Confidentiality of Substance Use Disorder Patient Records

Forms and Documents

Forms and supporting documents for this ICR

Document	Type	Status	Availability
12_2_2022_Part_2_ICR_Supporting_Statement.docx	Supporting Statement A	Uploaded 2022-12-02	Repair queued

IC Document Collections

Information collection document groups

IC ID	Collection	Type	Status	Form
256946	Reports to the Secretary		New
256945	Right to Request Restrictions		New
256944	Accounting of Disclosures of Part 2 Records		New
256942	Right to Discuss Patient Notice		New
256941	Less than 500 Affected Individuals (investigating and documenting breach) -- affecting <10		New
256940	Less than 500 Affected Individuals (investigating and documenting breach) -- affecting 10-499		New
256923	500 or More Affected Individuals (investigating and documenting breach)		New
256921	Notice to Secretary (notice for breaches affecting fewer than 500 individuals)		New
256920	Notice to Secretary (notice for breaches affecting 500 or more individuals)		New
256919	Media Notice - Breach		New
256918	Individual Notice-Substitute Notice (individuals' voluntary burden to call toll-free number for information)		New
256917	Individual Notice-Substitute Notice (staffing toll-free number)		New
256916	Individual Breach Notice-Substitute Notice (posting or publishing)		New
256915	Individual Breach Notice-Written and E-mail Notice (processing and sending)		New
256914	Individual Breach Notice-Written and E-mail Notice (preparing and documenting)		New
256913	Individual Breach Notice-Written and E-mail Notice (drafting)		New
256890	Disclosures for Audit & Evaluation - Paper		New
256889	Disclosures for Audit & Evaluation - Electronic		New
256888	Disclosures for Research - Paper		New
256887	Disclosures for Research - Electronic		New
256886	Documenting Emergency Treatment Disclosures		New
256885	PDMP Reporting		New
256884	Obtaining Consent for TPO		New
256883	Patient Notice - Providing to Patient		New
256881	Breach Notification - Training		New
256880	Training Program Development		New
256879	Notice to Accompany Disclosure - Updating		New
256878	Updating Consent Form		New
256877	Obtaining Consent - Training		New
256862	Requests for Restrictions - Training		New
256861	Accounting of Disclosures - Training		New
256860	Patient Notice - Updating		New
256859	Patient Notice and Right to Discuss - Training		New
256858	Complaint Procedures & Nonretaliation- Training		New

ICR Details

OMB Control No: 0945-0010	ICR Reference No: 202211-0945-002
Status: Historical Inactive	Previous ICR Reference No:
Agency/Subagency: HHS/OCR	Agency Tracking No:
Title: Confidentiality of Substance Use Disorder Patient Records
Type of Information Collection: New collection (Request for a new OMB Control Number)	Common Form ICR:  No
Type of Review Request: Regular
OIRA Conclusion Action: Comment filed on proposed rule	Conclusion Date: 01/05/2023
Retrieve Notice of Action (NOA)	Date Received in OIRA: 12/02/2022
Terms of Clearance: In accordance with 5 CFR 1320, the information collection is not approved at this time. Prior to publication of the final rule, the agency should provide to OMB a summary of all comments received on the proposed information collection and identify any changes made in response to these comments. In addition, OMB acknowledges that at the final rule stage the agency plans to request a revision to existing OMB control number 0930-0092 rather than seeking a new control number, as described in Supporting Statement A.

table that charts list comparision

	Inventory as of this Action	Requested	Previously Approved
Expiration Date		36 Months From Approved
Responses	0	0	0
Time Burden (Hours)	0	0	0
Cost Burden (Dollars)	0	0	0

---

Abstract: The Confidentiality of Substance Use Disorder Patient Records regulations (42 CFR part 2) implement section 543 of the Public Health Service Act, 42 United States Code (U.S.C.) § 290dd-2, as amended by section 131 of the Alcohol, Drug Abuse and Mental Health Administration Reorganization Act (ADAMHA Reorganization Act), Pub. L., 102-321 (July 10, 1992) and section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), Public Law 116-136 (March 27, 2020). The regulations serve to protect the confidentiality of patient records created by federally funded programs for the treatment of substance use disorder. The Department of Health and Human Services has proposed regulatory changes to implement the CARES Act.

