42 CFR Part 2 was enacted to protect the patient. Not the behavioral health provider. Not the primary care provider. 

Not the state Health Information Exchanges. It is about the patient.Specifically it says: 

§2.3 Purpose and effect.

(b)(2) "These regulations are not intended to direct the manner in which substantive functions such as research, 

treatment, and evaluation are carried out. They are intended to insure that an alcohol or drug abuse patient in a 

federally assisted alcohol or drug abuse program is not made more vulnerable by reason of the availability of his or 

her patient record than an individual who has an alcohol or drug problem and who does not seek treatment.

There is no addiction treatment paradigm, no best practice and certainly no evidence-based practice that indicate 

patient outcomes improve when the patient does not fully disclose the nature of their addiction. In fact, every single 

treatment paradigm is targeted to breaking through patient denial about their addiction by helping them to fully 

disclose these details and recognize its impact on their lives. 

As a former state and nationally certified addiction treatment provider, I would not have been able to encourage this 

disclosure knowing the therapeutic value was so significantly diminished by making them so vulnerable. I doubt this 

would be a problem, though, because who would seek treatment if it means that they are making themselves 

vulnerable by doing so?

With this in mind please consider the following remarks and recommendations:

1) 42 CFR Part 2 is no longer an obstacle in the electronic exchange of patient health information. 

With the development of the HL7 data standard Data Segmentation For Privacy (DS4P) and the successful pilot of 

the Consent2Share (C2S) technology standard by SAMHSA and the VA, and finally the approval of these standards 

by the Chief Privacy Officer at the Office of the National Coordinator for Health Information Technology, there is no 

longer a reason to cite Part 2 as an obstacle to sharing patient health information in health information exchange. 

These data and technology standards support full adherence to the statute by any certified EHR and the provider 

using it. Therefore, discussion of 42 CFR Part 2 as an obstacle to the effectiveness, efficiency and quality of patient 

health care should be abandoned. It is, in fact, no longer a relevant concern. 

Recommendation: Energy should be directed to ensuring that these data and technology standards are fully adopted 

and applied in ALL certified EHR solutions, as rapidly as is possible, and that providers fully understand what they 

mean and how they are applied.

2) There are significant shortcomings in the statute itself that it is time to address. 

a) The patient's right to confidentiality should be at least as enforceable as the rights afforded by HIPAA. Instead, the 

current system for ensuring enforcement is not viable or even credible. 

42 CFR Part 2 is enforced by criminal law, not civil law. The patient whose rights have been violated has no recourse 

in civil court if there is no decision to bring criminal charges against the perpetrator. As Dr. Westley Clarke, Director 

for CSAT has noted many times, there is no record of any criminal charges ever brought against any individual or 

organization for violating this federal statute since it was put into place in 1975 (Drug Abuse Prevention, Treatment, 

and Rehabilitation Act (21 U.S.C. 1175)) . 

Of course this does not mean all providers everywhere are incredibly vigilant in adhering to this statute. It means that 

in the past 40 years it has never once been enforced. A statute that is not enforced has no meaning to those who are 

not concerned about violating it. 

Recommendation: Make the statute as enforceable as HIPAA.

b) The financial penalties for violation are insignificant. 

Financial penalties for violation are negligible ($500 - $5000). With the advent of EHRs and certification criteria, 

HIPAA violation penalties were greatly increased. 42 CFR Part 2 violations were not addressed. What exactly is the 

disincentive to violate 42 CFR Part 2 when there is no recourse for the patient in civil court, and no significant 

consequences to the provider? 
Recommendation: Create some actual consequences to violating patient confidentiality, at least as great as those for 

violating HIPAA.

c) Organizations that in fact meet the criteria for 42 CFR Part 2 consider themselves exempt from 42 CFR Part 2.

Despite the attempt to clarify this in the SAMHSA FAQs (A10)- primary care providers who in fact meet this criteria 

continue to claim exemption, and their advocacy group representatives continue to argue against the applicability of 

42 CFR Part 2 in their situation.

This situation persists because adherence to 42 CFR Part 2 is incorrectly perceived as cumbersome and also 

because there is no viable enforcement structure. No penalities, no criminal charges, and a patient who is powerless 

to respond to the breach. 

Recommendation 1: Develop an online training series that offers not just an explanation, but also use case scenarios 

via animation to educate call providers in their responsibilities re: this information. The SAMHSA FAQs are helpful but 

they are also quite dense and do not offer any actual practice scenarios. 

Recommendation 2: Remove all doubt. Vest this information with the protections afforded by 42 CFR Part 2 

regardless of the information origin and whether or not the provider is a "treatment provider." 

Thanks in advance for your attention to this. 

Colleen O'Donnell

3245 Rio Drive #906

Falls Church VA 22041

703-931-8811
 

 

 

 

 

 

 

 

 

 

 

I am the medical director of an addiction treatment program (both inpt and outpt) situated in multiple 

hospital system which has recently become an ACO. We use the EPIC medical record system and have 

data sharing in place with a multi state system. 

Our addiction treatment includes hospital based care of severely ill hospitalized patients, medications it 

the outpt setting as well as care for pregnant women with addiction problems through the course of their 

pregnancy and delivery. Providing this care outside of the electronic medical record would be extremely 

unsafe. 

It is essential that SAMHSA act to ensure that safe care can be provided for these complex patients in a 

way that meets all regulatory requirements. 

Jim Walsh, MD 

Medical Director 

Addiction Recovery Service 

Swedish Medical Center 

Seattle, Washington 

jim.walsh@swedish.org 

pager 206 540-6573 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Dear SAMHSA: 

I write as a long-time researcher and observer of formal organizations that provide alcohol and drug 

abuse treatment, and an addiction medicine and primary care physician who treats many patients with 

alcohol and drug use disorders. Exceptionalism around alcohol- and drug-, not to mention HIV-, related 

health information served its purpose in the past, but I applaud SAMHSA for reconsidering this 

antiquated set of regulations. These regulations were developed before the advent of the Health 

Insurance Portability and Accountability Act of 1996 (HIPAA), which now ensures confidentiality and 

privacy for all protected health information (PHI). The additional bureaucratic burdens of 42 CFR Part 2 

for the records of patients with alcohol or drug use disorders exacerbates the problems of stigma, 

inadequate access to care and poor coordination and quality of care that these patients face in the 

mainstream health care system. As the rest of the health care system moves towards unified electronic 

health records (EHRs) and integrated systems (e.g. Accountable Care Organizations [ACOs] and PatientCentered Medical Homes [PCMHs]) that provide incentives for population management and care 

coordination, the creation of firewalls within EHRs to comply with 42 CFR Part2 will institutionalize the 

marginalization of patients with alcohol and drug problems. Now is the time for SAMHSA to 

acknowledge fully and publically that alcohol and drug use disorders and the programs that treat these 

disorders should be a full and equal responsibility of the mainstream health care system, and that these 

patients and their disorders should be treated in the same manner as other patients and their 

disorders. I strongly advocate that SAMHSA seek repeal of 42 CFR Part 2 and make the health records of 

patients with alcohol and drug use disorders subject to the same requirements as other PHI under 

HIPAA. Such deregulation would be widely applauded as reducing unnecessary administrative waste. It 

would also advance true parity in the management of alcohol and drug use disorders, which was 

Congress’s intent in adopting the Mental Health Parity and Addiction Equity Act of 2008. 

Best Regards, 

Peter D. Friedmann, MD, MPH, FASAM, FACP 

Professor of Medicine, and Health Services, Policy & Practice 

Alpert Medical School and School of Public Health, Brown University 

Director, Research Section, Division of 

General Internal Medicine 

Rhode Island Hospital -- Plain St. Bldg. Rm. 123 

593 Eddy St. Providence, RI 02903 

Tele: 401-444-3347 Fax: 401-444-5040 

Cell :401-465-9144 

Director, Center of Innovation in Long-Term 

Services and Supports, 

A COIN of the VA HSR&D Service 

Providence Veteran Affairs Medical Center 

830 Chalkstone Ave, Building 32 

Providence, RI 02908 

Tele: 401-273-7100 x6240 Fax: 401-457-3311 
 

 

 

 

 

Hello, 

Regarding section b below- does the actual person who performs a records audit on behalf of an oversight 

organization have to be the person who physically copies and removes the records from the D&A agency, or 

can the oversight organization request that the D&A agency copy and send the records to the oversight 

agency? 

The situation: As the single state agency (ssa) overseeing monitoring of the SAPT block grant, a sample of 

drug and alcohol treatment invoices from a treatment provider are compared to the client case notes and 

records of service from the client file at the treatment provider to validate payment. 

The client case notes and records of service are identified via a unique client number. All client names and 

other identifying information is redacted. An audit and evaluation form is signed by ssa staff, which states that 

42 CFR will be adhered to. 

Does the actual ssa staff person have to copy and remove the requested records from the facility, or can the 

requested records be copied and removed from the facility by facility staff, and be delivered to the ssa staff. 

Thank you 

§ 2.53Audit and evaluation activities.

(a)Records not copied or removed. If patient records are not copied or removed, patient identifying

information may be disclosed in the course of a review of records on program premises to any person who

agrees in writing to comply with the limitations on redisclosure and use in paragraph (d) of this section and

who:

(1) Performs the audit or evaluation activity on behalf of:

(i) Any Federal, State, or local governmental agency which provides financial assistance to the program or is

authorized by law to regulate its activities; or

(ii) Any private person which provides financial assistance to the program, which is a third party payer

covering patients in the program, or which is a quality improvement organization performing a utilization or

quality control review; or

(2) Is determined by the program director to be qualified to conduct the audit or evaluation activities.

(b)Copying or removal of records. Records containing patient identifying information may be copied or

removed from program premises by any person who:

(1) Agrees in writing to:

(i) Maintain the patient identifying information in accordance with the security requirements provided in §

2.16 of these regulations (or more stringent requirements);

(ii) Destroy all the patient identifying information upon completion of the audit or evaluation; and

(iii) Comply with the limitations on disclosure and use in paragraph (d) of this section; and

(2) Performs the audit or evaluation activity on behalf of:

(i) Any Federal, State, or local governmental agency which provides financial assistance to the program or is

authorized by law to regulate its activities; or

(ii) Any private person which provides financial assistance to the program, which is a third part payer coverin g

patients in the program, or which is a quality improvement organization performing a utilization or quality

control review.

Stefanie Mihalcik | Drug & Alcohol Program Representative 

Pennsylvania Department of Drug & Alcohol Programs 
 

 

 

Bureau of Quality Assurance for Prevention and Treatment 

02 Kline Village| Harrisburg PA 17104 

Direct Phone: 717-736-7465 

Phone: 717.783.8200 | Fax: 717.787.6285 

www.ddap.pa.gov 
 

 

 

 

 

As a nurse practitioner working in a methadone clinic, I believe there should be some way to show 

providers that our clients are in MMT on the prescription monitoring program. Suboxone shows on the 

PMP, even when it is given from our clinic physician. I have found 5 clients being prescribed methadone 

by providers while coming to the methadone clinic where I am employed. I am sure they were diverting. 

Their urines were showing that they only had methadone and if I hadn't done the prescription 

monitoring program (PMP)they never would have been caught. 

Please consider this. 

