Substance Use Disorder Patient Records Supporting Statement A_06102020

SUPPORTING STATEMENT FOR THE

CONFIDENTIALITY OF SUBSTANCE USE DISORDER PATIENT RECORDS

42 CFR PART 2

Background

The Confidentiality of Substance Use Disorder Patient Records regulations (42 CFR part 2) implement section 543 of the Public Health Service Act, 42 United States Code (U.S.C.) § 290dd-2, as amended by section 131 of the Alcohol, Drug Abuse and Mental Health Administration Reorganization Act (ADAMHA Reorganization Act), Pub. L., 102-321 (July 10, 1992). The regulations serve to protect the confidentiality of patient records created by federally funded programs for the treatment of substance use disorder (SUD). Under the regulations, a “substance use disorder” is a defined term, which refers to a cluster of cognitive, behavioral, and physiological symptoms indicating that an individual continues using a substance despite significant substance-related problems such as impaired control, social impairment, risky use, and pharmacological tolerance and withdrawal. For the purposes of part 2, this definition does not include tobacco or caffeine use.

The regulations were first promulgated as a final rule in 1975 (40 FR 27802) and amended thereafter in 1987 (52 FR 21796) and 1995 (60 FR 22296). On February 9, 2016, SAMHSA published a notice of proposed rulemaking (NPRM) (81 FR 6988), inviting comment on proposals to update the regulations, to reflect the development of integrated health care models and the growing use of electronic platforms to exchange patient information. At the same time, consistent with the statute, SAMHSA wished to preserve confidentiality protections it establishes for patient identifying information from covered programs because persons with SUDs may encounter significant discrimination or experience other negative consequences if their information is improperly disclosed.

In response to public comments, on January 18, 2017, SAMHSA published a final rule (82 FR 6052), providing for greater flexibility in disclosing patient identifying information within the health care system, while continuing to protect the confidentiality of SUD patient records. SAMHSA concurrently issued a supplemental notice of proposed rulemaking (SNPRM) (82 FR 5485) to solicit public comment on additional proposals. In response to public comments, SAMHSA subsequently published a final rule on January 3, 2018 (83 FR 239) that provided greater clarity regarding payment, health care operations, and audit or evaluation-related disclosures, and provided language for an abbreviated prohibition on re-disclosure notice.

In both the 2017 and 2018 final rules, SAMHSA signaled its intent to continue to monitor implementation of 42 CFR part 2, and to explore potential future rulemaking to better address the complexities of health information technology, patient privacy, and interoperability, within the constraints of the statute. The emergence of the opioid crisis, with its catastrophic impact on individuals, families, and caregivers, and corresponding clinical and safety challenges for providers, has highlighted the need for thoughtful updates to 42 CFR part 2. The laws and regulations governing the confidentiality of substance abuse records were originally written out of concern for the potential for misuse of those records against patients in treatment for a SUD, thereby undermining trust and leading individuals with SUDs not to seek treatment. As observed in the 1983 proposed rule, the purpose of 42 CFR part 2 is to ensure that patients receiving treatment for a SUD in a part 2 program “are not made more vulnerable to investigation or prosecution because of their association with a treatment program than they would be if they had not sought treatment” (48 FR 38763).

In recent years, the devastating consequences of the opioid epidemic have resulted in an unprecedented spike in overdose deaths related to both prescription and illegal opioids, as well as correspondingly greater pressures on the SUD treatment system, and heightened demand for SUD treatment services. Because of this, SAMHSA is finalizing changes to the regulation that SAMHSA believes will better align with the needs of individuals with SUD and of providers, and help facilitate the provision of well-coordinated care, while ensuring appropriate confidentiality protection for persons in treatment through part 2 programs.

A. JUSTIFICATION

1. Circumstances of Information Collection

This is a request for an extension of OMB approval (OMB No. 0930-0092) of the information collection requirements in the Final Rule (42 CFR Part 2), Confidentiality of Alcohol and Drug Abuse Patient Records, which expires on December 31, 2022. Federally conducted, regulated, or assisted SUD programs are required by statute to keep patient records confidential. There is a criminal penalty for violation of the statutes or implementing regulations requiring confidentiality: a fine of not more than $500 in the first offense and not more than $5,000 in the subsequent offense. The statutory authority for the confidentiality of substance use disorder patient records is 42 U.S.C. 290dd-2.

