HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

HHS Issues Final Rule on Confidentiality of Alcohol and Drug Abuse Patient Records Regulations

In February 2016, the Department of Health and Human Services published a proposed change to the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, (42 CFR Part 2) to facilitate health integration and information exchange. HHS has now finalized the Part 2 changes following an extensive evaluation of public comments, according to a recent press release from the Substance Abuse and Mental Health Services Administration (SAMHSA).

The Confidentiality of Alcohol and Drug Abuse Patient Records regulations were introduced in 1975 to protect the privacy of patients receiving treatment for substance abuse and mental health disorders. At the time there was concern that the revelation of patients’ identities would have serious social consequences and a lack of privacy may deter individuals from seeking treatment.

The healthcare delivery system has changed considerably during the past 40 years and Part 2 regulations were in need of modernization. While the privacy of patients must and will still be protected, the Part 2 changes will help to promote health integration and allow information exchange with research institutions.

According to HHS Deputy Assistant Secretary, Kana Enomoto, the Part 2 changes “will further enhance health services research, integrated treatment, quality assurance and health information exchange activities while at the same time safeguarding the essential privacy rights of people seeking treatment for substance use disorders.” Enomoto went on to explain that “These efforts clear the way for integrated health care models that can provide a better, more cost-effective health care system that also empowers people to make key decisions about their health care.”

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

A number of new provisions have been finalized in the HHS Final Rule:

  • Any lawful holder of patient identifying information will be permitted to disclose Part 2 identifying information to qualified individuals for purposes of scientific research, provided the research meets certain regulatory requirements. The sharing of data will enable organizations to conduct essential research on substance use disorders. SAMHSA will also permit data linkages between data sets and data repositories holding Part 2 data, if certain regulatory requirements are met.
  • In certain circumstances, patients will be permitted to use general designations such as “My Treating Providers” when giving consent to share personal information. Patients are not required to agree to disclosures of their personal information, although by doing so they will be able to benefit from integrated healthcare systems. If patients do use the general disclosure designation, they can request a list of individuals and entities with whom their information has been shared.
  • Changes have been made that outline audit/evaluation procedures necessary to meet the requirements of CMS-regulated accountable care organization and other CMS-regulated organizations. The changes permit financial and quality assurance functions critical to ACOs and other healthcare organizations.
  • Part 2 has been updated to cover physical and electronic documentation
  • SAMHSA will develop additional sub-regulatory guidance on the finalized provisions and will monitor the implementation of the Final Rule.

HHS has also issued a Supplemental Notice of Proposed Rulemaking (SNPRM) and is seeking input and comments from the public on additional clarifications and suggestions on a number of new provisions including:

  • Clarifying and limiting the circumstances under which contractors, subcontractors and legal representatives of lawful holders of Part 2 data can receive information for payment and healthcare operations activities.
  • An abbreviated alternative statement for the notice to accompany disclosure.
  • The use of contractors, sub-contractors, and legal representatives by CMS-regulated entities to carry out audit and evaluation activities necessary to meet the requirements of a CMS-regulated program.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.