1. 42 CFR Part 2 Final Rule and Health Center Compliance California Primary Care Association
Good afternoon everyone and welcome to this HITEQ webinar on the 42 Code of Federal Regulations Part 2 Final Rule and Health Center Compliance.
My name is Nathan Botts from the Health Information Technology, Evaluation and Quality Center (or HITEQ Center) and I will be your moderator for this webinar.
If you have questions during this presentation will be taking them through the chat function in the lower left hand corner of your screen. We will address as many as we can at the end of the presentation as time permits.
Your feedback is important to us as it helps us to plan effective webinars and other trainings.  At the end of this webinar you’ll be asked to complete an evaluation survey. It will pop up on your screen immediately after this webinar. We thank you in advance for taking the time to provide your feedback.
June 21, 2017 | 12-1 pm PT

2. HITEQ Purpose
The Health Information Technology Evaluation and Quality (HITEQ) Center is a HRSA-funded Cooperative Agreement that collaborates with HRSA partners to support health centers in full optimization of their EHR/Health IT systems
The HITEQ Center is a HRSA-funded cooperative agreement that collaborates with our HRSA partners including PCAs, HCCNs and other National Cooperative Agreements to support HCs in full optimization of the use of EHRs and other health IT systems for continuous data driven QI

3. HITEQ Focus Areas
HITEQ services are provided within 10 main focus areas: Health IT Enabled Quality Improvement, EHR Selection and Implementation, Health Information Exchange, Achieving Meaningful Use, QI/HIT Workforce Development, Value Based Payment, Privacy and Security, Electronic Patient Engagement, and Population Health Management.
For the Web-based health IT knowledgebase, we have resource sets for each of the 10 main topic areas. These resource sets are curated groups of resources that we have either developed internally or identified from experts or organizations that are health center focused. Resource sets include: business cases; checklists; sample forms; decision support tools; best practices; tips and lessons learned; and case studies.
Today we are highlighting the 42 Code of Federal Regulations Part 2 Final Rule implications for community health centers.

4. Today’s Presenters Reece Hirsch, CIPP Morgan, Lewis & Bockius LLP
Co-Head of Privacy & Cybersecurity Practice
Brenda Goldstein
LifeLong Medical Care
Psychosocial Services Director
Julia Weisner, JD, Esq
Health Center Counsel & Compliance Director

5. Session Agenda Review history and recent changes of 42 CFR Part 2
Review common definitions, and how the changes may affect integrated medication-assisted treatment (MAT) and Screening, Brief Intervention, and Referral to Treatment (SBIRT) programs. 
LifeLong Medical Care’s Experience

6. APPLYING 42 CFR Part 2 to Primary health care providers
June 21, 2017
California Primary Care Association Webinar
Reece Hirsch, CIPP
Co-Head of Privacy & Cybersecurity Practice
v.3

7. The History of Part 2 In 1970 and 1972, Congress enacted
The Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment and Rehabilitation Act
The Drug Abuse Prevention and Rehabilitation Act of 1972
Designed to protect the privacy of alcohol and drug abuse records
And ensure that persons substance abuse disorders (SUD) are not dissuaded from seeking treatment due to fear of stigma
1975: US Dept. of Health, Education and Welfare issues the Confidentiality of Alcohol and Drug Abuse Records regulations, located at 42 CFR Part 2

8. Part 2 Regulations
The Part 2 regulations set forth the limited circumstances in which SUD patient information may be used, disclosed and re-disclosed
Until recently, regulations had not been substantively amended for nearly three decades
Many providers argued that Part 2 had become outdated in the wake of the Health Insurance Portability and Accountability Act (HIPAA)
January 18, 2017: US Dept. of Health and Human Services (HHS) Substance Abuse and Mental Health Services Administration (SAMSHA) released final regulations revising Part 2
Intended to facilitate disclosure of SUD information between providers, patients and payors
More consistent with HIPAA but still recognizing sensitive nature of SUD information
Effective March 21, 2017