Susan Gurney FNP, PMHNP 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Roxanne Baker, C.M.A. President 

Board of Directors 

Donna Schoen, CMA First Vice President 

Kerry Wolf, R.N., CMA, Vice President 

J.R. Neuberger, CMA Secretary 

Cheryl Blankenship Kupras, MSW, LCSW, CMA 

Brenda Davis, BSm CASAC-T 

Claude Hopkins, CADC, CMA Grievance Coordinator 

Chris Kelly, Advocates for Recovery through Medicine 

Nanette C. Wollfarth, CMA Chapter Coordinator 

Administration 

Joycelyn Woods, M.A., C.M.A. Executive Director 

Walter Ginter, C.M.A. Training & Recovery Services 

Herman Joseph, Ph.D., C.M.A., Ambassador At Large 

Advisory Board 

Andrew Byrne, M.D. 

Vincent P. Dole, M.D.

David A. Fiellin, M.D.
 

Herman Joseph, Ph.D., C.M.A.
 

Jeffrey D. Kamlet, M.D., FASAM, DABAM
 

Jason Kletter, Ph.D.
 

Joyce H. Lowinson, M.D. 

Judith Martin, M.D. 

John J. McCarthy, M.D.
 

Laura McNicholas, M.D., Ph.D.
 

Robert G. Newman, M.D.
 

J. Thomas Payte, M.D., C.M.A.
 

Beny J. Primm, M.D.
 

Marc Shinderman, M.D. 

Affiliated Groups and Chapters 

AZ NAMA Recovery, NAMA Recovery NorCAL (CA) 

CT Organizing Network, CT NAMA Recovery 

CT Capitol NAMA Recovery, Delaware NAMA Recovery 

FL NAMA Recovery, Atlanta NAMA-R (Suboxone) 

Chicago NAMA Recovery, The MAG IND 

Maryland NAMA Recovery, Massachusetts NAMA Recovery 

NJ NAMA-R Advocates, S Jersey NAMA Recovery 

NYC NAMA Recovery, Advocates for Change (Syracuse) 

Choice, Advocacy & Recovery Solutions (OH) 

Rhode Island NAMA-R, Tennessee NAMA Recovery 

Texas NAMA Recovery, New England NAMA Recovery (VT) 

Wisconsin NAMA Recovery 

International 

Australian IV League, HOPE (Bulgaria)
 

Méta d'âme’ (Canada), CRAMA (Croatia)
 

Brugerforeningen (Denmark), ACCES (France)
 

Inner Voice of Drug Users (India)
 

Methadone Indonesia, UISCE Ireland
 

I-ACT (South Africa), Italy Gruppo SIMS, Recovering Nepal
 

Landelijk Steunpunt Druggebruikers (Netherlands)
 

LIBERATION (Poland), INTEGRATION (Romania)
 

Svenska BrukarForeningen (Sweden)
 

Assoc. Substitution Therapy Receivers in Ukraine
 

Methadone Alliance (UK), National Users Network (UK)
 

Projects 

Medication Assisted Recovery Support Project (MARS) 

Stop Stigma Now 

June 9, 2014 

Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road, Room 5–1011 

Rockville, MD 20857 

Re: Confidentiality 

Dear Sirs and Madams: 

It is imperative that the confidentiality provisions put into place 

by Congress in 42 CFR Part 2 to protect the anonymity of patients 

seeking treatment for addictions to opiate drugs stay in place and 

not be weakened in any manner due to today’s movement 

towards electronic access to patient records across the spectrum 

of medical providers. 

The reasons for this are many and are the same today as those 

that motivated Congress to put 42 CFR Part 2 into place originally. 

First and foremost is the fact that prospective patients will be 

wary to seek treatment if they know that this knowledge will be 

disseminated, and through that distribution possibly become 

known by friends, family, employers, insurers and other providers 

of medical services to them. The stigma and discrimination that 

patients in addiction treatment are routinely subjected to for 

seeking medical assistance for what has become proven to be a 

chronic medical condition is as much or more widespread today 

than at any other time in our history. The National Alliance for 

Medication Assisted Recovery (NAMA-Recovery), as the 

preeminent patient advocacy organization in the United States is 

on the front lines of battling this discrimination and routinely 

hears the horror stories of patients mistreated by misinformed 

medical professionals on a daily basis. And if the discrimination 

and stigma exhibited by medical personnel is this widespread, it is 

even more so among the general population. Patients 

Continued 
_____________________ 

 

 

Continued 

1 Umbricht-Schneiter, A., Ginn, D.H., Pabst, K.M. and Bigelow, G.E. 1994. Providing medical care to 

methadone clinic patients: Referral vs on-site care. American Journal of Public Health 84(2): 208-210. 

SAMHSA, 6-9-2014, Page 2 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

need the protection of confidentiality to protect them from this widespread discrimination that results in 

substandard medical care and even death in too many instances. 

As examples, for patients in methadone treatment for opioid addictions, these patients typically get no 

medical care at all or are abused by medical providers by not being given pain medications for conditions 

warranting them. The reason given for their conditions is blamed on the methadone or they are told that 

they have to first get off the methadone treatment before they can get medical care. And because of the 

potential cardiac situation exhibited by a very small minority of patients, people are denied their 

methadone while they are an in-patient – this with no taper given and the doctor at their methadone 

program not alerted or consulted, something that would never happen in other specialties. We personally 

know of 3 instances where this has occurred. Imagine going to the hospital because you have pain in your 

chest and then being put into withdrawal for having sought medical attention. We also know of several 

instances where patients in a coma were not given their doctor prescribed methadone and it was obvious 

they were in withdrawal and suffering. The families complained profusely and after some 48+ hours of 

not getting their medication it was given to them after NAMA-Recovery intervened. One of these patients 

died the following week and he only went into the hospital for tests, but for the first 3 days he was only 

given half his regular methadone dose, began to deteriorate, went into a coma and died 6 days later. He 

had HCV was admitted for a biopsy and some tests, but the discrimination he was subjected to in this 

observer’s opinion killed him. This is what happens too often when patients tell medical professionals 

about their status as addiction treatment patients. To weaken 42 CFR Part 2 will make these types of 

injustices rampant across this nation and have worried patients not seeking needed medical interventions 

for fear of the stigma they will be subjected to, to the point of it risking their lives. 

We know of only 1 study that evaluated the medical care that methadone patients routinely get outside of 

the clinic environment1

. It was done 20 years ago. It compared medical care given in a clinic setting with 

care given in an outside clinic. First they could not find a medical clinic to be the patients outside care 

provider even though the providers were assured they would be paid for missed appointments, a 

prejudicial fear they expressed. After 3 attempts the researchers finally found a clinic willing to give 

medical care to methadone patients. The study found that only around 30% of the patients treated in the 

outside clinic got medical care. The quality of the medical care was not evaluated in the study, only the 

problems with access experienced by the patients. 

Medical professionals do not get their information about methadone treatment in medical school or from 

the scientific literature. Rather it comes from the media and they believe the myths and 

misunderstandings about methadone treatment and opioid addiction. Even worse since stable 

methadone patients have learned not to tell clinicians for their own protection the typical methadone 

patients that a doctor sees are those that are brought into the Emergency Room with multiple problems 

including secondary drug use. They make the assumption that all methadone patients are like this when 

multiple studies have proven that this is not the case at all. 

Until the medical profession is educated about methadone and addiction, methadone patients need the 

right to first develop a relationship with a physician or medical professional before they tell them they 
SAMHSA, 6-9-2014, Page 3 

 

are a methadone patient in addiction treatment. Most patients understand it is important for a physician 

to know what medications you are taking, however they also realize through negative learning 

experiences like those illustrated above that first they have to develop a relationship with a given medical 

professional and during that time make a judgment if the physician will be objective and provide 

competent treatment or impose his prejudices upon the patient at the real risk to the patient’s welfare. 

Another serious concern is that once this information goes into the the electronic health information 

networks that there will be no protection to patients at all. These records could easily accessible by 

employers, courts and other governmental agencies and not always through legal means. We are inferring 

that it would be easy for anyone to get access either by payment or having a friend that works in a 

hospital or doctor’s office. And while there may be rigid violations for any illegal access it would be nearly 

impossible to prove it. 

42 CFR Part 2 is essential to protect this patient population from a medical system and a society that is 

behind the times and knows virtually nothing about addiction treatment using medications like 

methadone, a treatment that our National Institutes of Health has called the “Gold Standard” for the 

treatment of opioid addiction. Do not weaken 42 CFR Part 2 to make electronic record keeping easier. 

Patients will die as a result, real people with families and friends like any other individuals in our 

population. They deserve better. 42 CFR Part 2 gives them that choice. 

Kind regards, 

Joycelyn Woods Roxanne Baker 

Executive Director President 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

To Whom it May Concern, 

It is imperative that the confidentiality provisions put into place by Congress in 42 CFR to 

protect the anonymity of patients seeking treatment for addictions to drugs stay in place and not 

be weakened in any manner due to today’s movement towards electronic access to patient 

records across the spectrum of medical providers. 

The reasons for this are many and are the same today as those that motivated 

Congress to put 42 CFR into place originally. 

First and foremost is the fact that prospective patients will be wary to seek treatment if 

they know that this knowledge will be disseminated, and through that distribution 

possibly become known by friends, family, employers, insurers and other providers of 

medical services to them. The stigma and discrimination that patients in addiction 

treatment are routinely subjected to for seeking medical assistance for what has 

become proven to be a chronic medical condition is as much or more widespread today 

than at any other time in our history. The National Alliance for Medication Assisted 

Recovery (NAMA-Recovery), as the preeminent patient advocacy organization in the 

United States is on the front lines of battling this discrimination and routinely hears the 

horror stories of patients mistreated by misinformed medical professionals on a daily 

basis. And if the discrimination and stigma exhibited by medical personnel is this 

widespread, it is even more so among the general population. The misinformation and 

stigma routinely spouted by the media is widespread and the cause of these 

misconceptions on the part of the general population. Patients need the protection of 

confidentiality to protect them from the widespread discrimination that results in 

substandard medical care and even death in too many instances, let alone the prejudice 

from ordinary people and family members that must be endured. Lessening 42 CFR will 

only make this situation more difficult for patients and prevent many from seeking 

deperately needed treatment. 

As examples, for patients in methadone treatment for opioid addictions, these patients 

typically get no medical care at all or are abused by medical providers by not being 

given pain medications for conditions warranting them. The reason given for their 

conditions is blamed on the methadone or they are told that they have to first get off the 

methadone treatment before they can get medical care. And because of the potential 

cardiac situation exhibited by a very small minority of patients, people are denied their 

methadone while they are an in-patient – this with no taper given and the doctor at their 

methadone program not alerted or consulted, something that would never happen in 

other specialties. We personally know of 3 instances where this has occurred. Imagine 

going to the hospital because you have pain in your chest and then being put into 

withdrawal for having sought medical attention. We also know of several instances 

where patients in a coma were not given their doctor prescribed methadone and it was 

obvious they were in withdrawal and suffering. The families complained profusely and 

after some 48+ hours of not getting their medication it was given to them after NAMARecovery intervened. One of these patients died the following week and he only went 

into the hospital for tests, but for the first 3 days he was only given half his regular 
methadone dose, began to deteriorate, went into a coma and died 6 days later. He had 

HCV was admitted for a biopsy and some tests, but the discrimination he was subjected 

to in this observer’s opinion killed him. This is what happens too often when patients tell 

medical professionals about their status as addiction treatment patients. To weaken 42 

CFR will make these types of injustices rampant across this nation and have worried 

patients not seeking needed medical interventions for fear of the stigma they will be 

subjected to, to the point of it risking their lives. 