A notice of proposed rulemaking was published in the Federal Register on August 26, 2019 (84 FR 44568). Because the final rule was not published prior to the expiration of the previously approved PRA package on December 21, 2019, interim approval was sought and received due to the critical importance of the information collections. This PRA package is intended to replace the currently approved package.

The information collection requirements in 42 CFR Part 2 for which OMB approval is requested are:

42 CFR Part 2 - Section 2.22 - Disclosure

Requires each program to make public disclosure in the form of communication to each patient that Federal laws and regulations protect the confidentiality of each patient and includes a written summary of the effect of these laws and regulations. We did not finalize any changes to this section as part of the 2020 final rule.

42 CFR Part 2 – Section 2.31 – Consent Requirements

This provision explains the requirements for consent associated with disclosure of patient records. The 2020 final rule finalizes that patients may consent to disclosures of part 2 information to entities without a treating provider relationship without naming the specific individual receiving this information on behalf of a given entity.

42 CFR Part 2 – Section 2.36 – Disclosure to Prescription Drug Monitoring Programs (PDMPs)

The 2020 final rule finalizes adding a new section 2.36 permitting part 2 programs, including Opioid Treatment Program (OTPs), and other lawful holders to report any data for controlled substances dispensed or prescribed to patients, as required by states currently for other prescribed, controlled substances to their respective state PDMPs. The 2020 final rule is also finalizing a requirement for Part 2 providers to obtain written consent from the patient whose identifying information will be disclosed prior to making such reports.

42 CFR Part 2 – Section 2.51 – Medical Emergencies

This provision requires the program to document a disclosure of a patient record to authorized medical personnel in a medical emergency. Provisions being finalized in the 2020 final rule will allow disclosure of a patient record during natural and major disasters. The regulation is silent on retention period for keeping these records as this will vary according to State laws. It is expected that these records will be kept as part of the patients' medical records.

42 CFR Part 2 – Section 2.52 – Research

Currently, this provision permits part 2 programs and lawful holders to disclose patient identifying information for research, without patient consent, if the recipient of the patient identifying information is a Health Insurance Portability and Accountability Act (HIPAA)-covered entity or business associate, and has obtained and documented authorization from the patient, or a waiver or alteration of authorization, consistent with the HIPAA Privacy Rule at 45 CFR 164.508 or 164.512(i) or the recipient is subject to the HHS regulations regarding the protection of human subjects under the Common Rule (45 CFR part 46). The 2020 final rule finalizes to allow disclosures of part 2 data for research purposes from a HIPAA covered entity or business associate to individuals and organizations who are neither HIPAA covered entities, nor subject to the Common Rule, provided that any such data will be disclosed in accordance with the HIPAA Privacy Rule at 45 CFR 164.512(i). Additionally, SAMHSA is finalizing to permit research disclosures to recipients who are covered by FDA regulations for the protection of human subjects in clinical investigations (at 21 CFR Part 50), subject to appropriate documentation of compliance with FDA regulatory requirements, and pursuant to authority under the Food, Drugs and Cosmetics Act.

42 CFR Part 2 – Section 2.53 – Audit and Evaluation

This provision describes the circumstances under which specified individuals and entities may access patient identifying information in the course of an audit or evaluation. The 2020 final rule clarifies that government agencies and third-party payer entities will be permitted to obtain part 2 records without written patient consent to conduct audits or evaluations aimed at improving care and outcomes for part 2 patients (e.g., provider education, recommending or requiring improved health care approaches); target limited resources more effectively; and/or to determine the need for adjustments to payment policies for the care of patients with SUD. SAMHSA is also finalizing language to clarify that (1) audits and evaluations may include reviews of appropriateness of medical care, medical necessity, and utilization of services; (2) part 2 programs may disclose information, without consent, to non-part 2 entities that have direct administrative control over such part 2 programs; and (3) entities conducting audits or evaluations in accordance with §§ 2.53(a) and (b) may include accreditation or similar types of organizations focused on quality assurance. Further, SAMHSA is finalizing to permit patient identifying information to be disclosed to government agencies in the course of conducting audits or evaluations mandated by statute or regulation, if those audits or evaluations cannot be carried out using de-identified information.