9. Part 2 as a Barrier to Integration
Prior to the recent regulations, Part 2 had become a barrier to integration of substance abuse treatment with health care decisions affecting the whole patient
Part 2 was no longer consistent with the trend toward health information exchange
Two disparate sets of privacy standards had served to isolate SUD treatment programs from other providers

10. What is a “Program”?
A “program” is defined as any “individual” or “entity” that “holds itself out as providing education, treatment or prevention to individuals in need of alcohol or drug abuse treatment”
A general medical facility is typically not considered a program
However, a defined unit within a general facility that holds itself out as a provider of substance abuse and/or alcohol treatment services and provides those services is a program under Part 2
Specific providers working in a general medical facility whose main job function is to diagnose and treat patients for SUD meet the definition of “program”

11. “Federally Assisted”
A program must be “federally assisted,” which means that the program:
Is being operated by a department or agency of the United States
Is operating based on the authorization of a department or agency of the US
e.g., the program has received a license, certification, registration or other authorization from the government
Is receiving federal financial assistance or is part of an organization receiving federal financial assistance OR
Receives tax deductions or is operating under tax-exempt status

12. Examples of Federally Assisted Programs
A program authorized, certified, licensed, or registered by the federal government
A program receiving federal funds in any form, including funds that do not directly pay for SUD services
Any program granted tax-exempt status by the IRS
A program allowed tax deductions by the IRS for contributions
A program authorized to conduct business by the federal government, including programs certified as a Medicare provider
A program authorized to conduct methadone maintenance treatment
A provider registered with the Drug Enforcement Agency
A program conducted by the federal government

13. Covered by Part 2?
An internist who provides occasional advice about substance abuse to patients as part of his or her primary care practice
NO: Internist does not “hold himself/herself out” as providing specialized substance abuse treatment services
Community health clinic that is not licensed as a substance abuse treatment provider but advertises its expertise in serving patients with substance abuse disorders
PROBABLY: If the clinic promotes its substance abuse treatment services capacity and provides or makes referrals for substance abuse services, probably subject to Part 2

14. Applicability of Part 2 to FQHCs
FQHCs and other primary care providers are typically general medical facilities that are not programs subject to Part 2
Typical FQHC does not “hold itself out” as providing SUD treatment
What if an FQHC provides certain instances of SUD services without “holding itself out” as a SUD provider?
What if a certain physician at a FQHC provides some SUD services but it not his or her “main job function”?
However, FQHCs are federally assisted because they are certified by the federal government

15. Interaction Between HIPAA and Part 2
A provider that is subject to both HIPAA and Part 2 must follow both regulations
The practical effect is that compliance with both regulations will necessarily mean adherence to the regulations with the most restrictions
Likely Part 2
HIPAA’s definition of “health information” is very broad, including any information that relates to
The past, present or future physical or mental health condition of an individual
The provision of health care to an individual
The past, present or future payment for the provision of health care to an individual

16. Information Subject to Part 2
Information protected by Part 2 overlaps with HIPAA but is narrower in scope
Information that identifies individuals who have received treatment or are receiving treatment for substance abuse and/or alcohol abuse
“[Records] of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of [drug abuse and/or alcohol abuse programs”

17. Examples of Part 2 Information
A counselor in a Part 2 program is asked to confirm whether an individual was ever admitted to the program
Contents of an electronic medical record system in an FQHC that includes patient information form the FQHC’s advertised SUD treatment program
Contents of an electronic medical record system in a hospital that includes patient information from the hospital’s methadone treatment program

18. Disclosure of SUD Treatment Records
Except in very limited circumstances, Part 2 does not permit a federally assisted program to disclose SUD treatment records unless a patient first provides voluntary written consent
The consent form must include 10 required elements as specified in the law, including
Name or title of the individual or organization to whom the disclosure is being made (the “To Whom” provision)
The specific purpose or need for disclosure
A description of how much and what kind of information will be disclosed
Expiration date or event