We know of only 1 study that evaluated the medical care that methadone patients 

routinely get outside of the clinic environment[1]. It was done 20 years ago. First they 

could not find the patients a medical clinic to be the patients outside care provider even 

though the providers were assured they would be paid for missed appointments, a 

prejudicial fear they expressed. After 3 attempts the researchers finally found a clinic 

willing to trea. But only if the patients got their medical situations evaluated – it was 

around 30% that were accepted. The quality of the medical care was not evaluated in 

the study, only the problems with access experienced by the patients. 

Medical professionals do not get their information about methadone treatment in 

medical school or from the scientific literature. Rather it comes from the media and they 

believe the myths and misunderstandings about methadone treatment and opiod 

addiction. Even worse since stable methadone patients have learned not to tell 

clinicians for their own protection the typical methadone patients that a doctor sees are 

those that are brought into the Emergency Room with multiple problems including 

secondary drug use. They make the assumption that all methadone patients are like 

this when multiple studies have proven that this is not the case at all. 

Until the medical profession is educated about methadone and addiction, an education 

that they do not presently get in medical school, methadone patients need the right to 

first develop a relationship with a physician or medical professional before they tell them 

they are a methadone patient in addiction treatment. Most patients understand it is 

important for a physician to know what medications you are taking, however they also 

realize through negative learning experiences like those illustrated above that first they 

have to develop a relationship with a given medical professional and during that time 

make a judgment if the physician will be objective and provide competent treatment or 

impose his prejudices upon the patient at the real risk to the patient’s welfare. 42 CFR 

is essential to protect this patient population from a medical system that is behind the 

times and knows virtually nothing about addiction treatment using medications like 

methadone, a treatment that our National Institutes of Health has called the “Gold 

Standard” for the treatment of opioid addiction. Do not weaken 42 CFR to make 

electronic record keeping easier. Patients will die as a result, real people with families 

and friends like any other individuals in our population. They deserve better. 42 CFR 

gives them that choice and those most important protections. 

Kind regards, 
 

 

J.R. Neuberger 

Member, Board of Directors 

Corporate Secretary 

National Alliance for Medication Assisted Recovery (NAMA-Recovery) 

[1] Umbricht-Schneiter, A., Ginn, D.H., Pabst, K.M. and Bigelow, G.E. 1994. Providing medical care to 

methadone clinic patients: Referral vs on-site care. American Journal of Public Health 84(2): 208-

210. 

J.R. Neuberger, CMA 

Member, Board of Directors, 

National Alliance for Medication Assisted Recovery 

Director, Delaware Chapter: NAMA-Recovery 

NAMA-Recovery website: www.Methadone.org 

METHADONE is MEDICINE 

Methadone IS Recovery! 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 
 

 
 

 
 

 
 

 

 

 
 

 
 

 
 

 
 

 
 

 

 

 

 

 

 

 

 

 

 

 

 

 
 

 
 


 

 
 

 
 

 
 


 

 
 


 

 
 

 
 

 

 

Roxanne Baker, C.M.A. President 

Board of Directors 

Donna Schoen, CMA First Vice President 

Kerry Wolf, R.N., CMA, Vice President 

J.R. Neuberger, CMA Secretary 

Cheryl Blankenship Kupras, MSW, LCSW, CMA 

Brenda Davis, BSm CASAC-T 

Claude Hopkins, CADC, CMA Grievance Coordinator 

Chris Kelly, Advocates for Recovery through Medicine 

Nanette C. Wollfarth, CMA Chapter Coordinator 

Administration 

Joycelyn Woods, M.A., C.M.A. Executive Director 

Walter Ginter, C.M.A. Training & Recovery Services 

Herman Joseph, Ph.D., C.M.A., Ambassador At Large 

Advisory Board 

Andrew Byrne, M.D. 

Vincent P. Dole, M.D.

David A. Fiellin, M.D.
 

Herman Joseph, Ph.D., C.M.A.
 

Jeffrey D. Kamlet, M.D., FASAM, DABAM
 

Jason Kletter, Ph.D.
 

Joyce H. Lowinson, M.D. 

Judith Martin, M.D. 

John J. McCarthy, M.D.
 

Laura McNicholas, M.D., Ph.D.
 

Robert G. Newman, M.D.
 

J. Thomas Payte, M.D., C.M.A.
 

Beny J. Primm, M.D.
 

Marc Shinderman, M.D. 

Affiliated Groups and Chapters 

AZ NAMA Recovery, NAMA Recovery NorCAL (CA) 

CT Organizing Network, CT NAMA Recovery 

CT Capitol NAMA Recovery, Delaware NAMA Recovery 

FL NAMA Recovery, Atlanta NAMA-R (Suboxone) 

Chicago NAMA Recovery, The MAG IND 

Maryland NAMA Recovery, Massachusetts NAMA Recovery 

NJ NAMA-R Advocates, S Jersey NAMA Recovery 

NYC NAMA Recovery, Advocates for Change (Syracuse) 

Choice, Advocacy & Recovery Solutions (OH) 

Rhode Island NAMA-R, Tennessee NAMA Recovery 

Texas NAMA Recovery, New England NAMA Recovery (VT) 

Wisconsin NAMA Recovery 

International 

Australian IV League, HOPE (Bulgaria)
 

Méta d'âme’ (Canada), CRAMA (Croatia)
 

Brugerforeningen (Denmark), ACCES (France)
 

Inner Voice of Drug Users (India)
 

Methadone Indonesia, UISCE Ireland
 

I-ACT (South Africa), Italy Gruppo SIMS, Recovering Nepal
 

Landelijk Steunpunt Druggebruikers (Netherlands)
 

LIBERATION (Poland), INTEGRATION (Romania)
 

Svenska BrukarForeningen (Sweden)
 

Assoc. Substitution Therapy Receivers in Ukraine
 

Methadone Alliance (UK), National Users Network (UK)
 

Projects 

Medication Assisted Recovery Support Project (MARS) 

Stop Stigma Now 

June 25, 2014 

Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road, Room 5–1011 

Rockville, MD 20857 

Re: Confidentiality 

Dear Sirs and Madams: 

I was at the June 11th Listening Session for 42 CFR Part 2 and 

was very disturbed as to how it was organized. Methadone 

patients are the primary group that will be impacted by any 

changes and yet not one patient spoke. All day long the 

majority of the speakers were not the ones being impacted 

by any change in 42 CFR Part 2. I contacted the organizers 

informed them I represented patients and asked to speak. 

Since they had no patients speaking I would have thought 

they would have asked me for advise and if not me to ask 

AATOD if they could recommend a patient representative. 

The answer to my request was that I could speak at the end 

during the public comments. When I arrived I was not listed 

as an in-person speaker but as being on the web and as the 

only patient speaking was only given three minutes while 

other groups and organizations had several speakers and 

could make several points. There should have been a 

patient speaking for each panel during the session and it is 

S!MHS!’s responsibility to insure that the patients’ voice is 

heard. It is troubling that the premier group in the world 

representing MAT patients was not contacted. 

Here are some of the issues that were raised and the reason 

that patient confidentiality and privacy is more important 

today than it was three decades ago. 

Continued 
Continued 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

SAMHSA, 6-25-2014, Page 2 

Confidentiality is very important to methadone patients because of the stigma and prejudice they 

experience not only from the medical profession but in every aspect of their lives. I would estimate 

that at least 30% do not tell their immediate family and by that I mean the persons that they are living 

with. Most methadone patients know it is important to tell doctors that they are taking methadone, 

however from experience they have learned that they will get better health care if they develop a 

relationship and then tell the doctor. When a doctor knows that you are a methadone patient on day 

one it is unlikely that you as a methadone patient will get any medical care usually one of three things 

will occur: 1. your symptoms will be blamed on the methadone and you will be advised to get off of it, 

2.you will never be given pain medication for anything, and 3. you will be told that methadone is not 

good to take and that it is bad and you should get off of it. 

Doctors in Emergency Rooms need to know what the patient has taken for patient safety. 

While this is true generally doctors should not assume that everything in a patients record is correct or 

there. Patients go to doctors outside of the system all the time so that that information is missing. If 

they have taken illicit drugs or been given a medication from a friend or family member that will not be 

in the medical record either. And even when the information is there it does not mean that doctors 

know what to do with that information as in the death of Libby Zion at New York Hospital. Methadone 

patients rarely enter Emergency Rooms in an unconscious state so the best way to know what 

medications they are taking is to ask them. Doctors insisting that the OTP records be included in the 

electronic health information system is misleading and demonstrates their lack of understanding of the 

health care system when it comes to methadone and the prejudice patients experience. 

Certainly one way to alert Emergency Room staff that an unconscious patient is taking methadone 

would be to make it mandatory for Opioid Treatment Programs to give patients a card that they can 

carry on them. Methadone patients should not be mandated to carry the card because this was the 

case once in New York and several patients were stopped because they lived in communities with drug 

trafficking. When it was discovered that they were methadone patients they were beaten up by the 

police. After several instances of that occurring the state agency still mandated that every patient get 

a card but that the decision to carry it was with patients and that patients should be advised about the 

consequences if they carried it or did not. While the majority of OTPs in the US issue a card it is not 

enforced and neither is it a required regulation. 

At the Listening Session many stated that most patients don’t even know what 42 CFR Part 2 is. 

While methadone patients may not know that 42 CFR Part 2 is the code for the confidentiality 

regulations they do understand the need for confidentiality and are concerned about it. They may not 

understand the statue itself and all the rights that it confers but they do know that their information 

cannot be released without their consent. And that is very important to them. A significant number of 

methadone patients would not have entered treatment without their records being protected. 
SAMHSA, 6-25-2014, Page 3 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The records need to be merged with the general hospital records so that behavioral health institutions 

can plan for better health care and continuity of care. 

Behavioral health care institutions should know all the services in their area anyway so that they can 

refer a patient when it is required. Does this happen? Sometimes. However I doubt very much that 

merged records would create a more comprehensive system. Neither would it make a better system 

because institutions are not looking for more comprehensive care but cheaper care. The point is that a 

good program will refer and use the various systems in the area that is available merged records or 

none. 

The consent release form is too restrictive or does not allow for certain information. 

Persons that say this appears to be more of a case of not knowing how to fill out the consent form 

properly. What more is necessary but the date, that the consent last for 6 months, the material to be 

released and the agency to release it to. What more is needed? 

Some unforeseen consequences of making 42 CRF Part 2 less restrictive. 

Methadone prescriptions may be allowed on state prescription monitoring systems and the majority of 

these data bases are run by criminal justice agencies. Several states whose prescription monitoring 

systems are run by police have indicated that they want to use these data bases to also search for 

warrants. 

Most methadone patients when they enter treatment try to resolve their criminal justice issues 

including warrants. This would place a very real barrier for persons needing treatment. And although 

warrant searching is not being done presently it is likely that eventually it will occur. Methadone 

patients need protection from this and 42 CFR Part 2 does it. 

Once OTP records enter the electronic hospital system there is no guarantee that there will be any 

protection for anyone in treatment. Clerks, secretaries and I suspect janitors can even access records. 

