The federal government has issued a long-awaited proposed rule on changing the 41-year-old regulation governing confidentiality of patient records for substance use disorder (SUD) treatment. Under the old rule, treatment programs could not disclose any information about a patient unless the patient gave individualized, written consent. That consent had to name the person receiving the information. Under the proposed rule, which is designed to accommodate electronic health records and integration of medical care, patients could give a “general” consent, which would provide their information throughout an entire hospital, health care system or other organization.

The Substance Abuse and Mental Health Services Administration (SAMHSA) promulgates the regulation, known as 42 CFR Part 2. The law and regulations protects the identity, diagnosis, prognosis and treatment of any patient. The law and regulations were implemented so that patients would be able to seek treatment without fear of having adverse consequences.

In the preamble to the proposed rule, published in the Federal Register February 9 but released online February 5, SAMHSA said it “wants to ensure that patients with substance use disorders have the ability to participate in, and benefit from new integrated health care models without fear of putting themselves at risk of adverse consequences.” While striving to facilitate information exchange, SAMHSA also wants to consider “the legitimate privacy concerns of patients seeking treatment for a substance use disorder,” and said these concerns include “loss of employment, loss of housing, loss of child custody, discrimination by medical professionals and insurers, arrest, prosecution, and incarceration.”


While the addition of a “general” consent is the main issue for privacy loss, there are many other key provisions and definitions in the proposed rule:

  • The proposed rule also clarifies that general medical facilities and general medical practices would only be subject to it if they hold themselves out as providing, or actually provide, substance use disorder diagnosis, treatment or referral to treatment.
  • The summary of the law and regulations can be given to patients in either paper or electronic format.
  • The prohibition on re-disclosure would be modified to indicate that it only applies to information that would identify an individual as having been diagnosed with, treated for or referred to treatment for a substance use disorder.
  • The medical emergency exception would be broadened to give providers more discretion in deciding when a medical emergency exists.
  • Patients would have to be provided with a list of disclosures — who had received their SUD information — but this provision would not go into effect until two years after the final rule goes into effect.
  • Costs associated with updates would be $74.2 million in year one, $47.0 million in year two and $14.8 million in years 3 to 10, for a total of just under $240 million over a 10-year period.
  • The Data Segmentation for Privacy (DS4P) met its goals, which was to show that it is possible to support current Part 2 standards in an electronic context, but SAMHSA said that most current electronic applications may not be able to support it.
  • The Federal Register notice included a clear statement that “stakeholders” had pushed SAMHSA to these changes: “These stakeholders are concerned that part 2, as currently written, continues to be a barrier to the integration of substance use disorder treatment and physical health care.”
  • The definition of substance use disorder would not include tobacco or caffeine.
  • A treating provider relationship begins when an individual seeks health-related assistance from an individual or entity who may provide assistance, even if only by making an appointment.
  • The “to whom” designation would no longer have to be to an individual but could be to an entity such as a hospital or a practice. For a third-party payer, the name of the entity could be used as well, such as Medicare or Medicaid.
  • Research institutions could obtain information as well.

Almost six years ago, SAMHSA said it would not change 42 CFR Part 2 (see ADAW, June 21, 2010). Later that summer, H. Westley Clark, M.D., then-administrator of SAMHSA’s Center for Substance Abuse Treatment (CSAT), along with then-director of SAMHSA Pam Hyde, reiterated that (see ADAW, Aug. 9, 2010). However, by 2013, Hyde had changed her tune, telling a workforce meeting that the regulations was “getting in our way” (see ADAW, Sept. 23, 2013).

The basic requirements of the authorizing statute includes the requirement that the patient’s written consent must be obtained before disclosures can be made. SAMHSA cannot change that without a change in the law itself.

Early comments

The National Association of Medicaid Directors (NAMD) issued a statement on February 8 saying that the proposed changes did not go far enough. Instead, NAMD wants the SUD records to be treated the same way as medical records are treated under the Health Insurance Portability and Accountability Act (HIPAA). “So long as substance abuse information is treated differently from other health information, individuals with substance use disorders will never have the same access, quality, and safety of care as persons with other diseases,” the statement said. “Rather, greater alignment with HIPAA will ensure Medicaid programs and providers can increase access to substance use disorder services; integrate services; ensure patient safety; and ultimately improve the well-being of Medicaid enrollees.”

The Legal Action Center, which was involved in the original writing of 42 CFR Part 2, said in a February 10 press release that it is still studying the proposed rule. However, it added that it “applauds SAMHSA’s efforts to modernize the confidentiality regulations to facilitate communication between providers, better integrate health care, and improve health outcomes — while protecting the core confidentiality protections of the treatment records of people with substance use disorders, so that individuals can seek and receive that care without fear of suffering discrimination, criminal prosecution or other harm.”