19. Exceptions to Authorization Requirements Under Both HIPAA and Part 2
Internal program communications
In response to a crime against program personnel or on program premises (or threats to commit such a crime)
To report suspected child abuse or neglect
Medical emergencies

20. Exceptions to Authorization Requirements Under Both HIPAA and Part 2 (cont.)
In response to a valid court order
For audit and evaluation activities
For research activities
In communication with a Qualified Service Organization (Part 2) or business associate (HIPAA)

21. Criminal Justice Disclosures
A Part 2 program may disclose information about a patient to persons in the criminal justice system who have
Made participation in the program a condition of the disposition of any criminal proceedings against the patient OR
A condition of the patient’s parole or release from custody

22. Minors and Part 2
Under Part 2, a minor must always sign the consent form for a program to release information
Even to his or her parent or guardian
HIPAA defers to the requirements of other applicable state laws that define who constitutes the “personal representative” of a minor

23. Part 2 and Health information Exchanges
Previously, Part 2 did not permit a patient to authorize disclosure to a class of organizations
The new Final Rule allows the patient to consent to disclosure to a Health Information Exchange (HIE) or Accountable Care Organization (ACO) network generally
So long as the “To Whom” section of the consent designates a general description of individuals entities with a treatment relationship with the patient

24. Formal Policies and Procedures
The Final Rule clarifies that Part 2 programs and other entities maintaining Part 2 information must have formal policies and procedures related to the security of electronic and paper records
Not nearly as prescriptive as the HIPAA Security Rule
Final Rule does not establish that compliance with HIPAA requirements will necessarily be sufficient to meet this requirement

25. Redisclosure Prohibition
Part 2 even restricts the re-disclosure and use of SUD records once they have been lawfully disclosed by a SUD program
In order to fulfill its statutory obligations, even with the patient’s signed written consent to disclosure, all SUD records must be accompanied by a statement prohibiting further disclosure unless
Disclosure is expressly permitted by the written consent
As otherwise permitted by Part 2
Final Rule clarifies that prohibition on redisclosure only applies to records that identify, directly or indirectly, individual as having been treated for SUD
Such as through medical codes or descriptive language

26. Redisclosure Statement
Even when a patient has signed a consent to disclosure of Part 2 records, the consent must be accompanied by this statement:
This statement has been disclosed to you from records protected by Federal confidentiality rules (42 CFR Part 2). The Federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient

27. Qualified Service Organizations
Under Part 2 a qualified service organization (QSO) is an individual or entity providing a service to Part 2 treatment programs pursuant to a written agreement.
QSO services include data processing, bill collecting, dosage preparation, laboratory analyses, or legal, accounting or other professional services
Final Rule narrows the ability to use QSO arrangements
Care coordination and medication management are no longer permitted purposes for using a QSO agreement

28. Disclosures for Research Purposes
The Final Rule modifies Part 2’s research exception
Permits disclosure of Part 2 data to qualified personnel for the purpose of conducting scientific research by a Part 2 program or other lawful holder
The researcher must provide documentation of meeting certain requirements related to other existing protections for human research
Final Rule also enables researchers holding Part 2 data to obtain linkages from other data sets, provided that appropriate safeguards are in place

29. Medical Emergencies
Prior to the Final Rule, Part 2 provided that SUD information may be disclosed to medical personnel
“For the purpose of treating a condition which poses an immediate threat to the health of any individual and which requires immediate medical intervention”
Final Rule modifies the medical emergencies provision to reflect the statutory language that Part 2 information may be disclosed to medical personnel without patient consent to the extent necessary to meet a “bona fide medical emergency”
Intended to give providers greater discretion to determine when a medical emergency exists