2. Purpose and Use of Information

The information disclosed to patients pursuant to the public disclosure requirement in 42 CFR 2.22 will be used by the patient to understand permitted uses that may be made of his or her treatment records. Notice to each patient at the outset that the program must maintain the confidentiality of patient records will provide an incentive for the patient to be frank and open in the therapeutic relationship. Such information will also serve to notify each patient of the limitations of the confidentiality protection, e.g., no confidentiality protections are extended to criminal behavior (or threats thereof) on program premises or against program personnel, nor to information about suspected child abuse or neglect that must be reported under State law to appropriate State or local authorities. Awareness of the existence of the Federal confidentiality regulations/standards by program staff and patients will encourage diligence in program compliance and may deter certain behavior by patients.

The ability for patients to consent to disclosure of patient records to organizations without a treating provider relationship under 42 CFR 2.31 will provide patients the needed flexibility to disclose protected information for reasons including eligibility determinations and seeking non-medical services or benefits from governmental and non-governmental entities (e.g., social security benefits, local sober living or halfway house programs).

The disclosure of dispensing data for controlled substances to state PDMPs under proposed 42 CFR 2.36 will allow for greater patient safety, better patient treatment, and better care coordination among the patient’s providers. This disclosure will further enhance PDMPs as a tool to help prevent prescription drug misuse and opioid overdose, while providing more complete and accurate data.

Information documenting the "medical personnel" status of the recipient of a disclosure under 42 CFR 2.51 will be used by the program as a record that only medical personnel, i.e., only persons able to alleviate the medical emergency, were furnished patient identifying information in accordance with the statutes.

Patient data and information disclosed under 42 CFR 2.52 will be used to advance and scientific and public health research, which are both critical in light of the national opioid epidemic.

Under 42 CFR 2.53, information may be disclosed to better serve and protect patients with an SUD for purposes such as identifying specific types of challenges faced by patients receiving opioid therapy treatment, such as co-occurring medical or psychiatric conditions, or social and economic factors that impede treatment or recovery; to recommend or mandate improved medical care approaches; target limited resources more effectively to care for patients; or to adjust specific Medicaid or other program policies or processes related to payment or coverage to facilitate adequate coverage and payment. Government agencies may also wish to know how many patients test positive for a new and harmful illicit drug, and how part 2 programs are actually treating those patients, as an input to agency decisions aimed at improving quality of care. Government agencies may also wish to modify requirements for part 2 programs, educate or provide additional oversight of part 2 providers, and/or update corresponding payment or coverage policies.

The Federal role in this activity is to ensure that substance use disorder patient records are kept confidential in accordance with Federal statutes and regulations.

3. Use of Information Technology

The information collected and retained by a program is the minimum amount necessary to comply with the statutory requirements. There are no technical or legal obstacles to reducing burden. It is not clear that use of information technology would be appropriate for these requirements, but nothing precludes use of information technology that may be available to individual treatment facilities or programs.

4. Effort to Identify Duplication

State law, professional and ethical standards, and the policies of a program or medical care facility may impose standards for maintaining confidentiality of all medical records, in addition to standards imposed for substance use disorder patient records by subject Federal law and regulations. Those same entities may impose public disclosure requirements. On the basis of professional knowledge and public comment received on publications of the regulation, SAMHSA staff are not aware of any other laws, standards, or policies that require documentation of the "medical personnel" status of persons to whom a disclosure is made to meet a medical emergency as set out in 42 CFR 2.51 or notice to the patient of the effect and limits of the Federal confidentiality requirements as set in other provisions of 42 CFR part 2. The events about which these provisions require disclosure and recordkeeping are unique, and no similar information exists outside those events.

5. Involvement of Small Entities

The regulations require a minimum of information for all affected facilities, many of which are small entities and therefore, there is no significant impact involving small entities. As discussed in section A.12, we estimate a total burden associated with all information collections of 580,441 hours and $26,145,027 across all 13,585 part 2 programs for 1,658,732 total patient admissions. On average, this equates to an annual burden of 42.73 hours and $1,925 for each part 2 program and 0.35 hours and $15.76 per patient admission.

