1. Does 42 CFR Part 2 Apply to Me and Will it Continue to Be?
Renée Popovits, J.D.
Texas Council of Community Centers
April 30, 2015

2. Roadmap for Today Brief overview of Part 2 Decision Tree
Ways to Legally Share Part 2 Protected Information
Part 2 Evolution on the Horizon
Q&A
Words of Wisdom

3. Confidentiality Protections
Confidentiality specific to substance abuse treatment, diagnosis and referral
Enacted back in early 1970s
Federal laws: 42 U.S.C. 290dd-2 Federal regulations: C.F.R. Part 2

4. Why Stringent Protections for Addiction Treatment?
Premised on negative stigma historically associated with substance abuse
Assumed individuals would be more motivated to seek treatment if they were assured their treatment remained confidential

5. Patient Identifying Information
42 CFR Part 2
Name
Address
Social Security Number
Fingerprints
Photograph
Other similar info by which the identity of a patient can be determined with reasonable accuracy and speed either directly or by reference to other publicly available info
Does not include a number assigned to a patient by a program - different than HIPAA
HIPAA
Same: 42 CFR Part 2 PLUS
Address is defined more broadly
Names of relatives/household
Name of employer
Variety of dates
Telephone/fax number
address/URL/IP
Medical record number
Account/health plan number
Vehicle or other device serial number
Popovits & Robinson, P.C.

7. 7 STEP 1 IS THE CENTER “FEDERALLY ASSISTED”?
1. Is the Center conducted in whole or in part by any department or agency of the United States?
2. Is the Center being carried out under a license, certification, registration or other authorization granted by any department or agency of the United States, including Medicare certification, authorization to conduct methadone maintenance, or registration to dispense under the Controlled Substance Act if the substance is used to treat substance abuse?
3. Is the Center receiving Federal financial assistance in any form, including assistance from the State or a local government unit who in turn receives Federal funds that could be used for substance abuse treatment?
4. Is the Center allowed income tax deductions for contributions or granted tax exempt status by the IRS?

8. If YES to ANY of Questions 1-4
STEP 1 8
IS THE CENTER
“FEDERALLY ASSISTED”?
If YES to ANY of Questions 1-4
Proceed to STEP 2
If NO to ALL of Questions 1-4 Center is NOT a “Federally Assisted” program under 42 CFR Part 2 Proceed to STEP 3

9. STEP 2 9
DOES THE CENTER “HOLD ITSELF OUT” AS PROVIDING AND PROVIDE ALCOHOL AND SUBSTANCE ABUSE DIAGNOSIS, TREATMENT OR REFERRAL FOR TREATMENT (the “Services”)?
5. Is the provider licensed by the State to provide these Services?
10. Does the Center make statements on the internet about providing these Services?
6. Does the Center have a specific unit which these Services?
11. Does the Center have a specific contract with the Texas Department of State Health Services to provide these Services?
7. Are there personnel within the Center whose primary function is providing these Services and who are identified as such specialized personnel?
12. Does the Center provide Screening, Brief Intervention and Referral to Treatment “SBIRT” services? (If you are not federally assisted, Part 2 does not apply to SBIRT records)
8. Does the Center advertise or post notices about providing these Services?
13. Is the Center conducting any activities that would lead one to reasonably conclude that it is providing these Services?
9. Does the Provider hold certifications in addiction medicine and provide these Services?

10. STEP 2 10 If YES to ANY of Questions 5-13 Center MUST comply with
DOES THE CENTER “HOLD ITSELF OUT” AS PROVIDING AND PROVIDE ALCOHOL AND SUBSTANCE ABUSE DIAGNOSIS, TREATMENT OR REFERRAL FOR TREATMENT (the “Services”)?
If YES to ANY of Questions 5-13 Center MUST comply with
42 CFR Part 2
If NO to ALL of Questions 5-13, proceed to STEP 3

11. STATE REQUIREMENT ANALYSIS
STEP 3 11
STATE REQUIREMENT ANALYSIS
14. Does a State licensure law or regulation specifically require your Center to comply with Part 2 elements regardless of applicability under Federal definition?
15. Does a State confidentiality law or regulation specifically require your Center to comply with Part 2 elements regardless of applicability under Federal definition?
16. Does a State funding contract specifically require your Center to comply with Part 2 elements regardless of applicability under Federal definition?