30. SUD Discrimination Addressed
Concerns about continuing discrimination against SUD patients persist
Final Rule addresses these concerns indirectly
Final Rule expands protections to former, as well as current, patients
Final Rule requires Part 2 programs and other lawful holders of SUD information to have in place formal policies and procedures addressing security for electronic and paper records

31. Takeaways
Most primary care clinics will be general medical facilities not subject to Part 2
For FQHCs and other primary care clinics that regularly provide SUD treatment services, it’s a fact and circumstances test as to whether the clinic constitutes a Part 2 program
The issue needs to be carefully considered by primary care clinics that are in the gray area because the requirements of Part 2 are stringent
HIPAA compliance is not sufficient

32. Biography
W. Reece Hirsch counsels clients on healthcare regulatory and transactional matters and co-heads the firm’s privacy and cybersecurity practice. Representing healthcare organizations such as hospitals, health plans, insurers, physician organizations, healthcare information technology companies, and pharmaceutical and biotech companies, Reece advises clients on issues such as privacy, fraud and abuse, and self-referral issues. This includes healthcare-specific data privacy and security matters, such as compliance with the Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act.
W. Reece Hirsch
San Francisco T F

35. Substance Use Records Privacy Regulations Impact on FQHCs LifeLong Medical Care California Primary Care Association
June 21, 2017

36. Disclaimer
This presentation and its contents are not intended to be legal advice.

37. AGENDA Federal and CA Substance Use Records Regulations
What Does SAMHSA Have to Say About 42 CFR Part 2 and FQHCs?
How Does California Privacy Law Impact FQHCs?
Were they intended to apply to FQHCs?
What do the CA Law Exceptions Mean for FQHCs – what can and can’t we do?
Policy Arguments for Why the Laws Likely Don’t Apply to FQHCs?
How Do 42 CFR Part 2 Requirements Impact FQHCs?
How LifeLong Integrates Substance Use Services into Primary care

38. High Level Points
42 CFR Part 2 requirements don’t apply apply to FQHCs that do not have an identified unit which is holds itself out as a treatment provider, where the primary function of the provider is not to treat substance use disorders.
California privacy laws are similar to 42 CFR Part 2, however permit sharing records with treating professionals within the same Organization. The law is silent on whether records can be shared with outside specialists and there is no guidance as to whether or how this would be applied to FQHCs.

39. Federal and CA Substance Use Records Regulations
Federal Law:
42 CFR Part 2
California Law:
Cal Health & Safety Code 11845(a), (b) & (c)
Federally assisted programs can’t disclose SU TX records without written patient consent, which must be specific to each provider the disclosure is made to and describing the purpose of each consent.
*Federally assisted – FQHCs would fall under this category.
Sharing of SU TX records maintained by a program, which is
Assisted by the “Department”
Requires prior written consent of the client
Disclosure may be made only for the purposes as clearly stated in the consent
Exceptions?
Communications between qualified professional persons employed by the Program in the provision of service are permitted without specific patient consent!

40. Federal Law What Does SAMHSA Have to Say About 42 CFR Part 2 and FQHCs?
QUESTION 10: Do all primary care providers who prescribe controlled substances to treat substance use disorders meet the definition of a “program” under Part 2? “federally qualified health centers would generally be considered “general medical care” facilities”
and ONLY meet Part 2’s definition of a program if:
they work in an identified unit within such general medical care facility that holds itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment or referral for treatment or
the primary function of the provider is alcohol or drug abuse diagnosis, treatment or referral for treatment and they are identified as providers of such services.

41. California Law Were CA SU Consent Laws Intended to Apply to FQHCs
California Law Were CA SU Consent Laws Intended to Apply to FQHCs? “Assisted by the Department?”
SU TX programs were previously regulated by the California Department of Alcohol and Drug Programs (ADP).
In 2013, CA transferred ADP regulatory responsibilities to DHCS (the “Department”).
Not clear that the State intended the law to apply to FQHCs providing treatment services.
*Rules for Exchanging Behavioral Health Information in California. California Health Care Foundation, July 2015.