Netsmart, which has supported revisions as well (see ADAW, Oct. 19, 2015), said it was not prepared to comment on the proposed rule yet.

Harms of weak privacy rule

SAMHSA opened the door to weakening 42 CFR Part 2 when it held a listening session June 11, 2014 (see ADAW, June 16, 2014). Almost everyone, except for opioid treatment programs (OTPs) and patient advocates, supported making the changes. The question is whether the proposed rule has gone far enough.

At the June 11, 2014, listening session, Joycelyn Woods, executive director of the National Alliance for Medication Assisted Recovery, spoke on behalf of methadone and buprenorphine patients when she said a revision would create a barrier to patients entering treatment, and Mark W. Parrino, president of the American Association for the Treatment of Opioid Dependence, which represents opioid treatment programs, agreed. “We still live in an age of employment discrimination,” said Parrino. “We still live in an age where police cruisers park in front of drug treatment facilities.”

Last week, Robert G. Newman, M.D., president emeritus of Beth Israel Medical Center, told ADAW the proposed rule is “a terrible proposal.” Most people entering treatment in an OTP “are desperate, facing the prospect or presence of severe physical withdrawal, and pressure from demands of drug courts, probation or parole officers, or other agencies of the criminal justice system,” he said. “Under such circumstances, ‘voluntary consent’ is an oxymoron.” The only valid release of information is to confirm with a “registry” that the applicant receives no treatment at any other OTP — and the registry must, under federal law, serve exclusively for the purpose of preventing multiple enrollment, he said.

In addition, said Newman, consent isn’t meaningful unless it’s contemporaneous. “How can one provide informed consent to release information if one has no way of knowing what that information — concerning future events — will reveal?” he said.

The changes “would make a mockery of the promise of patient confidentiality, which for decades has been viewed as essential where patients treated for drug dependence are concerned,” said Newman. (Newman was sued by the government when law enforcement tried to get records of his patients in OTPs in New York City in the 1970s — before 42 CFR Part 2. He won.)

Clark, former director of CSAT, told ADAW last week that the main problem is that researchers and many organizations believe that confidentiality and security are two different things, and that the main problem with breaches is security. “The fallacy is that in preserving confidentiality, greater care is taken to have a stronger interest in security,” he said. “Without that interest, people tend to be lax.”

He added, “Sacrificing privacy and confidentiality on the premise that big data will allow for the treatment of all that ails you is a risky bet.” And he noted that pregnant and parenting women who have SUDs are at heightened risk of investigations by child welfare if their privacy and confidentiality aren’t protected; knowing this, they might not even want to seek treatment.

James C. Pyles, principal with Powers Pyles Sutter & Verville, an expert on health information technology, said the proposal “is another example of the attitude promoted by some vendor and mental health associations that are not subject to standards of professional ethics that we could really improve the health care system if we could just get rid of the patients.”

The proposed rule weakens privacy for patients, he said, but “patients and their silly privacy rights are such a burden to these folks.”

The patients will be asked to sign a consent form authorizing “general” consent throughout a health system when they are at their most vulnerable — presenting for treatment for SUDs. And only if the patient asks for a list of disclosures would it be provided.

“There is nothing in the proposed rule that requires a covered facility to give the patient information so they can make a meaningful decision about this general consent,” said Pyles. Although SAMHSA lists the possible loss of employment, housing, child custody, discrimination by insurers and medical professionals, arrest, prosecution and incarceration, the proposed rule goes on to state that it is designed to help patients benefit from integrated treatment. “There is no statement of why this more widespread disclosure of sensitive mental health and substance abuse treatment information throughout a health care delivery system will not enhance the risk of the harms the current rule is designed to address,” said Pyles. “Nor is there any explanation of how disclosing this treatment information throughout such systems will in some way eliminate, or even reduce, these harms.”

In fact, there is already an “unprecedented health information breach epidemic in which the health privacy of more than 150 million Americans has been breached over just the past six years,” said Pyles.

“It would appear that, based on SAMHSA’s own rationale for the proposed rule, the proposed rule conflicts with SAMHSA’s mission, which is ‘to reduce the impact of substance abuse and mental illness on America’s communities,’” said Pyles. “The only way this rule could be consistent with SAMHSA’s mission is if that mission would be furthered by discouraging individuals from seeking mental health and substance abuse treatment.”

The June 11, 2014, listening session comments are posted on the SAMHSA website at

Comments are due by 5 p.m. on April 11. For the proposed rule, go to