Does 42 CFR Part 2 Apply to Me and Will it Continue to Be? Renée Popovits, J.D. Texas Council of Community Centers April 30, 2015

Roadmap for Today Brief overview of Part 2 Decision Tree Ways to Legally Share Part 2 Protected Information Part 2 Evolution on the Horizon Q&A Words of Wisdom

Confidentiality Protections Confidentiality specific to substance abuse treatment, diagnosis and referral Enacted back in early 1970s Federal laws: 42 U.S.C. 290dd-2 Federal regulations: 42 C.F.R. Part 2

Why Stringent Protections for Addiction Treatment? Premised on negative stigma historically associated with substance abuse Assumed individuals would be more motivated to seek treatment if they were assured their treatment remained confidential

Patient Identifying Information 42 CFR Part 2 Name Address Social Security Number Fingerprints Photograph Other similar info by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available info Does not include a number assigned to a patient by a program - different than HIPAA HIPAA Same: 42 CFR Part 2 PLUS Address is defined more broadly Names of relatives/household Name of employer Variety of dates Telephone/fax number E-mail address/URL/IP Medical record number Account/health plan number Vehicle or other device serial number Popovits & Robinson, P.C.

7 STEP 1 IS THE CENTER “FEDERALLY ASSISTED”? 1. Is the Center conducted in whole or in part by any department or agency of the United States? 2. Is the Center being carried out under a license, certification, registration or other authorization granted by any department or agency of the United States, including Medicare certification, authorization to conduct methadone maintenance, or registration to dispense under the Controlled Substance Act if the substance is used to treat substance abuse? 3. Is the Center receiving Federal financial assistance in any form, including assistance from the State or a local government unit who in turn receives Federal funds that could be used for substance abuse treatment? 4. Is the Center allowed income tax deductions for contributions or granted tax exempt status by the IRS?

If YES to ANY of Questions 1-4 STEP 1 8 IS THE CENTER “FEDERALLY ASSISTED”? If YES to ANY of Questions 1-4 Proceed to STEP 2 If NO to ALL of Questions 1-4 Center is NOT a “Federally Assisted” program under 42 CFR Part 2 Proceed to STEP 3

STEP 2 9 DOES THE CENTER “HOLD ITSELF OUT” AS PROVIDING AND PROVIDE ALCOHOL AND SUBSTANCE ABUSE DIAGNOSIS, TREATMENT OR REFERRAL FOR TREATMENT (the “Services”)? 5. Is the provider licensed by the State to provide these Services? 10. Does the Center make statements on the internet about providing these Services? 6. Does the Center have a specific unit which these Services? 11. Does the Center have a specific contract with the Texas Department of State Health Services to provide these Services? 7. Are there personnel within the Center whose primary function is providing these Services and who are identified as such specialized personnel? 12. Does the Center provide Screening, Brief Intervention and Referral to Treatment “SBIRT” services? (If you are not federally assisted, Part 2 does not apply to SBIRT records) 8. Does the Center advertise or post notices about providing these Services? 13. Is the Center conducting any activities that would lead one to reasonably conclude that it is providing these Services? 9. Does the Provider hold certifications in addiction medicine and provide these Services?

STEP 2 10 If YES to ANY of Questions 5-13 Center MUST comply with DOES THE CENTER “HOLD ITSELF OUT” AS PROVIDING AND PROVIDE ALCOHOL AND SUBSTANCE ABUSE DIAGNOSIS, TREATMENT OR REFERRAL FOR TREATMENT (the “Services”)? If YES to ANY of Questions 5-13 Center MUST comply with 42 CFR Part 2 If NO to ALL of Questions 5-13, proceed to STEP 3

STATE REQUIREMENT ANALYSIS STEP 3 11 STATE REQUIREMENT ANALYSIS 14. Does a State licensure law or regulation specifically require your Center to comply with Part 2 elements regardless of applicability under Federal definition? 15. Does a State confidentiality law or regulation specifically require your Center to comply with Part 2 elements regardless of applicability under Federal definition? 16. Does a State funding contract specifically require your Center to comply with Part 2 elements regardless of applicability under Federal definition?