---

Authorizing Statute(s): US Code: 42 USC 290dd-2 Name of Law: Confidentiality of Records
  

Citations for New Statutory Requirements: PL: Pub.L. 116 - 136 3221 Name of Law: Coronavirus Aid, Relief, and Economic Security (CARES) Act

---

Associated Rulemaking Information
RIN:	Stage of Rulemaking:	Federal Register Citation:	Date:
0945-AA16	Proposed rulemaking	87 FR 74216	12/02/2022

---

Federal Register Notices & Comments

Did the Agency receive public comments on this ICR? No

---

Number of Information Collection (IC) in this ICR: 34

table that charts list of burden

IC Title	Form No.	Form Name
500 or More Affected Individuals (investigating and documenting breach)
Accounting of Disclosures - Training
Accounting of Disclosures of Part 2 Records
Breach Notification - Training
Complaint Procedures & Nonretaliation- Training
Disclosures for Audit & Evaluation - Electronic
Disclosures for Audit & Evaluation - Paper
Disclosures for Research - Electronic
Disclosures for Research - Paper
Documenting Emergency Treatment Disclosures
Individual Breach Notice-Substitute Notice (posting or publishing)
Individual Breach Notice-Written and E-mail Notice (drafting)
Individual Breach Notice-Written and E-mail Notice (preparing and documenting)
Individual Breach Notice-Written and E-mail Notice (processing and sending)
Individual Notice-Substitute Notice (individuals' voluntary burden to call toll-free number for information)
Individual Notice-Substitute Notice (staffing toll-free number)
Less than 500 Affected Individuals (investigating and documenting breach) -- affecting 10-499
Less than 500 Affected Individuals (investigating and documenting breach) -- affecting <10
Media Notice - Breach
Notice to Accompany Disclosure - Updating
Notice to Secretary (notice for breaches affecting 500 or more individuals)
Notice to Secretary (notice for breaches affecting fewer than 500 individuals)
Obtaining Consent - Training
Obtaining Consent for TPO
PDMP Reporting
Patient Notice - Providing to Patient
Patient Notice - Updating
Patient Notice and Right to Discuss - Training
Reports to the Secretary
Requests for Restrictions - Training
Right to Discuss Patient Notice
Right to Request Restrictions
Training Program Development
Updating Consent Form

---

Burden increases because of Program Change due to Agency Discretion: Yes

Burden Increase Due to: Changing Regulations

Burden decreases because of Program Change due to Agency Discretion: Yes

Burden Reduction Due to: Changing Regulations

Short Statement: Burden reduction was achieved due to regulatory proposals required by statute that would reduce the number of written consents needed before disclosing and redisclosing patient records. Nonrecurring burdens increased due the need to update the consent form, patient confidentiality notice, and notice to accompany disclosures consistent with statutory changes--and train staff on new requirements. Recurring burdens increased due to new breach notification requirements imposed by statute. Total burdens increased due to updates to hourly wages and an increase in the estimated number of programs subject to the regulation.

---

Annual Cost to Federal Government: $1,794,543

Does this IC contain surveys, censuses, or employ statistical methods? No

Does this ICR request any personally identifiable information (see OMB Circular No. A-130 for an explanation of this term)? Please consult with your agency's privacy program when making this determination.     No

Does this ICR include a form that requires a Privacy Act Statement (see 5 U.S.C. §552a(e)(3))? Please consult with your agency's privacy program when making this determination.     No

Is this ICR related to the Affordable Care Act [Pub. L. 111-148 & 111-152]? No

Is this ICR related to the Dodd-Frank Wall Street Reform and Consumer Protection Act, [Pub. L. 111-203]? No

Is this ICR related to the American Recovery and Reinvestment Act of 2009 (ARRA)? No

Is this ICR related to the Pandemic Response? No

---

Common Form ICR:  No

---

On behalf of this Federal agency, I certify that the collection of information encompassed by this request complies with 5 CFR 1320.9 and the related provisions of 5 CFR 1320.8(b)(3).

The following is a summary of the topics, regarding the proposed collection of information, that the certification covers:

(a) It is necessary for the proper performance of agency functions;

(b) It avoids unnecessary duplication;

(c) It reduces burden on small entities;

(d) It uses plain, coherent, and unambiguous language that is understandable to respondents;

(e) Its implementation will be consistent and compatible with current reporting and recordkeeping practices;

(f) It indicates the retention periods for recordkeeping requirements;

(g) It informs respondents of the information called for under 5 CFR 1320.8 (b)(3) about:

(i) Why the information is being collected;

(ii) Use of information;

(iii) Burden estimate;

(iv) Nature of response (voluntary, required for a benefit, or mandatory);

(v) Nature and extent of confidentiality; and

(vi) Need to display currently valid OMB control number;

(h) It was developed by an office that has planned and allocated resources for the efficient and effective management and use of the information to be collected.

(i) It uses effective and efficient statistical survey methodology (if applicable); and

(j) It makes appropriate use of information technology.

If you are unable to certify compliance with any of these provisions, identify the item by leaving the box unchecked and explain the reason in the Supporting Statement.

Certification Date: 12/02/2022

---