This would make it very easy for an employer to pay hospital staff or the boyfriend/girlfriend of a 

probation/parole office to access the records and find out about any medications. And it would be 

nearly impossible to know who accessed the records. This needs to be considered very carefully 

because once these records are included you cannot get them back. 

At the present police are not allowed to enter OTPs and if they need anything or bring a patient that 

has been arrested to the clinic to dose they must wait outside. This is true of anyone working in the 

criminal justice system and the rationale is that they could see another patient that possibly has a 

warrant or they want to question. Without 42 CFR Part 2 protecting patients from this any patient with 

legal trouble would be afraid to go to the program and probably leave treatment even though they 

were attempting to resolve the legal problems. 

Continued 
SAMHSA, 6-25-2014, Page 4 

The technology is available to make OTP records part of the electronic health information system with 

a firewall. Therefore when part of a patient’s information needs to be released it can be. The reason 

that it is not available is no one wants to do it. However methadone patients are not the only group 

protected, for example medical records for persons with HIV are protected and the reason is because 

of the stigma and prejudice. And any methadone patient that is HIV+ will tell you that it is far more 

stigmatizing to be a methadone patient than a HIV patient. As long as there are groups that need to be 

protected it will be necessary to put a barrier on their records. 

What about current patients that already in treatment being told that their treatment information was 

confidential and that no one could access it unless they released it. The trust that has developed 

between treatment staff and patients would be destroyed. This was one of the most important issues 

when 42 CFR Part 2 was initiated. Treatment professionals from throughout the US stated that 

confidentiality was important to maintain trust. In 1972 the confidentiality regulations had been 

published in the Federal Register but before comment could be assessed a murder occurred near a 

New York City Methadone Program. The police presented a court order to view photographs of the 

patients and the program refused creating the case of Newman vs People since Dr. Newman was the 

director of the program. Dr. Newman refused to release the photographs was found in contempt of 

court and ordered to spend 30 days at Rikers Island. He was given two days to appeal and during this 

time a letter signed by the Special Action Office for Drug Abuse Prevention (S.A.O.D.A.P.) General 

Counsel was hand-delivered by the Deputy Director of S.A.0.D.A.P.. What the letter said is as important 

today as it was then. It addressed the importance of assuring addicts that treatment records would be 

maintained in confidence: "Because a high proportion of heroin addicts are involved in a life style 

which puts them in fear of criminal prosecution, any effort to modify that life style through 

participation in a treatment program is bound to be compromised if the addict believes that such 

participation will generate records which increase the risks he already feels. Stated more positively, all 

the operators of treatment programs with whom we have talked believe that it is important for them 

to give assurance of confidentiality to persons entering treatment, and we share this view." On the 

day that Dr. Newman was supposed to report to Rikers Island, July 25, 1972 the F. D.A. made the 

confidentiality provisions of the Federal Register Notice on Methadone published April 6, 1972 to be 

effective immediately. 

Changing the regulation would be an enormous task. It took about ten years to change 42 CFR Part 8 

and since confidentiality is even more important there needs to be even more thought put into any 

change. More important methadone patients need to be part of changing anything that protects them 

in 42 CFR Part 2. Since buprenorphine patients experience the same stigma and discrimination as 

methadone patients it would be insightful to include them if any changes are made. 

There is no data on methadone patients about the discrimination they experience in: 1) health care, 2) 

employment, 3) schools and training programs, 4) family, 5) criminal justice agencies, 6) child welfare 

agencies and 7) other institutions. NAMA-R receives several grievances a month from patients about 

criminal justice and child welfare agencies who are told that they must get off methadone and are 

often given a time limit that is contrary to Best Practice. Not only is this done but often patients are 

Continued 
SAMHSA, 6-25-2014, Page 5 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Sincerely, 

 

Executive Director President 

arrested and given jail time when they are not able to meet the time limit given to them. Methadone 

patients that work in health care report that medical professionals are the worst when it comes to 

treating methadone patients. I am attaching several reports from patients regarding the typical 

treatment that methadone patients experience when they reveal their status to medical professionals. 

If any changes are made to 42 CFR Part 2 SAMHSA will also have the responsibility to respond to the 

negative situations that methadone patients experience when accessing health care. Hospitals and 

health care facilities should be fined perhaps through American With Disabilities cases and included in 

the outcome should be education of the medical professionals about methadone treatment. SAMHSA 

will also have the obligation to insure that anyone that wrongfully takes any medical information from 

the hospital electronic information system is penalized. 

However, changing the regulations might not matter one bit because most states and especially those 

states with large numbers of methadone patients have a similar state regulation in place. Thus even if 

the federal statue were reversed you would have all the state regulations in place and many states 

seeing that patients are no longer protected at the federal level could tighten up their state 

regulations. This would certainly make SAMHSA appear to be indifferent towards the prejudice and 

stigma that methadone patients experience. 

NAMA Recovery has offered our services to SAMHSA in helping to decide if any changes should be 

made to 42 CFR Part 2 and we continued to offer our support. 

Joycelyn Woods

Executive Director

Roxanne Baker

President

enclosure

 


 


 


 

From: Lisa Hathaway [mailto:donotreply@eventbrite.com]
 

Sent: Monday, June 09, 2014 10:04 AM
 

To: Tipping, Kate (SAMHSA)
 

Subject: 42 CFR Part 2 Listening Session - Question from Lisa Hathaway
 

Lisa Hathaway (lisa.hathaway@bcbsfl.com) has a question for you about your event 42 CFR 

Part 2 Listening Session. 

Will SAMHSA also be considering the conflict with other federal laws and 42 CFR 2? For 

example: 1) HIPAA-you can share member PHI for treatment and health plan operations; 2) with 

CMS for Medicare Advantage Organizations and Part D Sponsors, you must provide CMS with 

mental health information through for risk adjustment with the HCC (hierarchial condition 

codes) and you are paid based on a member's HCCs thru the risk adjustment; 3) similar to the 

MAOs and Part D, for the Qualified Health Plans on the Exchange, there is now also risk 

adjustment and a similar system of where you are paid based on risk adjustement. So, there are 

other federal laws that require sharing of diagnoses and data for mental health and substance 

abuse conditions and drug treatment. Thanks for adding this to the considerations for the law. 

Lisa A. Hathaway, Assistant General Counsel Florida Blue 904-566-7878 

This message was sent to you via Eventbrite. 

Collect event fees online with Eventbrite 

 


 


 


 


 


 


 

Recommendations,concerning,proposed modifications,

of,42,CFR,Part,2,confidentiality protections

Submitted!June!9,!2014,!to the
 

Substance!Abuse!and!Mental!Health!Services Administration
 

(FR!Docket!# 2014C10913)
 

Robert!G.!Newman,!MD, MPH
 

President!Emeritus,!Beth!Israel!Medical Center
 

605!E.!82nd St. 
 

New!York,!NY 10028
 

rgnewmanmd@gmail.com
 

Thank!you!for!the!opportunity!to!submit!comments!regarding!possible!

modifications!of!federal!regulations!governing!confidentiality!of!alcohol!and!drug!

patient!records!(42!CFR!Part!2).!My!personal!interest!and!involvement!in!this!

issue!date!back!more!than!four!decades,!when!I!was!the!defendant!(and,!

ultimately,!the!prevailing!party)!in!People&v.&Newman[1], “...!the!leading!case!

construing!21!USC!1175”[2].!21!USC!1175!initially!authorized!the!restrictions!

upon!disclosure!and!use!of!drug!abuse!treatment!records!that!for!the!most!part!

remain!in!effect!today.[3]

Violations!of!an!individual’s!need,!desire!and!right!to!confidentiality!generally!are!

rationalized!with!the!argument!that!compelling!societal&interests!demand!it.!The!

key!changes!being!considered!by!SAMHSA’s!!“listening!session,”!however,!

relate!to!modifications!that!are!intended!primarily!to!benefit&patients through!

integration!of!medical!records!and!enhanced!medical!care!coordination.

Specifically,!the!changes!would!“expand!the!authority!for!releasing!data!to!...!

thirdCpartyCpayers,!health!management!organizations,!HIEs!(health!information!

exchanges),!and!care!coordination!organizations.”!As!part!of!an!integrated,!

electronic!medical!record!the!data!presumably!would!be!available!to!virtually!all!

providers!of!care.

Whatever!the!rationale,!the!argument!against!weakening!the!safeguards!of!

confidentiality!afforded!patients!(including!applicants!for!treatment!and!former!

patients)!is!summed!up!clearly!and!succinctly!by!SAMHSA!itself!in!the!

announcement!of!this!hearing:!“...&treatment&for&substance&abuse&disorders&is&

still&associated&with&discrimination.”!!Yes,!indeed!

Misunderstanding!of!addiction,!of!addicts!and!of!addiction!treatment!is!nearC!

universal!in!our!society!and!–!sadly!C!is!widely!evident!among!healthcare!workers,
2
 

hospitals,!clinics,!insurers,!etc.!Accordingly,!while!the!broadest!possible!knowledge!of!

a!patient’s!history!can!be!helpful!in!reaching!a!diagnosis!and!deciding!on!the!optimal!

therapeutic!course,!knowledge!of!an!addiction!history!is!far!more!likely!to!result!in!

negative!consequences!for!the!patient.

It!might!be!argued!that!stigmatization!of!those!who!are!or!who!have!been!dependent!

on!drugs!would!diminish!if!more!visibility!were!given!to!those!who!need!and!have!

received!help,!and!if!they!–!and!their!records!–!were!not!subject!to!special!

restrictions.!I!have!heard!colleagues!for!whom!I!have!greatest!respect!point!to!the!

enormously!gratifying!strides!in!recent!decades!in!overcoming!bias!based!on!sexual!

orientation,!progress!attributed!in!large!measure!to!the!willingness!of!many!gays!and!

Lesbians!and!others!to!“come!out!of!the

closet.”!“Coming!out,”!however,!must!be!an!individual!choice,!and!not!the!result!of!

closet!doors!being!smashed!open!to!expose!those!inside!

Individuals!must!be!free!to!authorize!release!of!information,!but!such!authorization!

must!!not!!be!!coerced,!!and!!must!!not!!be!!a!!sine&&qua&&non&&for!!the!!! provision!!!!!!!!!!!!!!!!

of!treatment.!Every!effort!must!be!made!to!ensure!that!patients!are!!! fully!!!!informed!

as!to!the!potential!benefits!as!well!as!the!risks!of!disclosure.!They!must!be!allowed!to!

decide!for!themselves!whether!to!permit!release!of!information!that,!given!societal!

attitudes!of!today,!can!very!literally!destroy!lives.

SAMHSA!and!other!concerned!parties!are!urged!to!heed!the!words!of!Justice!Louis!

Brandeis!(Olmstead&vs&United&States,!1928):!"Experience!should!teach!us!to!be!most!

on!our!guard!to!protect!liberty!when!the!government’s!purposes!are!to!be!beneficent.”!

Thank!you!again!for!the!opportunity!to!share!these!views!with!you.

[1]People&v.&Newman.!!32!NY!2nd 1972

[2]Dept.!HEW.!“Confidentiality!of!Alcohol!and!Drug!Abuse!Patient!Records.”!!