STATE REQUIREMENT ANALYSIS STEP 3 12 STATE REQUIREMENT ANALYSIS If YES to ANY of Questions 14-16 Center MUST comply with 42 CFR Part 2 If NO to ALL of Questions 14-16 Center DOES NOT need to comply with 42 CFR Part 2  

Ways to Legally Share Part 2 Protected Information Patient Written Consent [2.31 and 2.35] Medical Emergency [2.51] Qualified Service Organization [2.12(c)(4)] Audit and Evaluation [2.53] Research [2.52] Communications within a Program or Entity having Administrative Control [2.12(c)(3)] Child Abuse Reporting [2.12(c)(6)] Crime on Program Premises or Against Program Personnel [2.12(c)(5)] Court Order [2.61 – 2.67] Armed Services and VA Administration Exemption [2.12(c)(1)&(2)] Not Identify the Individual as an Alcohol or Substance Abuser [2.12(a)(i)]  

Patient Written Consent HIPAA Authorization Description of info to be disclosed Name of person(s) to whom disclosure is made Description of purpose of disclosure Expiration date or event Signature of individual and date Description of authority to act if signed by personal rep. Statement on right to revoke, exceptions to revocation and description of how to revoke or a reference to the Notice of Privacy Practices Statement that treatment, payment, enrollment or eligibility for benefits may not be conditioned on the authorization or if permitted, a statement about the consequences for refusing to sign Information is subject to redisclosure 42 CFR Part 2 Consent Program or person making disclosure Person /organization to whom disclosure is made Name of patient Purpose of disclosure How much/what kind of info to be disclosed Revocation provision Date, event or condition of expiration Signature Date

Medical Emergency 42 CFR Part 2 Can disclose information to medical personnel to extent necessary for emergency Narrowly construed - must be immediate threat to health and require immediate medical intervention Must document certain elements in patient’s record HIPAA May use or disclose PHI in a medical emergency without authorization, provided the treatment agency furnishes the notice of privacy practices as soon is reasonably practicable after the emergency

Qualified Service Organization 42 CFR Part 2 QSOs Must enter into QSO Agreement to allow sharing of information Person/agency that provides services to program and will have access to confidential information HIPAA Business Associates Must enter into Business Associate Agreement to allow sharing of information Person/agency that provides services to program involving confidential information or HIPAA-related activity Many requirements consult the rule

Audit and Evaluation Requires a written agreement Different standard applied if records are copied or removed Pertains to any federal, state or local governmental agency providing financial assistance or authorized to regulate the program Applies to any private person providing financial assistance to the Program (3rd party payor) or quality improvement organization (performing utilization or quality control review) Section on Medicare or Medicaid audit Limitations on disclosure and use

Research Patient identifying information may be disclosed for scientific research Program director makes decision Researcher is qualified Has a research protocol to maintain the information in accordance with security requirements of 2.16 and will not be redisclosed except back to the program and not identify any individual patient in the report Written statement required verifying IRB review

Communications within a Program or Entity having Administrative Control Permits communication of information between or among personnel having a need for the information in connection with their duties Duties must arise out of the provision of diagnosis, treatment or referral for treatment Allowed within a program without consent Allowed between a program and an entity that has direct administrative control without consent Should apply minimum necessary standard

Revising Part 2 Regulations: What is your position on revising the regulations at 42 CFR Part 2? I am in favor of revising 42 CFR Part 2 to ease consent requirements in order to facilitate the sharing of SUD information among providers 49.0% I am in favor of revising 42 CFR Part 2 to make it more consistent with HIPAA 39.0% I am in favor of revising 42 CFR Part 2 to expand the protections to cover SUD information collected by all medical providers 10.4% I am against revising 42 CFR Part 2 1.5% N=259 CiMH, National Council & ASAM 2014 Poll Results August 13, 2013 Popovits/Vendome Webinar Poll Results N=154

SAMHSA Listening Session On June 11, 2014, SAMHSA held a public listening session to solicit input from stakeholders on updating 42 CFR Part 2. Seven topics were addressed: Applicability Consent Requirements Redisclosure Medical Emergency Qualified Service Organization (QSO) Research Electronic Prescribing and Prescription Drug Monitoring Programs (PDMPs)

1. Applicability of 42 CFR Part 2 Difficulties encountered for identifying providers covered by Part 2 Whether Part 2 applies depends on whether the provider advertises their SUD services (holds themselves out) Options for defining what information is covered Definition based on substance abuse treatment services rather than type of facility providing the services SBIRT and other pretreatment services would not be covered Consider how redefining applicability impacts patients, healthcare providers, HIEs, CCOs, HIT vendors, and others

Applicability…On the Horizon Limit applicability only to those facilities licensed to provided SUD Treatment Brighter lines for patients understanding their protections Changes will promote coordinated care among providers

2. Consent Requirements 42 CFR 2.31 requires written consent to include name or title of individual or the name of the organization to which the disclosure is made (the To Whom Issue) Cannot include future unnamed providers on consents SAMHSA is examining consent requirements to facilitate information sharing within healthcare while ensuring the patient is fully informed and necessary protections obtained Solicited comments on allowing general descriptions of individuals/organizations; Providing patient with list of providers; requiring the consent to explicit treatment information; disclosing specific providers of multiple units; evaluating impact on integration of data, HIEs, health homes, ACOs and CCOs