6. Consequences If Information Collected Less Frequently

A discussion of less frequent information collection is not applicable to the provisions under 42 CFR 2.22, 2.31, 2.51, 2.52, and 2.53 as these disclosures are generated on an ''as needed" basis. The public disclosure requirement that each patient be notified of the effect and limits of the Federal confidentiality laws and regulations in 42 CFR 2.22 are imposed for each patient admission; less frequent disclosure would not provide each patient with notice. Additionally, less frequent disclosure of patient information than what would be authorized under the provisions of 42 CFR 2.31, 2.51, 2.52, and 2.53 would be contrary to the stated goals of the proposed rule by reducing the ability of patients to receive medical care during emergencies or receive benefits from entities without a treating provider relationship, and negatively impacting individuals and organizations with legitimate research, audit, and evaluation purposes. Finally, reporting of dispensing data to PDMPs on a less-than-quarterly basis would decrease the effectiveness of PDMPs to monitor the use of prescribed, controlled substances.

7. Consistency with the Guidelines in 5 CFR 1320.5(d) (2)

This information collection fully complies with 5 CFR 1320.5(d)(2).

8. Consultation Outside the Agency

The 2019 proposed rule served as the 60-day Federal Register notice required by 5 CFR 1320.8(d), and was published on August 26, 2019. Comments were received. A summary of the comments and our responses is attached to this PRA package.

SAMHSA has received feedback from stakeholders regarding whether certain types of disclosure are permitted by the regulation. Other stakeholders have expressed their concern that part 2 programs are inconsistent with their interpretations of the regulation, indicating a need for further clarity. A number of the provisions finalized in the 2020 final rule have been influenced by the need to reduce confusion and increase consistency across all stakeholders who either disclose or are lawfully permitted access to patient records.

In April 2013, 3 substance abuse treatment providers were consulted about the amount of time required to comply with these information collection requirements and about the typical salaries of the staff who handle each activity. Listed below are the 3 substance abuse treatment providers who were consulted. Information on these topics in item A.12 reflects these discussions.

Ms. Peg Wright (Project Director) and Ms. Heather Rhodes (Program Manager)

The Center for Great Expectations

New Brunswick, NJ

(732) 993-9762

Community Counseling Center of Southern Nevada

Ronald Lawrence, MFT, LADC, Executive Director

Community Counseling Center

714 E. Sahara Avenue

Las Vegas, NV 89104

(702) 369-8700 x227

Mount Vernon Hospital

Mr. Henry Jones (Program Administrator) and Mr. Gerald Miller (Team Leader)

12 North Seventh Ave.

Mount Vernon, NY 10550

(914) 361-6102

 

9. Payment to Respondents

No payments are made to respondents for compliance with this regulation.

10. Assurance of Confidentiality

No assurance of confidentiality is provided to those parties required to document "medical personnel" status; give notice to each patient (federally conducted, regulated, or assisted SUD programs); or disclose patient records and information to PDMPs, lawful research entities, or entities conducting lawful audits and evaluations. They are the parties upon whom the Federal statutes and regulations impose confidentiality standards for the benefit of patients.

11. Questions of a Sensitive Nature

The public disclosure requirement in 42 CFR 2.22 provides notice to each patient rather than soliciting information. The nature of the records generated in compliance with the provisions of 42 CFR part 2 will not include sensitive material except insofar as the records generated become a part of a SUD patient's record; i.e., except insofar as the documentation of "medical personnel" status is connected with an identified individual's treatment for a SUD.

Many of the treatment providers are covered also under the Privacy Rule of HIPAA. The Privacy Rule applies to “covered entities” which are health plans, health care clearinghouses and health care providers who transmit health information in electronic form. The Privacy Rule permits uses and disclosures of protected health information (without patient authorization) to carry out treatment, payment and health care operations. HIPAA permits the exchange of information among providers for the purpose of treatment. Treating medical emergencies would fall under these permitted uses and disclosures. In this case, an authorization form would not be required.