1975.!Federal&Register.!!40(127),!Sect.!265C1(d),!p.!27821

[3]http://cfr.vlex.com//vid/2CstatutoryCconfidentalityCpatientC19797521,!accessed!June,!

2014
 

 

 

 

 

 

 

 

	 

	 

	 

	 

	 

	 

These comments are from Bay-Arenac Behavioral Health, located in Michigan, which is a state funded 

Community Mental Health Center for two counties and a state designated Coordinating Agency for 

Substance Abuse services for a six county region. 

Our overall comments are: 

1.	 SAMHSA should not require consent among “covered entities” for communications for purposes 

of coordination of care. 

2.	 SAMHSA should broaden the applicability of 42 CFR Part 2 in order to accommodate the new 

health care environment where increasingly complex service delivery systems and modalities 

are involved in SA treatment, payment and operations. 

3.	 SAMHSA should permit consents to name agencies and entities to whom information can be 

released versus specific individuals. 

4.	 Serious civil and criminal consequences should remain in place for the disclosure of this 

information beyond the state and federally funded health care “covered entity” context. 

Not Require Consent Among Covered Entities 

We strongly recommend that SAMHSA consider creating a “covered entity” conceptual framework for 

SA confidentiality that is similar to that for HIPAA. If necessary this could be limited to state or federally 

funded health care programs, as these are within the federal governments locus of control. The 

“covered entities” could have privacy notice obligations and permissible use of information for 

treatment and operations. This would greatly improve the ability of providers to meet the 

requirements being placed upon them by state and federal payers to integrate efforts to support 

patients in their recovery, and it would greatly improve clinical outcomes. It would eliminate the need 

to obtain a consent for administrative purposes. 

We assume it is the intent of 42 CFR Part 2 to prevent those (who are not providing health care) from 

knowing about a patients drug and alcohol treatment and history because they may discriminate against 

that patient for purposes of employment, housing or other opportunities. We do not think it is the 

intent to prevent those who are providing health care from communicating with each other and 

improving the likelihood of recovery for the patient. Addiction by its nature is a disease that can cause 

patients to “manage” relationships including those with health care providers in order to meet their 

needs for drugs or alcohol. Patients who experience the poorest clinical outcomes are those who 

refuse to provide consent for release of information for coordination of care but then seek to obtain 

what are often duplicative and contraindicated services from multiple health care providers. 

As examples: 

•	 The State of Michigan is transferring management of substance abuse services from designated 

regional coordinating agencies to health plans. At this point in time, it is assumed each of the 

thousands of patients receiving care under this system will have to sign a consent to release 

information to the new health plan in order to comply with 42 CFR Part 2. This is a waste of 

resources and it is unknown what would happen if a patient refused. 

•	 Our psychiatrists have expressed concern that they must prescribe without full information 

regarding medications prescribed by other prescribers or without knowing the drug and alcohol 

history gleaned by other health care providers because a patient refuses to provide consent for 

coordination of care. In some instances optimal treatment options may not be utilized due to 

concerns over possible adverse effects or a physician may be concerned about accepting a 
 

 

 

 

 

 

 

 

	 

	 

	 

	 

patient into treatment because they believe they cannot adhere to their professional obligations 

to provide proper treatment. 

Broaden the Applicability 

Whatever the level of confidentiality and consent required, we strongly recommend SAMHSA apply the 

same standard across the entire health care industry, much like HIPAA was applied. 

As SAMHSA notes, the exclusivity of substance abuse treatment among providers is fading (it should be 

noted provider SA licensing requirements remain intact) and is being replaced by integrated service 

delivery models, such as integrated health care clinics. The lines between types of providers are blurring 

and the distinction relative to confidentiality is becoming less meaningful. It is becoming harder to 

determine if and when your organization should comply with 42 CFR Part 2, and as a result, you apply 

the consent requirements to populations for whom compliance is probably technically not required in 

order to be safe. 

Also, the value of applying 42 CFR Part 2 to only SA treatment providers is becoming less clear. Just as 

much damage is done if SA information is released by any health care provider to someone without a 

need to know. The standard for SA confidentiality is higher than for other health conditions, including 

mental health treatment. Societal culture is changing and alcohol/drug abuse is more opening discussed 

that several decades ago, and is perhaps less distinct in this way from other health conditions than it 

once was. Does research still provide an adequate rationale for holding this particular set of health 

conditions out as necessitating a higher confidentiality standard than exists for other health conditions? 

Relevant examples: 

•	 As a community mental health center, our treatment records contain social work and psychiatric 

assessments which indicate whether or not a patient reports they had/have a substance abuse 

condition. We are not the treating provider for substance abuse. 

•	 Our service access and eligibility center staff screen patients for both mental health and 

substance abuse conditions and make referrals to various appropriate providers, both mental 

health agencies and substance abuse treatment providers. 

•	 One of our mental health treatment models, integrated dual diagnosis treatment (IDDT), treats 

mental health conditions in a way that coordinates the mental health and substance abuse 

services being received, but does not deliver the actual substance treatment. So our treatment 

plan may reference all services being received, although our agency is not the substance abuse 

treatment provider. 

•	 Our agency has worked closely with other health care providers (such as primary care physicians 

and others not in the behavioral health field), and they do not concern themselves with 42 CFR 

Part 2, although they may be helping a patient resolve their alcohol or drug addiction, but do 

not hold themselves out to be an SA treatment provider. 

Permit Consents to Name Agencies and Entities 

We strongly recommend SAMHSA eliminate the requirement to identify an individual in the “To Whom” 

section on the consent. Newer modalities of care and integrated service delivery systems more often 

involve treatment teams, physician extenders, and other models which render naming an individual 

difficult. Requesting repeated releases from a patient to accommodate changes in the named 
 

 

 

 

 

 

 

 

	 

	 

individual when the patient has already agreed to receive care from the involved provider does not 

make sense. We strongly encourage SAMHSA to allow the consent to include a more general 

description of the individual, organization, or health care entity, or a health information exchange, to 

which disclosure is to be made. 

Other Points of Interest in Michigan: 

•	 Recent state legislative action in Michigan mandated the creation of a consent which complies 

with federal and state privacy and confidentiality requirements for all health care services 

including mental health care and substance abuse treatment. This action was driven by a state 

level health information exchange leadership group which recognized the barriers created by 

diverse consent management practices among health care providers. 

•	 Currently substance abuse treatment data is being excluded from a statewide initiative to 

improve coordination of care for all Medicaid patients due to unresolved privacy concerns. 

Thank you for the opportunity to submit comments. 

Janis Pinter 

Corporate Compliance Officer 

Bay-Arenac Behavioral Health (and Riverhaven Coordinating Agency) 

201 Muholland Dr. 

Bay City, MI 48708 

989-895-2300 
Thank you greatly for allowing us to make comments in advance of the public hearing. 

I represent a large county level 1 hospital and trauma center that has Part 2 Program. The Part 2 

Program treaters would like to share all patient information with their colleagues in various 

departments in order to coordinate care and best serve the needs of each individual patient. This 

includes information like a medication list that could prevent the prescription of counter indicated 

materials all the way down to patient schedules that could assist in coordinating care in a large facility 

across multiple specialties. Should a QSOA agreement be entered or are these the types of 

communications that are considered “between a program and an entity having direct administrative 

control”? Most importantly the providers don’t want to be limited in sharing treatment information 

that might identify a patient as being in a substance abuse program that could avert a medical 

catastrophe. There may be no emergency necessitating the “breaking the glass” until it is too late. 

The statutory provisions create a significant barrier within institutions to provide patient care. We 

would like that loosens restrictions and/or definitively states what can be shared: 

Current: 

(3) Communication within a program or between a program and an entity having direct 

administrative control over that program. The restrictions on disclosure in these regulations do not apply 

to communications of information between or among personnel having a need for the information in 

connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment 

of alcohol or drug abuse if the communications are 

(i) Within a program or 

(ii) Between a program and an entity that has direct administrative control over the program. 

Anticipated: 

(3) Communication within a program or between a program and an entity having direct 

administrative control over that program. The restrictions on disclosure in these regulations do not apply 

to communications of information between or among personnel having a need for the information in 

connection with their duties to provide patient care or arise out of the provision of diagnosis, treatment, or 

referral for treatment of alcohol or drug abuse if the communications are 

(i) Within a program or 

(ii) Between a program and an entity that has direct administrative control over the program. 

The provisions of the statute create a barrier to patient care by hindering the flow of real time medical 

information necessary to avoid catastrophic events to minor inconveniences. Obtaining patient consent 

can alleviate some of these issues, but the consent requirements are very restrictive and delay the flow 

of information. For instance, a hospital can open/acquire additional clinics or bring in outside services 
and grant them access to their medical records systems under a BAA. These partners initially cannot 

gain access to the 42.2CFR records without creating a new release or a possibly a QSOA. 

Henry A. Parkhurst 

Assistant County Attorney 

C-2000 Government Center 

300 South Sixth Street 

Minneapolis, Minnesota 55487 

Phone (612) 348-4145 

Fax: (612) 348-8299 

PRIVILEGED AND CONFIDENTIAL 

 ATTORNEY-CLIENT COMMUNICATION OR ATTORNEY WORK PRODUCT 

Do not share this message with any other person without prior permission from counsel. If you have 

received this message in error, please immediately 

 call 612-348-4145. 

Disclaimer: Information in this message or an attachment may be government data and thereby 

subject to the Minnesota Government Data Practices Act, Minnesota Statutes, Chapter 13, may 

be subject to attorney-client or work product privilege, may be confidential, privileged, 

proprietary, or otherwise protected, and the unauthorized review, copying, retransmission, or 

other use or disclosure of the information is strictly prohibited. If you are not the intended 

recipient of this message, please immediately notify the sender of the transmission error and then 

promptly delete this message from your computer system. 
 

 

 

 

 

 

Removing my right to have my mental health records reviewed without consent is a mere precept for 

the on going battle of the liberals to next ban gun rights! Yes, it's a hidden agenda & I'm not buying 

it. Oppose this attempt to eliminate consent from whom the mental health records belong, is only the 

first of what will be future presentence of this administration to come, where voting or supporting nonliberal agendas will equate to the how the IRS has handled the tea party! It will lead to inability for 

conservatives, prior military with PTSD being able to protect their privacy & eventually their families I'm 

sure. We are not fools, please refuse to fold to such an out right attempt to the manipulation of our 

mental capacity to all venues of political involvement with this power of non consent to the most 

valuable asset we all own-- our sanity & it's representation!!! 
	 

 

 

	 

	 

	 

	 

	 


 


 
 


 
 


 
 


 
 


 
 


 
 

	 

	 

	 

	 

	 

 


 


 


 


 


 


 


 

	 

	 

	 

	 

	 

	 


 


 


 


 


 


 


 

 

	 

	 

	 

	 

	 

	 


 


 


 


 


 


 


 

	 

	 

	 

	 

	 

	 

For more info contact: 

JAMES C. PYLES 

Jim.Pyles@ppsv.com 

202.872.6731 

Comments of James C. Pyles, Counsel,
 

American Psychoanalytic Association
 

Public Listening Session
 

79 Federal Register 26,929 (May 12, 2014)
 

FR Doc. 2014—10913
 

Substance Abuse and Mental Health Services Administration
 

June 11, 2014
 

Issue 

The American Psychoanalytic Association (APsaA), one of the oldest mental 

health professional associations in the country, has been asked to address 

whether narrowing the applicability of 42 C.F.R. Part 2 would: 

(a)	 adversely impact patients and health care provider organizations, 

(b)	 whether the change would address stakeholder concerns, and 

(c)	 whether this change would raise any new concerns. 