Consent…On the Horizon Consent provisions will be expanded to permit “any provider involved in my care” Harmonized with HIPAA elements Information sharing with Health Homes, ACOs and CCEs will be permitted under certain conditions Add patient safeguards such as audit trails, routine audits and mandatory exclusion from evidence

3. Redisclosure Numerous concerns on prohibition on redisclosure (2.32) Most EHRs do not support data segmentation Need to keep SUD information separate from rest of medical record or apply Part 2 protections to entire record SAMHSA considering that prohibition on redisclosure would only apply to information that would identify a person as a substance abuser and allow other health related information shared by the Part 2 program to be redisclosed

Redisclosure…On the Horizon BIGGEST CHALLENGE Suggestions thus far won’t solve problem Need better categorization of data and uniform reporting before you can achieve Reexamine existing conflicting rules on redisclosure

4. Medical Emergency 2.51 permits information to be disclosed without consent “For the purpose of treating a condition which poses an immediate threat to the health of any individual and requires immediate medical intervention” Statute permits disclosures to medical personnel to the extent necessary to meet a bona fide medical emergency SAMHSA seeking to relax standard consistent with statute and allow providers discretion when a bona fide emergency exists This would enable sharing information with a detox center when a patient is too intoxicated to provide informed consent SAMHSA sought factors to determine whether a medical emergency exists SAMHSA also sought use cases and patient privacy concerns

Medical Emergency…On the Horizon Consistency in definitional application Witness broadened definitions Still need revisions to who documents the emergency; with EHRs can’t preserve existing requirements

5. Qualified Service Organization Concerns raised from payers and health management organizations about disclosing information to ACOs and CCOs for care coordination, population health management and outreach for chronic conditions SAMHSA considering expansion of definition of Qualified Service Organization (QSO) section 2.11 to: Explicitly include care coordination services Allow QSO Agreement between a payer or ACO and service provider SAMHSA also sought other use cases and patient privacy concerns

QSO…On the Horizon Easiest way to share information without consent Questionable if such expansion is supported by existing statute Artificial solution because Coordination Services are provided to the patient not the program Solution not transparent for patients

6. Research Program director may authorize disclosures for scientific research purposes Absent consent organizations that store patient health data cannot disclose part 2 data to qualified researchers or research organizations SAMHSA considering expansion to allow healthcare entities receiving and storing part 2 data including third party payers, HIEs and CCOs for purposes of research, audit or evaluation SAMHSA solicited factors on how healthcare entities are organized, functioned and have duties to an umbrella organization SAMHSA also sought use cases and patient privacy concerns

Research…On the Horizon Key to understanding what is working Whoever controls the data holds the power of and ability to change Need to focus on use of research data rather than restrictions on who can receive

7. Electronic Prescribing & PDMPs Consent required for pharmacies that receive electronic prescriptions directly from a Part 2 program Consent required for a Prescription Drug Monitoring Program (PDMP) to redisclose information to those with access to the PDMP Pharmacy data systems cannot manage patient consent or segregate data subject to Part 2 Pharmacy systems lack ability to identify providers subject to Part 2 preventing data from reaching the PDMP Some PDMPs are accessible by law enforcement and can lead to investigation, arrest or other forms of discrimination SAMHSA solicited comments from pharmacy system vendors seeking concerns, technology barriers, use cases and patient privacy concerns

Electronic Prescribing & PDMPs…On the Horizon Many productive benefits to PDMPs Need to prohibit access to law enforcement Need to address appropriate conditions and access to child welfare Need to include parameters for treatment intervention and restrictions on use Mandatory exclusions from evidence for inappropriate use

QUESTION & ANSWER

What Do You Know About 42 CFR Part 2? “The evolution of Part 2 must contemplate not just a vision for integrated care but also address protections of patients rights” -Renée Popovits “Patients deserve the option and choice or deciding whether they want to share their substance use disorders information and health information exchanges” -Renée Popovits

Achieving Integration Under the ACA Costs higher when behavioral health remains untreated. Solution: Allow MH/SUD patients the right and choice to decide whether to share information, and Facilitate the legal exchange of information needed to advance the quality of care.

Embrace Hope and Believe your Actions will make a Difference. The Moment is Now for One World, One Health. Successful Collaboration and Comprehensive Wellness can be Achieved. Embrace Hope and Believe your Actions will make a Difference. Renée M. Popovits renee@popovitslaw.com 708.479.3230