12. STATE REQUIREMENT ANALYSIS
STEP 3 12
STATE REQUIREMENT ANALYSIS
If YES to ANY of Questions Center MUST comply with
42 CFR Part 2
If NO to ALL of Questions Center DOES NOT need to comply with 42 CFR Part 2

13. Ways to Legally Share Part 2 Protected Information
Patient Written Consent [2.31 and 2.35]
Medical Emergency [2.51]
Qualified Service Organization [2.12(c)(4)]
Audit and Evaluation [2.53]
Research [2.52]
Communications within a Program or Entity having Administrative Control [2.12(c)(3)]
Child Abuse Reporting [2.12(c)(6)]
Crime on Program Premises or Against Program Personnel [2.12(c)(5)]
Court Order [2.61 – 2.67]
Armed Services and VA Administration Exemption [2.12(c)(1)&(2)]
Not Identify the Individual as an Alcohol or Substance Abuser [2.12(a)(i)]

14. Patient Written Consent
HIPAA Authorization
Description of info to be disclosed
Name of person(s) to whom disclosure is made
Description of purpose of disclosure
Expiration date or event
Signature of individual and date
Description of authority to act if signed by personal rep.
Statement on right to revoke, exceptions to revocation and description of how to revoke or a reference to the Notice of Privacy Practices
Statement that treatment, payment, enrollment or eligibility for benefits may not be conditioned on the authorization or if permitted, a statement about the consequences for refusing to sign
Information is subject to redisclosure
42 CFR Part 2 Consent
Program or person making disclosure
Person /organization to whom disclosure is made
Name of patient
Purpose of disclosure
How much/what kind of info to be disclosed
Revocation provision
Date, event or condition of expiration
Signature
Date

15. Medical Emergency 42 CFR Part 2
Can disclose information to medical personnel to extent necessary for emergency
Narrowly construed - must be immediate threat to health and require immediate medical intervention
Must document certain elements in patient’s record
HIPAA
May use or disclose PHI in a medical emergency without authorization, provided the treatment agency furnishes the notice of privacy practices as soon is reasonably practicable after the emergency

16. Qualified Service Organization
42 CFR Part 2
QSOs
Must enter into QSO Agreement to allow sharing of information
Person/agency that provides services to program and will have access to confidential information
HIPAA
Business Associates
Must enter into Business Associate Agreement to allow sharing of information
Person/agency that provides services to program involving confidential information or HIPAA-related activity
Many requirements consult the rule

17. Audit and Evaluation Requires a written agreement
Different standard applied if records are copied or removed
Pertains to any federal, state or local governmental agency providing financial assistance or authorized to regulate the program
Applies to any private person providing financial assistance to the Program (3rd party payor) or quality improvement organization (performing utilization or quality control review)
Section on Medicare or Medicaid audit
Limitations on disclosure and use

18. Research
Patient identifying information may be disclosed for scientific research
Program director makes decision
Researcher is qualified
Has a research protocol to maintain the information in accordance with security requirements of 2.16 and will not be redisclosed except back to the program and not identify any individual patient in the report
Written statement required verifying IRB review

19. Communications within a Program or Entity having Administrative Control
Permits communication of information between or among personnel having a need for the information in connection with their duties
Duties must arise out of the provision of diagnosis, treatment or referral for treatment
Allowed within a program without consent
Allowed between a program and an entity that has direct administrative control without consent
Should apply minimum necessary standard

20. Revising Part 2 Regulations: What is your position on revising the regulations at 42 CFR Part 2?
I am in favor of revising 42 CFR Part 2 to ease consent requirements in order to facilitate the sharing of SUD information among providers 49.0%
I am in favor of revising 42 CFR Part 2 to make it more consistent with HIPAA 39.0%
I am in favor of revising 42 CFR Part 2 to expand the protections to cover SUD information collected by all medical providers 10.4%
I am against revising 42 CFR Part 2 1.5%
N=259
CiMH, National Council & ASAM 2014 Poll Results
August 13, 2013 Popovits/Vendome Webinar Poll Results
N=154

21. SAMHSA Listening Session
On June 11, 2014, SAMHSA held a public listening session to solicit input from stakeholders on updating 42 CFR Part 2.
Seven topics were addressed:
Applicability
Consent Requirements
Redisclosure
Medical Emergency
Qualified Service Organization (QSO)
Research
Electronic Prescribing and Prescription Drug Monitoring Programs (PDMPs)

22. 1. Applicability of 42 CFR Part 2
Difficulties encountered for identifying providers covered by Part 2
Whether Part 2 applies depends on whether the provider advertises their SUD services (holds themselves out)
Options for defining what information is covered
Definition based on substance abuse treatment services rather than type of facility providing the services
SBIRT and other pretreatment services would not be covered
Consider how redefining applicability impacts patients, healthcare providers, HIEs, CCOs, HIT vendors, and others

23. Applicability…On the Horizon
Limit applicability only to those facilities licensed to provided SUD Treatment
Brighter lines for patients understanding their protections
Changes will promote coordinated care among providers

24. 2. Consent Requirements
42 CFR 2.31 requires written consent to include name or title of individual or the name of the organization to which the disclosure is made (the To Whom Issue)
Cannot include future unnamed providers on consents
SAMHSA is examining consent requirements to facilitate information sharing within healthcare while ensuring the patient is fully informed and necessary protections obtained
Solicited comments on allowing general descriptions of individuals/organizations; Providing patient with list of providers; requiring the consent to explicit treatment information; disclosing specific providers of multiple units; evaluating impact on integration of data, HIEs, health homes, ACOs and CCOs