42. What do the CA Law Exceptions Mean for FQHCs?
Can We Share SU Records Between FQHC Staff and Providers Who Treat the Patient? Yes!
Communications between qualified professional persons employed by the Program in the provision of service are permitted without consent!
Can We Share SU Records Without Outside Specialists Treating the Patient?
There is no rule or guidance on this type of disclosure.

43. Policy Arguments for Why the Laws Don’t Apply to FQHCs?
Barrier to Coordination of Care
Government has incentivized care coordination through encouraged use of EHRs which require data sharing among different providers.
Quality Data Sharing and Ties to Payment
Government has imposed increased quality data reporting requirements and tied this to payment, which requires data sharing across entities (Meaningful Use).
Dependence on Health Centers to Cover the Safety Net
To provide services on a greater scale and connect with other providers, data sharing is critical.
Focus on Screening for SU in Primary Care for Prevention
Best practices for screening include detection of substance use disorders within the primary care setting (SBIRT) and primary care settings are the target for collecting this data.  

44. LifeLong’s MAT Services
Funding Source
HRSA Substance Abuse Expansion Grant, which pays for resources to develop the infrastructure, hiring of staff who are not billable under FQHC rules, and training for staff to provide these services.
Services and Model
Integration into already existing behavioral health and primary care services at LifeLong.
Harm reduction approach available to users within their primary care setting.
Buprenorphine, Naloxone and Naltrexone prescribing and counseling to patients with on-going case management by PCP and other clinic staff.
MAT Services Staff
Recovery Support Specialists (2), Care Coordinator, Program Manager, Provider Champions.
Referral of Patients
Review primary care data to identify patients who are using prescribed opiates, primary care provider or mental health specialist identifies a need through the course of general treatment, outreach to patients through one-on-one interactions with primary care provider or Program Coordinator (no general advertising).
DEA Certificates
Promoting LifeLong physicians with background and interest to become DEA certified to prescribe Buprenorphine.

45. How LifeLong Has Operationalized MAT Services
“An identified unit”
Focus and primary function of the clinic is primary care and MAT is wholly integrated within primary care services.
“Holds itself out”
MAT services are not separately advertised to patient nor the public.
Patients must be seen by a PCP first to receive services at the primary care clinic.
“Primary function of the provider”
Title of the staff to not connote that they provide treatment services.
The staff person has other roles and responsibilities besides MAT service support. Providers are primary care providers as their primary function.

46. Concluding Points
42 CFR Part 2 requirements don’t apply apply to FQHCs that do not have an identified unit that holds itself out as a treatment service and where the primary function of the provider is not to treat substance use disorders.
California privacy laws are similar to 42 CFR Part 2, however permit sharing records within the same Organization. The law is silent on whether records can be shared with outside specialists and there is no guidance as to whether or how this would be applied to FQHCs.

47. Thank you! & Questions?
Brenda Goldstein Director of Psychosocial Services Julia Weisner, JD, Esq Health Center Counsel and Compliance Director

48. Comments, Questions, and Discussion
Please ask your questions in the chat box.

49. Questions? Comments?
Contact HITEQ at: Please take our evaluation!!!
If you have any further questions or comments, please contact us.
And just a reminder that in a moment, an evaluation survey will pop up for you to fill out. Please fill this out as it helps us to plan effective webinars and other trainings.  

50. Thank you again for your participation. Good bye.
This project was supported by the Health Resources and Services Administration (HRSA) of the U.S. Department of Health and Human Services (HHS) under cooperative agreement numberU30CS29366, Training and Technical Assistance National Cooperative Agreement for $1,954,318 with 0% of the total NCA project financed with non-federal sources.  This information or content and conclusions are those of the author and should not be construed as the official position or policy of, nor should any endorsements be inferred by HRSA, HHS or the US Government.
Thank you again for your participation. Good bye.