APsaA believes this suggested change would: 

(a)	 adversely affect patients by eroding the trust that is essential to quality 

mental health care and providers by creating greater complexity and 

conflict in patient privacy laws and standards of ethics, 

(b)	 not address shareholders’ concerns by diminishing burdens, and 

(c)	 raise new concerns among patients, families and practitioners that the 

privacy of sensitive mental health information will not be protected. 

The overall issue throughout the “notice of public listening session” is 

whether SAMHSA should reduce the privacy rights and protections of individuals 

in federally-assisted substance abuse treatment programs in order to “reduce the 

1501 M STREET, NW  SEVENTH FLOOR  WASHINGTON DC 20005  PH 202.466.6550  FX 202.785.1756  WWW.PPSV.COM 
 

 

 

	 

	 

	 

	 

 

	 

 

 

	 

	 

	 

	 

	 

	 

	 	 

	 

	 

	 

	 

2
 

burdens” on certain “stakeholders,” e.g., new health care organizations such as 

ACOs and health homes?1 

These “stakeholders” have sought this change in the regulations because 

complying with the patients’ wishes with respect to privacy is “difficult” for them. 

It is important to be clear about what these stakeholders are seeking—they 

wish to more freely use and disclose a patient’s sensitive substance abuse 

treatment information regardless of the patient’s wishes and over the patient’s 

objections. Under existing law, they may use and disclose a patient’s substance 

abuse information: 

(a)	 with the patient’s consent, or 

(b)	 without consent 

(1)	 to the extent necessary to meet a bona fide medical emergency, 

(2)	 for the purpose of conducting scientific research, management 

audits, financial audits or program evaluations, and 

(3)	 if authorized by a court order to avert a substantial risk of death 

or bodily harm.2 

APsaA believes that SAMHSA should assist integrated delivery systems in 

accommodating patients’ expectations, privacy rights, privacy laws and ethical 

standards, rather than seeking to alter patients’ expectations, privacy laws and 

ethical standards to accommodate the current capability of new health care 

delivery models. As SAMHSA concedes in the notice, “technical solutions for 

managing consent collection are possible.”3 SAMHSA should not be seeking to 

reduce the privacy burden on integrated delivery systems by increasing the 

privacy burden and risk for patients and practitioners. 

1 79 Fed. Reg. at 26,930. 2 42 U.S.C. 290dd-2(b). 3 79 Fed. Reg. at 26,931. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 


 


 


 


 


 

3
 

Consideration of “Stakeholders” Views 

SAMHSA states that the purpose of the listening session is “to obtain direct 

input from stakeholders on updating the regulations.”4 There is no indication that 

SAMHSA plans to give the views of patients or consumers additional weight, and 

there is an assumption that the regulations need “updating.” In fact, patients are 

the most important “stakeholders” because they have the most at stake, and the 

health care delivery system cannot operate without their voluntary cooperation. 

As HHS determined in issuing the HIPAA Privacy Rule, “the entire health care 

delivery system is built upon the willingness of individuals to share the most 

intimate details of their lives with their health care providers.”5 APsaA believes 

that SAMHSA should give the greatest weight to the concerns of patients and 

consumers in determining whether their privacy rights should be weakened. 

Weakening the Privacy Protections in Federally-Assisted Substance Abuse 

Programs, in the Midst of an Electronic Health Information Privacy Breach 

Epidemic, Would Erode the Trust That is Essential for Quality, Cost Effective 

Health Care and Create an Ethical Conflict for Mental Health Practitioners. 

1. As the Supreme Court noted in 1996, effective mental health services 

are “rooted in the imperative need for confidence and trust” even more 

than with physical medicine. The “mere possibility of disclosure” may 

impede the development of the confidential relationship necessary for 

successful treatment. The Court’s holding has been followed in over 400 

6 cases. 

2. When HHS issued the HIPAA Privacy Rule in 1996, it found that “privacy 

is necessary to secure effective, high quality health care.”7 HHS found 

that the public’s trust in the health care delivery system was being 

eroded by the unwanted disclosure of medical records.8 More 

specifically, HHS found Americans were delaying or avoiding treatment 

for stigmatizing diseases such as cancer, HIV/AIDS, and other sexually 

transmitted diseases and that, every year more than 2 million Americans 

4 79 Fed. Reg. at 26,929.
 5 65 Fed. Reg. at 82,467 (Dec. 28, 2000).
 6 Jaffee v. Redmond, 116 S. Ct. 1923, 1928 (1996).
 7 65 Fed. Reg. at 82,467 (Dec. 28, 2000).
 8 65 Fed. Reg. at 82,467.
 
 

 

 

 

 

 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 

4
 

did not seek treatment for mental illness due to privacy fears at an 

annual cost of nearly $1 billion.9 

3. Since HHS’ findings in 1996, the nation has experienced an electronic 

health information privacy breach epidemic. Just since 2009 when 

health information privacy breaches began to be reported as required 

by the HITECH Act, more than 31 million Americans have had their 

health improperly disclosed in breaches involving 500 or more 

individuals, and thousands more have been the victims of smaller 

breaches.10 Between 2005 and 2008, the privacy of nearly 40 million 

electronic health records was breached.11 

4. As electronic health information privacy breaches have escalated, the 

public’s trust that privacy laws will protect them as declined, and 97% of 

the public believe that health care providers and insurers should not be 

able to share their health information without their consent.12 Twothirds of Americans are concerned that the privacy of their health 

information will be breached in an electronic health information system 

and many are withholding information to prevent it from being 

improperly disclosed. The concern is particularly high with respect to 

mental health and “drug misuse” information.13 

5. It is now well established that electronic health information systems 

cannot be made entirely secure.

14 But the damage that can be done by 

electronic breaches is unlimited because the health information of 

millions of individuals can be stolen “in a matter of seconds,” it can be 

stolen by thieves operating from anywhere in the world, and once 

stolen, electronic health information can never be recovered.15 

9 65 Fed. Reg. at 82,777-779. 10 Health information privacy breaches through May 17, 2014, Office of Civil Rights, Dept. of Health and Human
 

Services.
 11 “The Financial Impact of Breached Protected Health Information,” American National Standards Institute, et al.
 

p. 21 (March 2012). 12 Id. at p. 23.
 13 “Concern About Security and Privacy, and Perceived Control Over Collection and Use of Health Information Are
 

Related to Withholding Health Information from Healthcare Providers,” I. Agaku, et al., J. of Am. Med. Inform.
 

Assoc. (Aug. 2013).

14 “You WILL Be Hacked, Cope With It,” Infosecurity Magazine (Nov. 19, 2013), http://www.infosecuritymagazine.com/view/35708/you-will-be-hacked-cope-with-it/; HHS finding, “. . . there is no such thing as a totally
 

secure system that carries no risks to security.” 68 Fed. Reg. at 8346 (Feb. 20, 2003).
 15 “The Financial Impact of Breached Protected Health Information,” p. 15.
 
 

 

 

 

 

 

5
 

Narrowing the Applicability of 42 C.F.R. Part 2 to “Specialty” Substance Abuse 

Services and Excluding “Pre-Treatment” Services is Inconsistent With the 

Statute and Will Further Erode the Trust of Patients, Families and Practitioners. 

The statute on which 42 C.F.R. Part 2 is based could hardly be more broad. 

The statute states that the privacy protections, including the right of consent, are 

to apply to: 

“Records of the identity, diagnosis, prognosis, or treatment of 

any patient which are maintained in connection with the 

performance of any program or activity relating to substance 

abuse education, prevention, training, treatment, 

rehabilitation, or research which is conducted, regulated, or 

directly or indirectly assisted by any department or agency of 

the United States. . .”16 

There is no indication that Congress intended for the privacy protections to 

apply only to “specialty” substance abuse services or that pre-treatment 

substance abuse services (e.g., screening, brief interventions) were to be 

excluded. 

Further, it is unlikely that the public or practitioners will be able to draw a 

bright line between segments of an integrated delivery system that are providing 

“pre-treatment” substance abuse services for which there is no right of consent 

and segments providing substance abuse services for which consent is required. 

Greater complexity in the law will only lead to a further erosion of trust in the 

effectiveness of privacy protections and lower quality services as patients engage 

in self-protective measures. 

SAMHSA Should Not Encourage or Condone Noncompliance With Privacy Laws 

and Standards of Professional Ethics. 

The notice states that among the reasons SAMHSA is considering reducing 

the patients’ privacy rights are that the new integrated delivery systems 

“generally do not have sophisticated consent management capability” and that 

16 42 U.S.C. § 290dd-2(a). 
 

 

 

 

 

 

 

 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 

6
 

“[c]urrently most EHRs don’t support data segmentation.”17 However, the 

HITECH Act clearly contemplates that health care providers will use 

“[t]echnologies that protect the privacy of health information and promote 

security in a qualified electronic health record, including for the segmentation and 

protection from disclosure of specific and sensitive individually identifiable health 

information with the goal of minimizing the reluctance of patients to seek care (or 

disclose information about a condition) because of privacy concerns. . . .”18 

SAMHSA acknowledges that substance abuse treatment information is the type of 

information that could cause people to refuse to seek treatment if they fear they 

would compromise their privacy.19 

Further, the HITECH Act requires covered entities to grant an individual’s 

request for restrictions on the disclosure of health information if the individual 

pays for the services out of pocket.20 HHS has determined that covered entities, 

including health care providers, must have the capability to segment certain 

health information to comply with the patient’s right to pay privately. Further, 

HHS has determined that all providers subject to HIPAA should have that 

capability because it is needed to comply with HIPAA’s “minimum necessary” 

rule.21 

HHS has repeatedly made clear that the “minimum necessary” rule is to be 

“consistent with, and not override, professional judgment and standards.” 22 The 

professional standards of the American Psychoanalytic Association provide as 

follows: 

Confidentiality of the patient’s communications is a basic 

patient’s right and an essential condition for effective 

psychoanalytic treatment and research. A psychoanalyst must 

take all measures necessary to not reveal present or former 

patient confidences without permission, nor discuss the 

17 79 Fed. Reg. at 26,931.
 18 Section 3002(b)(2) of the HITECH Act.
 19 79 Fed. Reg. at 26,930.
 20 Section 13,405(a) of the HITECH Act.
 21 78 Fed. Reg. at 5628 (Jan. 25, 2013); 42 C.F.R. § 164.522(a)(1)(vi).
 22 67 Fed. Reg. at 53,197 (Aug. 14, 2002); 65n Fed. Reg. at 82,544 (Dec. 28, 2000).
 
 

 

 

 


 


 


 
 


 


 

7
 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 

particularities observed or inferred about patients outside 

consultative, educational or scientific contexts.23 

The ethics standards of the American Psychiatric Association provide similarly 

that: 

A psychiatrist may release confidential information only with 

the authorization of the patient or under proper legal 

compulsion.24 

See similarly the ethics standards for social workers: 

Social workers may disclose confidential information when 

appropriate with valid consent from a client or a person legally 

authorized to consent on behalf of a client.25 

Changing the substance abuse treatment rule to permit disclosure of 

sensitive health information without consent would put those rules in conflict 

with the ethical standards of psychoanalysts, psychiatrists and social workers. 

