CMS proposes to modify privacy rules for drug and alcohol abuse, behavioral health records, creating opportunity for integrating primary care and behavioral health

For the last ten years, technological maturation and the transition to accountable care and value-based payment have spurred the evolution of new methods of collecting and exchanging sensitive healthcare information.  To the chagrin of many innovators in the healthcare industry, however, privacy and security law has been slow to evolve, often representing a barrier to emerging models of healthcare aimed at integrating and streamlining care. One of the most promising models of care delivery accelerating in recent years is the integration of behavioral and primary healthcare. Unfortunately, because of the current federal rules regarding the protection of behavioral and primary healthcare information, these integrative models face operational and technological infrastructure challenges to managing and exchanging patient data that slow progress. For instance, for an organization that holds both primary care and behavioral health records related to substance use disorders (SUD), there are two separate sets of rules for how that information can be accessed and disclosed. Therefore, many organizations must implement costly data segmentation protocols and develop and implement separate consents and security policies. This creates redundant administrative costs and increases security risks.

On February 5, the Secretary of Health and Human Services, Sylvia Burwell, announced a proposed rule that would update privacy rules regarding substance abuse records--for the first time since 1987. The proposed rule would amend Title 42 of the Code of Federal Regulations part 2 (Part 2), which protects the confidentiality of the identity, diagnosis, prognosis, or treatment of patient records from individuals or entities who provide SUD diagnosis, treatment or referral for treatment. The stated intent of the Substance Abuse and Mental Health Services Administration (SAMHSA) in the promulgation of the rule is to “increase opportunities for individuals with SUD to participate in new and emerging health and health care models and health information technology (IT)” and to “to facilitate the sharing of information within the health care system to support new models of integrated health care…” The proposed changes would reduce administrative burden related to segmentation of primary care and behavioral health information related to SUD. In addition, the proposed changes specifically allow for the use of this information by organizations conducting population healthcare initiatives.

Key changes proposed by SAMHSA include the following:

A Note on the Definition of Program and Scope of Applicability…

The current regulations are applicable to “Programs”—defined as applicable to “individuals and general medical facilities”. However, this definition does not explicitly consider applicability of Part 2 to the growing number of integrated care settings, or settings where SUD treatment services are provided “incident to” general health care services. Therefore, the proposed rule includes medical practices (or personnel within medical practices) that provide SUD diagnosis, treatment or referral.

Newly Defined QSO Services

A qualified service organization (QSO) is an entity that provides certain services to a Program. Under the current regulations, restrictions on disclosure (i.e., prior written consent requirements) do not apply to information shared between a Program and QSO if the QSO needs that information to provide services and there is a written agreement in place (QSOA). To encourage ease of information sharing within new care models, the proposed rule revises the definition of QSO to specifically include population health management as an example of a service a QSO may provide. The commentary to the proposed rule uses accountable care organization (ACOs), managed care organizations (MCOs), and patient-centered medical homes (PCMH) as examples of QSOs that may exchange Program information for population health purposes.

Updated Patient Consent and Notification Rules

Under the current regulations, patients must provide a specific, written consent to the release of information related to “federally assisted” SUD diagnosis, treatment, or referral for treatment. This consent is highly specific, requiring the Program to annotate down to the individual(s) allowed to access the records. This can create a barrier to information sharing within organizations, like ACOs, that have multiple provider participants that are added on a regular basis, because it requires that the ACO execute a new consent any time a new provider requires access to records. For this reason, many provider organizations do not include SUD information in their systems. SAMHSA is proposing to revise the consent requirements to permit a more general designation (in the “To Whom” section of the consent form) of the individuals or entities to which a disclosure is made, as long as those individuals or entities have a “treating provider relationship” with the patient whose information is being disclosed. Importantly, SAMHSA commentary states that an entity may have a treating provider relationship with a patient if the entity employs or privileges one or more individuals who have a treating provider relationship with the patient. If there is no treatment relationship, the consent would have to be more specific, but does not need to contain individual names. In the absence of a treating provider relationship, the disclosing provider could simply designate the name of the entity (e.g., Acme ACO, Western HIE).

Notably, the rule also proposes some additional consumer protections. The consent form needs to (1) explicitly describe the SUD-related information to be disclosed and (2) specifically name the individual or entity permitted to make the disclosure. The rule also proposes to require that, upon request, patients receive a listing of the names of the treating providers to whom their information is disclosed.[1] Last, the disclosing provider must obtain written confirmation from the patient that they understand both the terms of their consent and, when using a general designation, that they have the right to obtain, upon request, a list of entities to which their information has been disclosed.

Disclosure and Redisclosure

The proposed rule would clarify that the prohibition on re-disclosure provision only applies to the subset of medical record information that could identify an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder, and allows other health-related information shared by the Program to be re-disclosed.

What would this mean for providers and related entities?

The proposed changes will require an initial set of administrative, operational and technical changes for providers. Some examples are included, below:

1. Updates to Part 2 patient consent forms

2. IT upgrades to (1) accommodate new consent requirements and (2) record the list of entities to which information is disclosed

3. Revision of partner contracts to ensure adherence to disclosure and redisclosure rules

4. Training staff on new requirements

Conclusion

Through its modification of consent and disclosure requirements under Part 2, as well as its inclusion of population health in its definition of QSO services, this proposed rule has the potential to ease barriers to streamlined and efficient exchange of patient information between primary care and behavioral and mental health providers. Relaxed consent requirements will make it easier for accountable care organizations (ACO), health information exchanges (HIE) and other coordinated care organizations to manage, analyze and exchange information from individuals with substance use disorders. For provider organizations, this means easier access and more complete patient records to assist in coordination of care and population health management.

[1] This disclosure requirement would not take effect until 2 years after the publication of the Final Rule.