Attachment A was developed by SAMHSA in consultation with the HHS Office of General Counsel, Office for Civil Rights and other offices and agencies within HHS, as guidance for treatment providers about the applicability of the Confidentiality Regulations and the HIPAA Privacy Rule. It explains which programs must also comply with the Privacy Rule and outlines what compliance will require. Attachments B and C were developed by SAMHSA and the Office of the National Coordinator for Health Information Technology (ONC) to help health care providers determine how Part 2 applies to them and to demonstrate how Part 2 applies to the electronic exchange of health care records by depicting scenarios they might encounter when caring for patients or exchanging health information.

Part 2 protects any and all information that could reasonably be used to identify and individual and requires that disclosures be limited to the information necessary to carry out the purpose of the disclosure. Under the Privacy Rule, a program may not use or disclose “protected health Information” (PHI) except as permitted or required by the Rule.

12. Estimates of Annualized Hour Burden

The annual burden for the information requirements in this subpart is summarized in the table that follows:

TABLE 1: Annualized Burden Estimates

	Annual No. Respondents (Substance Use Disorder Programs)	Responses per Respondent	Total Responses (No. of Tx Admissions)	Hours per Response	Total Hour Burden	Hourly Wage Cost	Total Hour Cost
Disclosure
42 CFR 2.22	13,585	122.1	1,658,732	.20	331,746	$48.02	$15,930,462
42 CFR 2.31, 2.52, and 2.53	13,585	1.83	24,881	4	99,524	$44.80	$4,458,675
42 CFR 2.31, 2.52, and 2.53	13,585	16.48	223,929	.25	55,982	$44.80	$2,508,005
Recordkeeping
42 CFR 2.36	13,585	195.8	2,659,825	0.033	88,661	$48.02	$4,257,491
42 CFR 2.51	13,585	2	27,170	.167	4,528	$44.80	$202,869
TOTAL	13,585	-	4,594,537	-	580,441	-	$27,357,502

As shown in Table 1, for 42 CFR 2.22 and 2.51, we are adjusting our currently approved burden estimates to reflect the use of updated data for the number of respondents and responses; our estimates of burden per response remain unchanged. We have not included discussion of these information collections in the 2020 final rule as we are not finalizing any changes to burden due to changes in policy, but instead are making adjustments due to availability of updated data. The respondents for this collection of information are publicly (Federal, State, or local) funded, assisted, or regulated alcohol and drug treatment programs. The estimate of the number of such programs (respondents) is based on the results of the 2017 National Survey of Substance Abuse Treatment Services (N-SSATS), and the average number of annual total responses is based the results of the average number of substance abuse treatment admissions from SAMHSA’s 2014–2016 Treatment Episode Data Set (TEDS) as the number of patients treated annually by part 2 programs, both approved under OMB No. 0930-0335. Conversations with treatment provider representatives indicated a wide range in the amount of time spent on confidentiality disclosure which typically occurs during intake assessment. The amount of time for disclosure to a patient ranged from a low of 3-5 minutes to a high of almost 38 minutes; the approximately 12 minute estimate used to estimate burden above reflects a judgment about the time needed to adequately comply with the legal requirements and for basic training of counselors on the importance of patient confidentiality. For 42 CFR 2.51, the time estimate for recordkeeping for a clerk to locate a patient record, record the necessary information and re-file the record is 10 minutes. Providers consulted consider these confidentiality provisions essential to getting patients into treatment and report that they do not consider them to be burdensome.

For 42 CFR 2.31, 2.52, and 2.53, the number of respondents is the same as under section 2.22. SAMHSA then estimated that part 2 programs would need to disclose average of 15 percent of these records (248,810) as a result of the provisions in the 2020 final rule. We then estimated that 10 percent or 24,881 (248,810 x 10%) of impacted records would be held by part 2 programs who will use paper records to comply with these requests for disclosure reports while the remaining 90 percent or 223,929 (248,810 x 90%) will use a health IT system. For part 2 programs using paper records, SAMHSA expects that a staff member will need to gather and aggregate the information from paper records, and manually track disclosures; for those part 2 programs with a health IT system, we expect records and tracking information will be available within the system.