Finally, the Supreme Court in Jaffee v. Redmond recognized a 

“psychotherapist-patient privilege” in federal law that can only be waived by the 

patient or to avert a serious threat of harm to the patient or others.26 The Court 

also recognized that all 50 states have similar laws. Congress made clear in the 

HITECH Act that such privileges are not to be waived by privacy laws.27 

So the existing privacy provisions in 42 C.F.R. Part 2 are consistent with 

current federal and state law, patient expectations and standards of professional 

ethics and should not be weakened to accommodate the current capabilities of 

integrated delivery systems. Rather, such systems should be required to comply 

with current privacy laws, patient expectations and ethical standards in order to 

preserve the trust that is essential for quality, cost effective health care. 

23 “Principles and Standards of Ethics for Psychoanalysts,” American Psychoanalytic Association, section IV (June
 

2008).

24 “The Principles of Medical Ethics,” American Psychiatric Association,” section 4.2 (2013).
 25 “Code of Ethics, National Association of Social Workers,” section 1.07(b) (2008).
 26 Jaffee v. Redmond, 116 S. Ct. at 1929, 1932, n. 19.
 27 Section 13,421(c) of the HITECH Act.
 
POWERS 


POWERS PYLES SUTTER & VERVILLE PC 

ATIORNEYSAT LAW ---­

June 13, 2014 

Ms. Cathy J. Friedman 

SAMHSA Public Health Analyst 

The Substance Abuse and Menta l Health Services Admin istration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

Re: Supplemental Comments of the Ame rican Psychoanalyt ic Association 

After June 12 Listening Session: Confidenti ality of Alcoho l and Drug 

Abuse Patient Records- 79 Fed. Reg. 26929, FR Doc. 2014-10913 

Dear Ms. Friedman: 

On behalf of the American Psychoanalytic Association (APsaA), I want to 

thank you for the opportun ity to comment on whether SAMHSA should reduce or 

narrow patients' privacy rights under 42 C.F.R. Part 2 to reduce the burden on 

new health care delivery models such as ACOs and health homes. As stated in our 

written comments subm itted on June 11 and for the nine reasons listed in my 

testimony on the record in the Listening Session on June 12 (copy attached), 

APsaA feels strong ly that it is essential for access to quality substance abuse 

treatment services to preserve or enhance the existing privacy rights of patients. 

also thought it might be helpfu l if I shared some observat ions about the 

comments we heard during the course of the Listening Session. 

1. 	 SAMHSA Should Put the Interests of Patients First 

The comments presented at the Listening Session fell generally into two 

categor ies: 

(a) 	 those by patient and consumer representatives and by 

representatives of mental health practitioners who are subject to 

estab lished standards of professional ethics in favor of preserving 

1501 M STREET, NW • SEVENTH FLOOR • WASH INGTON DC 20005 • PH 202.466 .6550 • FX 202.785.1756 • WWW .PPSV.COM 
POWERS 


POWERS PYLES SUTTER & VERVILLEPC --- ATTOflNE'ISATLAW --­

Ms. Cathy J. Friedman 

June 13, 2014 

Page 2 

and strength ening the privacy protections in the substance abuse 

rule; and 

(b) 	 those by behavioral health clinics, health information exchanges, 

and health IT vendors in favor of abolishing all or some of 

patients' rights under the substance abuse rule . 

So an initial question is, whose interests is SAMHSA principally charged w ith 

protecting? APsaA believes that SAMHSA should first and foremost protect the 

interests of patients . This is why the "stakeholder" approach wi ll always lead to a 

result that is not "patient-centered" because patients wi ll always be outvoted by 

the numerous and growing number of "stakeholders" seeking to further their own 

interests and profitability. App lying an approach that gives equal weight to all 

"stakeholders" in determining what privacy rights a patient should have, makes 

no more sense than using a "stakeholder" approach to decide how to treat a 

cancer patient. That would require convening a meeting of the patient and all 

conceivab le "stakeholders" includin g, oncologists, surgeons, administrators, the 

billing department, the laundry and janitorial services, drug company 

representatives, the medical equipment suppliers, the health IT department, inhouse and outside counsel, etc. and weighing all of their views equally. The 

patient's views wil l always be outweighed in such an approach. 

In fact, quality health care can only be provided if there is a relationship of 

trust between the patient and the practitioner -a nd those were the 

representatives at the Listening Session who most often favored preserving the 

patients' privacy rights. All health information starts out private and under the 

patient's contro l-in the patient's head or in the patient's body . Health care is 

only possible when the patient voluntarily (assuming they are competent) 

discloses that information to a practitioner. 

Studies we cited at pages 3-4 of our initial comments show that patients 

wi ll not disclose information necessary for their treatment if they do not trust 
---

POWERS 

POWERS PYLES SUTTER &VERVILLE PC --- ATTORNEYSATLAW 

Ms. Cathy J. Friedman 

June 13, 2014 

Page 3 

that the practitioner will use and disclose the information only as they consent. 

As the Supreme Court noted in Jaffee v. Redmond, 116 S. Ct. 1923, 1929 (1996), 

fai ling to allow the patient to contro l disclosure of mental health information 

does not make more information available, but rather makes less information 

availab le because it is "unl ikely to come into being." 

Several refer ences were made to "ba lancing" the individual' s privacy 

interests against the public's interest in more integrated health care and "big 

data." However, the Supreme Court in Jaffee expressly rejected such a "balancing 

component" based on the find ing that privacy is essential to quality mental health 

care, and access to quality mental health services is in the best interest of both 

the individual and the public. 116 S.Ct. at 1929. So for this reason as we ll, the 

interests of the pat ients should be given top priority when considering whether to 

narrow or reduce patients' privacy rights. 

Those who wish to disclose or gain access to the patient's sensitive mental 

health informat ion without the patient's consent or over the patient's objections 

are essentially taking the position that they could provide much better health care 

if they could just get the patient out of the way. That is not patient-centered 

health care. 

Putting the interests of the patients first wou ld also help blunt recent 

criticism that SAMHSA is "preoccupied" with "broadly defined behaviora l health 

concerns" rather than focused on severely menta lly ill patient s.

1 And reducing 

privacy protections in an election year in the middle of a rapidly expanding health 

privacy breach epidemic and a strong public backlash against unfettered NSA 

surveillance may not be wise politically . 

1 See "Memorandum: Committee 's Investigations of Federal Programs Addressing Severe Mental Illness," Majority 

Staff, Subcommittee on Oversight and Investigations, p. 6-7 {May 15, 2014). 
POWERS 

POWERS PYLES SUTTER & VERVILLE PC --- ATTORNEVSATLAW- - ­

Ms. Cathy J. Friedman 

June 13, 2014 

Page 4 

2. 	 SAMHSA Should Preserve and Enhance Clear and Unambiguous 

Privacy Protections that Are Consistent with Established Standards of 

Professional Ethics. 

For decades prior to the issuance Amended HIPAA Privacy Rule by the Bush 

Administration in 2002, the national standard for patient health information 

privacy was set forth in the American Medical Association's Standards for the 

Ethical Practice of Medicine which stated that a patient's health information may 

not be disclosed without consent, and any conflicts between a patient's right to 

privacy and a third party's need to know "should be resolved in favor of the 

patient, except where that would result in a serious health hazard or harm to the 

patient or others ." 2 So those who claim that the patient's right of consent 

somehow creates a threat to the patient's health need to understand that this has 

been the standard of practice throughout the history of medicine as well as the 

history of the country. 

In the eleven years since the effective date of the Amended HIPAA Privacy 

Rule on April 14, 2003, the public has lost confidence that the health privacy laws 

will protect them and the regulated industry does not know what is expected 

under complex and conflicting privacy laws and rules.3 This has resulted in poorer 

quality health care at higher cost. So SAMHSA should not use the HIPAA Privacy 

Rule as a model, and the inconsistency of Part 2 privacy protections with the 

HIPAA Privacy Rule should not be a justification for conforming Part 2 to HIPAA. 

The privacy protections in 42 C.F.R. Part 2 are much clearer and less 

conflicting and ambiguous than the protections in the Amended HIPAA Privacy 

Rule. By statute, they apply to "any patient" in connection with "any program or 

activity" that is "directly or indirectly" assisted by "any Department or agency of 

the United States." 4 It may be, as one commenter stated, that few patients know 

2 65 Fed. Reg. at 82,472. 
 3 "The Financial Impact of Breached Protected Health Inform ation ," ANSI, et al., pp. 20-23 (March 2012). 
 4 42 U.S.C. § 290dd-2{a). 
POWERS 

POWERS PYLES SUTTER & VERVILLE PC - -- ATIORNEYSATLAW- -­

Ms. Cathy J. Friedman 

June 13, 2014 

Page 5 

what Part 2 is, but nearly every patient will be more comfortable and trusting if 

they know that their substance abuse information cannot be used or disclosed 

without their written consent. 

By contrast, the HIPAA Privacy Rule only applies to three types of "covered 

entities" (health plans, health care clearing houses and health care providers) and 

their business associates, and the Rule expressly permits uses and disclosures of 

an indiv idual's health information for broadly defined treatment, payment, and 

health care operations without consent and even over the patient's objections. 5 

The Rule further permits numerous additional unauthorized uses and disclosures 

for special public interest purposes.6 Some of these uses and disclosures (other 

than treatment) are subject to the "minimum necessary" rule which HHS has 

determined must be applied in a manner that is consistent with and does not 

override professional standards and judgment. 7 There is an exception for 

"psychotherapy notes" which cannot be used or disclosed without the patient's 

permission, except in narrow circumstances. 8 It is simply impossible for any 

patient (and most practitioners) to understand what privacy rights patients have 

in a given situation under the Amended HIPAA Privacy Rule. 

The inadequacy of the Amended HIPAA Privacy Rule was partia lly 

addressed by Congress in the HITECH Act of 2009 which restricted some 

unauthorized uses and disclosures, restored the patients' right to prohibit 

disclosures for payment and health care operations without consent if they paid 

out of pocket and expressly stated that privileges (like the psychotherapistpatient privilege recognized by the Court in Jaffee) would remain available to 

individuals. 9 Unfortunately, these revisions made the HIPAA Privacy Rule even 

more uninte lligible to patients and providers . 

5 45 C.F.R. § 160.102 ; 164.506(a). 6 45 C.F.R § 164.5 12. 7 45 C.F.R. § 164.502(b); 67 Fed. Reg. at 53,197 (Aug. 14, 2002). 8 45 C.F.R. § 164.508(a)(2). 9 HITECH Act, sections 13,405(a); 13,421(c). 
POWERS 


POWERS PYLES SUTTER &VERVILLE PC --- ATTORNEVSATI.AW -- ­

Ms. Cathy J. Friedman 

June 13, 2014 

Page 6 

The confusion in the HIPAA Privacy Rule was created when the Bush 

Administration reversed a determination by the Clinton Administration to have 

the HIPAA Privacy Rule be consistent with centuries of professional ethics. The 

Original Health Information Privacy Rule issued by the Clinton Administration in 

2000 acknowledged that the right of consent for uses and disclosures is 

recognized in most standards of ethics and has been the established practice in 

the United States.10 The Bush Administration reversed this determination in 2002 

and eliminated the right of consent for treatment, payment and health care 

operations, over the strong objections of patient, consumer and practitioner 

organizations and at the behest of the provider community, led by the hospitals. 11 

When practitioner organizations, including APsaA, pointed out that such a 

reversal of privacy policy would put the HIPAA Privacy Rule in direct conflict with 

standards for the ethical practice of medicine and psychiatry, the Bush 

Administration did not deny the conflict, but tried to resolve it by saying that the 

Privacy Rule was intended to be merely a federal "floor" of privacy protections 

and was not even intended to serve as "best practices." 12 We heard commentary 

in the Listening Session from representatives of health information exchanges 

who said they were diligently designing their systems to comply with only this 

"floor" of protections. So experience has shown that the "floor" of federal 

privacy protections has also become the "ceiling." Hopefully, this is not a result 

that SAMHSA would support for the privacy of substance abuse information. 

