Revisions to 42 CFR Patient Confidentiality Rules for Substance Use Disorder: What It Means for Health Services Researchers

In August 2019 the United States Substance Abuse and Mental Health Services Administration (SAMHSA) proposed a revision to the Federal rule that protects patient confidentiality for people with substance use disorders, referred to as 42 CFR Part 2. The sixty day comment period has ended and comments are currently under consideration. This proposal seeks to facilitate disclosure of substance use treatment records to providers, insurers, and researchers in order to improve care coordination between opioid treatment programs (OTPs) and other providers. OTPs are specialized programs that provide substance use diagnoses, treatment and referral to treatment. These include specialty treatment facilities that provide medications for opioid use disorder such as methadone.

The proposed revision clarifies what is considered a protected record to encourage record sharing in electronic medical record (EMR) systems, requires OTPs to enter dispensed medication into state prescription drug monitoring programs (PDMPs), and clarifies what information can be disclosed without additional patient consent to third parties such as insurers, government agencies, and researchers. In general, the proposed revisions would make data on substance use disorder diagnoses and treatment in EMR, PDMPs, and insurance claims datasets more available to researchers. Researchers would still be subject to existing rules protecting confidentiality of any human subjects research data.

The proposed revision aims to improve care coordination between OTPs and other providers by clarifying which records are subject to additional protections under 42 CFR Part 2 and how to best include that information in an EMR. If a patient provides consent, the OTP can disclose patient treatment records to another provider outside the OTP system in order to facilitate care coordination between the two health systems. This provider then becomes the “lawful holder” of the patient’s information. These protected records may be segmented into a separate EMR system, or the provider can transcribe the information into the EMR system. All subsequent treatment records are not subject to additional protection, thus facilitating documentation of substance use treatment in the EMR. This revision will facilitate information sharing across health systems and provide linked information regarding substance use treatment and subsequent health care utilization.

Integrating OTP records into EMR systems could provide health services researchers who gain access to these records with a greater understanding of healthcare service utilization and health outcomes among people with substance use disorder. Under the proposed revision, this information can then be re-disclosed by the lawful holder to third party payers for the purpose of payment or healthcare operations, thereby also making this data available through insurance claims databases.

Under the revised rule health services researchers will have access to more detailed information on methadone and buprenorphine prescribing by OTPs through PDMPs. PDMPs are statewide records of prescribed medication, and previously did not include medications for dispensed through OTPs in order to protect patient confidentiality. The requirement to enter patient medications for substance use disorder in the PDMPS is intended to minimize contraindicated prescribing and resulting adverse events. This change will allow health services researchers to get better information about methadone dispensing and health outcomes by linking PDMP data with other data sources. Some patient advocates are concerned that the change will have unintended consequences and discourage people with opioid use disorder from accessing OTP services; however, buprenorphine prescribed by waivered physicians outside of specialty OTPs is already included in PDMPs.

Finally, under the current rule patient information can be re-disclosed for research purposes without patient consent only if the researcher is part of a HIPAA covered entities and receives documented access authorization. This may limit data access for legitimate stakeholders, such as state or government agencies, that are not covered by HIPAA. The proposed rule allows research disclosures of OTP data from a HIPAA covered entity to researchers or organizations that are not covered by HIPAA provided there be safe guards in place for the patient confidentiality. This more closely aligns with analogous requirements for human subject research. The change would therefore facilitate data access for health services researchers in state or government agencies.

Integrating data from OTPs in EMRs, allowing greater re-disclosure to third-party payers, and including medications dispensed in OTPs in PDMPs will allow health services researchers and health economists to estimate the costs of substance use treatment, the potential increased treatment utilization, and improved healthcare outcomes. Requiring OTPs to disclose medications in the PDMPs will also provide researchers a better understanding of the utilization of MOUDs in the United States, which is likely underestimated in the current PDMPs. Expanding data access to researchers outside of HIPAA-covered entities, such as state government agencies, will provide them with access to more information for decision making. These changes will need to be implemented in ways that maintain patient confidentiality and address concerns that the data will be misused by providers and insurers to deny care or reinforce stigmatizing behaviors in the health care system.