For 42 CFR 2.36, we used the average number of opiate treatment admissions from SAMHSA’s 2014–2016 TEDS (531,965) and assumed the PDMP databases will need to be accessed and reported once initially and quarterly thereafter for each patient. Averaging the number of admissions by the number of SUD programs, this equals 39.16 patients per program (531,965 patients ÷ 13,585 programs) and 195.8 PDMP updates per respondent (39.16 patients/program x 5 PDMP updates per patient). Based on discussions with providers, SAMHSA believes accessing and reporting to PDMP databases will take approximately 2 minutes per patient, resulting in a total annual burden of 8 minutes (4 database accesses/updates x 2 minutes per access/update) or 0.133 hours annually per patient.

The wage rates are based on 2019 information from the U.S. Bureau of Labor Statistics, www.bls.gov, (May 2019 National Occupational Employment and Wage Estimates, United States) for “Substance Abuse, Behavioral Disorder, and Mental Health Counselors”¹ and for “Medical Dosimetrists, Medical Records Specialists, and Health Technologists and Technicians, All Other”² occupations. We have used the mean rates and multiplied them by a factor of 2 to account for benefits and overhead costs.

13. Estimates of Annualized Cost Burden to Respondents

We estimate that there may be additional costs related to updating consent forms as a result of the provisions being finalized in 42 CFR parts 2.31 and 2.36. These provisions may result in providers needing to update their standard consent forms to allow for certain disclosures. As stated in the 2016 proposed rule (81 FR 7009 through 7010), based on a 2008 study from the Mayo Clinic Health Care Systems, the reported cost to update authorization forms was $0.10 per patient. Adjusted for inflation, costs associated with updating the patient consent forms in 2019 would be $0.12 per patient. Using the average number of substance abuse treatment admissions from SAMHSA’s 2014–2016 TEDS (1,658,732) as an estimate of the number of clients treated on an annual basis by part 2 programs, the total cost burden associated with updating the consent forms to reflect the updated 42 CFR part 2 regulations is estimated to be a one-time cost of $199,048 (1,658,732 x $0.12).

Further, the finalized provision to amend § 2.31 is likely to result in a decrease in the number of consents to disclosures that patients must make, due to the ability to consent to entities without naming a specific individual. Because of a lack of data regarding the number of consents patients have made to multiple individuals within the same entity which will become duplicative as a result of the finalized amendment, we are unable to quantify the reduction in burden related to the expected reduction in the number of required consents.

Finally, the costs to treatment providers associated with these regulations to duplicate disclosure statements as a result of section 2.22 is: 1,658,732 pages at $.05 each = $82,937. These costs may vary depending on the extent to which part 2 programs utilize electronic forms to record patient consent.

14. Estimates of Annualized Cost to Government

Staff for technical assistance and inquiries totals $33,205:

Office of General Counsel -1 GS-14 Step 5 x 5% time = $ 6,875 ($137,491 x 0.05)

SAMHSA -1 GS-14 Step 5 x 20% time = $27,498 ($137,491 x 0.20)

NOTE: This estimated annualized cost is for implementing the regulations in their entirety, not just for the information collection requirements.

15. Changes in Burden

Currently, there are 349,056 burden hours in the OMB inventory. The Program is requesting 580,441 hours. This adjustment of 231,385 hours is due to the estimated increase in the number of disclosures made by part 2 programs as result of the provisions in the 2020 final rule, offset slightly by a decrease in the number of patient admissions to treatment.

We also note that the previously approved burden costs were calculated using labor rates that were not adjusted for benefits and overhead costs. The labor rates shown in Table 1 incorporate this adjustment.

16. Time Schedule, Publication and Analysis Plans

The information collections in this regulation are not used for statistical purposes nor are they published.

17. Display of Expiration Date

There are no forms associated with these regulations.

18. Exceptions to Certification Statement

The certification is included in this submission.

B. STATISTICAL METHODS

This collection of information does not employ statistical methodology.

ATTACHMENT

A. The Confidentiality of Alcohol and Drug Abuse Patient Records Regulation and the HIPAA Privacy Rule: Implications for Alcohol and Substance Abuse Programs

B. Disclosure of Substance Use Disorder Patient Records: Does Part 2 Apply to Me?

C. Disclosure of Substance Use Disorder Patient Records: How Do I Exchange Part 2 Data?

1 https://www.bls.gov/oes/current/oes211018.htm

2 https://www.bls.gov/oes/current/oes292098.htm

10