of the liver?
The proposed rule applies to federally assisted programs. These outdated standards do not apply to patients with substance use disorders seeking care outside of these programs. People being treated in non–Part 2 programs have their records protected in the same way medical and mental health records are protected, by the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) regulations. Hopefully, SAMHSA will truly modernize Part 2 in the final rule and ensure that a treating provider has all of the necessary patient records to properly treat his or her patient and allow for the sharing of patient information for services like care coordination without a signed authorization. If the final Part 2 rule mirrors HIPAA, for treatment, payment and health care operations, patients will have privacy protections, quality care and the benefits of whole-person integrated care. This can be accomplished while maintaining the Part 2 prohibitions on sharing information with law enforcement and for other non-treatment-related purposes that might inhibit people from accessing care.
To quote the Centers for Medicare & Medicaid Services when they announced their initiative supporting improving connectivity for behavioral health and Medicaid providers, “doctors and other clinicians need access to the right information at the right time in a manner they can use to make decisions that impact their patient’s health.”