25. Consent…On the Horizon
Consent provisions will be expanded to permit “any provider involved in my care”
Harmonized with HIPAA elements
Information sharing with Health Homes, ACOs and CCEs will be permitted under certain conditions
Add patient safeguards such as audit trails, routine audits and mandatory exclusion from evidence

26. 3. Redisclosure
Numerous concerns on prohibition on redisclosure (2.32)
Most EHRs do not support data segmentation
Need to keep SUD information separate from rest of medical record or apply Part 2 protections to entire record
SAMHSA considering that prohibition on redisclosure would only apply to information that would identify a person as a substance abuser and allow other health related information shared by the Part 2 program to be redisclosed

27. Redisclosure…On the Horizon
BIGGEST CHALLENGE
Suggestions thus far won’t solve problem
Need better categorization of data and uniform reporting before you can achieve
Reexamine existing conflicting rules on redisclosure

28. 4. Medical Emergency
2.51 permits information to be disclosed without consent “For the purpose of treating a condition which poses an immediate threat to the health of any individual and requires immediate medical intervention”
Statute permits disclosures to medical personnel to the extent necessary to meet a bona fide medical emergency
SAMHSA seeking to relax standard consistent with statute and allow providers discretion when a bona fide emergency exists
This would enable sharing information with a detox center when a patient is too intoxicated to provide informed consent
SAMHSA sought factors to determine whether a medical emergency exists
SAMHSA also sought use cases and patient privacy concerns

29. Medical Emergency…On the Horizon
Consistency in definitional application
Witness broadened definitions
Still need revisions to who documents the emergency; with EHRs can’t preserve existing requirements

30. 5. Qualified Service Organization
Concerns raised from payers and health management organizations about disclosing information to ACOs and CCOs for care coordination, population health management and outreach for chronic conditions
SAMHSA considering expansion of definition of Qualified Service Organization (QSO) section 2.11 to:
Explicitly include care coordination services
Allow QSO Agreement between a payer or ACO and service provider
SAMHSA also sought other use cases and patient privacy concerns

31. QSO…On the Horizon Easiest way to share information without consent
Questionable if such expansion is supported by existing statute
Artificial solution because Coordination Services are provided to the patient not the program
Solution not transparent for patients

32. 6. Research
Program director may authorize disclosures for scientific research purposes
Absent consent organizations that store patient health data cannot disclose part 2 data to qualified researchers or research organizations
SAMHSA considering expansion to allow healthcare entities receiving and storing part 2 data including third party payers, HIEs and CCOs for purposes of research, audit or evaluation
SAMHSA solicited factors on how healthcare entities are organized, functioned and have duties to an umbrella organization
SAMHSA also sought use cases and patient privacy concerns

33. Research…On the Horizon
Key to understanding what is working
Whoever controls the data holds the power of and ability to change
Need to focus on use of research data rather than restrictions on who can receive

34. 7. Electronic Prescribing & PDMPs
Consent required for pharmacies that receive electronic prescriptions directly from a Part 2 program
Consent required for a Prescription Drug Monitoring Program (PDMP) to redisclose information to those with access to the PDMP
Pharmacy data systems cannot manage patient consent or segregate data subject to Part 2
Pharmacy systems lack ability to identify providers subject to Part 2 preventing data from reaching the PDMP
Some PDMPs are accessible by law enforcement and can lead to investigation, arrest or other forms of discrimination
SAMHSA solicited comments from pharmacy system vendors seeking concerns, technology barriers, use cases and patient privacy concerns

35. Electronic Prescribing & PDMPs…On the Horizon
Many productive benefits to PDMPs
Need to prohibit access to law enforcement
Need to address appropriate conditions and access to child welfare
Need to include parameters for treatment intervention and restrictions on use
Mandatory exclusions from evidence for inappropriate use

36. QUESTION
&
ANSWER

37. What Do You Know About 42 CFR Part 2?
“The evolution of Part 2 must contemplate not just a vision for integrated care but also address protections of patients rights”
-Renée Popovits
“Patients deserve the option and choice or deciding whether they want to share their substance use disorders information and health information exchanges”
-Renée Popovits

38. Achieving Integration Under the ACA
Costs higher when behavioral health remains untreated.
Solution:
Allow MH/SUD patients the right and choice to decide whether to share information, and
Facilitate the legal exchange of information needed to advance the quality of care.

39. Embrace Hope and Believe your Actions will make a Difference.
The Moment is Now for One World, One Health. Successful Collaboration and Comprehensive Wellness can be Achieved.
Embrace Hope and Believe your Actions will make a Difference.
Renée M. Popovits