If SAMHSA were to modify the Part 2 rule to provide that it only applies to 

"specialty substance abuse services," most patients (and many providers) will not 

be able to distinguish between "specialty" providers and non-specialty providers. 

The net result will be a further erosion of trust by patients and more uncertainty 

for providers. 

10 65 Fed. Reg. at 82,472, 82,474 (Dec. 28, 2000). 
 11 67 Fed. Reg. at 53,2 10. 
 12 67 Fed. Reg. at 53,212. 

POWERS 

POWERS PYLES SUTTER & VERVILLE PC --- ATIORNEVSATLAW--­

Ms. Cathy J. Friedman 

June 13, 2014 

Page 7 

Finally, sending a strong and clear message to the provider, vendor and 

health information exchange communities that SAMHSA plans to uphold the 

privacy protections of patients that are consistent with established standards of 

ethics will expedite the development of technologies that preserve and protect 

rather than destroy patients' privacy rights. The longer SAMHSA hints that it may 

be willing to "update" privacy protections to accommodate the interests of ACOs 

and health homes, the more development of essential technologies required by 

law will be delayed. As I stated, our objective should be to develop technologies 

that address patient expectations and facilitate the ethical practice of medicine 

and psychiatry rather than try to shape patient expectations and ethica l standards 

to fit the current capabi lities of the latest health delivery model. 

3. 	 The Right to Health Information is a Fundamental Right That Is 

Essential For Quality Substance Abuse Treatment. 

HHS determined when the Original HIPAA Privacy Rule was issued that 

"[p]rivacy is a fundamental right," "is one of the key values on which our society is 

built," and "is also necessary for the effective delivery of health care, both to 

individuals and to populations." 13 HHS further noted that "there is significant 

intrusion when records reveal detai ls about a person's mental state, such as 

during treatment for mental health." And further that, if "the right to be let 

alone" means anything, then it likely applies to having outsiders have access to 

one's int imate thoughts, words, and emotions" (citing the Supreme Court's 

hold ing in Jaffee).14 

HHS also noted that "few experiences are as fundamental to liberty and 

autonomy as maintaining control over when, how, to whom, and where you 

disclose personal material." 15 So, as I stated during the Listening Session, 

consent=control=privacy=liberty. If you have no right of consent, you have no 

13 65 Fed. Reg. at 82,464, 82,467 . 14 65 Fed. Reg. at 82,464. 

15 ).g. 
POWERS 

---

POWERS PYLES SUTTER & VERVILLE PC ATTORNE'ISATlAW ---

Ms. Cathy J. Friedman 

June 13, 2014 

Page 8 

control over your personal health information. If you have no control over the 

disclosure of that information, you have no privacy, and if you have no privacy, 

you have no liberty. Surely patients suffering from substance abuse, who are 

competent, deserve to have their liberty protected. 

Do not hesitate to contact me if APsaA can be of further assistance. 

Very truly yours, 

James C. Pyles 

Counsel 

American Psychoanalytic Association 

Attachment 
 

 

Should SAMHSA “update” substance abuse regulations by narrowing patient 

privacy rights to reduce the “burdens” ACO’s and Patient-Centered Medical 

Homes? 

APsaA’s answer is “No” for the following reasons: 

1. SAMHSA should put the interests of patients first because these 

“stakeholders” have the most at stake.
 

2. SAMHSA should help ACO’s and health homes comply with privacy laws, 

patients’ privacy expectations and standards of professional ethics rather 

than helping them violate those laws, expectations and ethics. 

3. Such a change is not supported by the substance abuse statute which 

provides a right of consent for the disclosure of substance abuse 

information “in connection with the performance of any program or activity 

relating to” federal assisted substance abuse “education, prevention, 

training, treatment, rehabilitation or research”. 

4. As recognized by the Supreme Court and over 400 federal court decisions 

over the last 15 years, effective mental health and substance abuse 

treatment is based on a relationship of trust between the patient and the 

practitioner, and minimizing privacy protections would erode that trust. 

5. Narrowing the consent requirements under the substance abuse privacy 

rule would add to the confusion that already exists among the public and 

practitioners—the HIPPA Privacy Rule initially complied with professional 

ethics but after the changes by the Bush Administration does not based on 

the argument that HIPAA is only a “floor” of federal privacy protections. 

6. We are in the midst of an epidemic of electronic health information privacy 

breaches with more than 31 million Americans having had their health 

privacy breached since 2009. Two-thirds of Americans are concerned that 

their health information privacy will be breached electronically and 97% of 

the public believes their health information should only be disclosed with 

their consent. 
7. Electronic health information systems cannot be made secure. 

8. The standards of professional ethics of APsaA, the APA and NASW all 

require patient consent for the disclosure of personal mental health 

information. 

9. A patient-practitioner privilege has been recognized by the Supreme Court 

at the federal level and by all 50 states, and the HITECH Act confirmed that 

such privileges are not waived. This privilege can only be waived by the 

patient except in emergencies to prevent death or injury. 
 

 


 


 


 

1
 

Should SAMHSA “Update” Substance Abuse Regulations
 

By Narrowing Patient Privacy Rights To Reduce 

The “Burdens” ACO’s And Patient-Centered Medical Homes?
 

APsaA’s answer is “No” for the following reasons: 

1. SAMHSA should put the interests of patients first because these 

“stakeholders” have the most at stake.
 

2. SAMHSA should help ACO’s and health homes comply with privacy laws, 

patients’ privacy expectations and standards of professional ethics rather 

than helping them violate those laws, expectations and ethics. 

3. Such a change is not supported by the substance abuse statute which 

provides a right of consent for the disclosure of substance abuse 

information “in connection with the performance of any program or activity 

relating to” federal assisted substance abuse “education, prevention, 

training, treatment, rehabilitation or research”. 

4. As recognized by the Supreme Court and over 400 federal court decisions 

over the last 15 years, effective mental health and substance abuse 

treatment is based on a relationship of trust between the patient and the 

practitioner, and minimizing privacy protections would erode that trust. 

5. Narrowing the consent requirements under the substance abuse privacy 

rule would add to the confusion that already exists among the public and 

practitioners—the HIPPA Privacy Rule initially complied with professional 

ethics but after the changes by the Bush Administration does not based on 

the argument that HIPAA is only a “floor” of federal privacy protections. 

6. We are in the midst of an epidemic of electronic health information privacy 

breaches with more than 31 million Americans having had their health 

privacy breached since 2009. Two-thirds of Americans are concerned that 

their health information privacy will be breached electronically and 97% of 

the public believes their health information should only be disclosed with 

their consent. 
2
 

7. Electronic health information systems cannot be made secure. 

8. The standards of professional ethics of APsaA, the APA and NASW all 

require patient consent for the disclosure of personal mental health 

information. 

9. A patient-practitioner privilege has been recognized by the Supreme Court 

at the federal level and by all 50 states, and the HITECH Act confirmed that 

such privileges are not waived. This privilege can only be waived by the 

patient except in emergencies to prevent death or injury. 
POWERS 

POWERS PYLES SUTTER & VERVILLE PC ---- ATTORNEYSATLAW ----

June 27, 2014 

Ms. Cathy J. Friedman 

SAMHSA Public Health Analyst 

Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

Re: Further Comments on Confidentiality of Alcohol and Drug Abuse Patient 

Records-79 Fed. Reg. 26929, FR Doc. 2014-10913 

Dear Ms. Friedman: 

Please accept the following comments to supplement the comments of the American 

Psychoanalytic Association filed with SAMHSA on June 11 and 13 and the oral comments I 

presented at the Listening Session on June 12. Several recent developments add important 

evidence to the points that we made that health information privacy remains a basic right of all 

competent Americans even in the digital age, that honoring and respecting a patient's right to 

privacy will always be less efficient than ignoring that right, and that health information 

technology is raising threats to the quality of health care. 

On June 25, the Supreme Court issued its decision in Riley v. California and U.S. v. Wurie. 

The Court held unanimously in both cases that the police must obtain a warrant before 

searching someone's cellphone incident to an arrest because: 

Mobile application software on a cell phone, or "apps," offer a range of 

tools for managing detailed information about all aspects of a person's 

life. There are apps for Democratic Party news and Republican Party 

news; apps for alcohol, drug, and gambling addictions; apps for sharing 

prayer requests; apps for tracking pregnancy symptoms; apps for 

planning your budget; apps for every conceivable hobby or pastime; apps 

for improving your romantic life. Decision p. 20 (emphasis supplied). 

So, information about an individual's alcohol and drug additions are the very types of 

information the Court found to be included in the individual's right to privacy protected by the 

Constitution. 

Further, the Court also noted that "[a]n Internet search and browsing history, for 

example, can be found on an Internet-enabled phone and could reveal an individual's private 

interests or concerns-perhaps a search for certain symptoms of disease, coupled with 

frequent visits to WebMD." Decision at p. 20 (emphasis supplied). Finally, the Court noted 

that, while generally the Court applies a balancing test to determine whether a search is 

1501 M STREET, NW • SEVENTH FLOOR • WASHINGTON, DC 20005 • PH 202.466.6550 • FX 202.785,1756 • WWW.PPSV.COM 
POWERS 

POWERS PYLES SUTTER & VERVILLE PC --- ATIORNEYSATLAW ---

Ms. Cathy J. Friedman 

June 27, 2014 

Page 2 

"unreasonable" under the Fourth Amendment, it rejected a balancing test because of the type 

and volume of information that can be compiled in a cell phone and held "that officers must 

generally secure a warrant before conducting such a search." Decision at pp. 9-10. 

The Court also acknowledged that respecting the privacy rights of individuals would 

impede certain societal interests, such as fighting crime. But the Court found: 

Our cases have recognized that the Fourth Amendment was the founding 

generation's response to the reviled "general warrants" and "writs of 

assistance" of the colonial era, which allowed British officers to rummage 

through homes in an unrestrained search for evidence of criminal 

activity. 

So the Court confirmed that society's interest in efficiency must give way to the individual's 

right to privacy. 

Finally, a recent study adds to findings of an Institute of Medicine study that electronic 

health records are adding medical errors which are not being reported. See "An Analysis of 

Electronic Health Record-Related Patient Safety Concerns," Meeks, DW, et al., Journal of the 

American Medical Informatics Association {April 2014}. Finding: 

EHR-related safety concerns involving both unsafe technology and unsafe 

use of technology persist long after 'go-live' and despite the sophisticated 

EHR infrastructure represented in our data source. Currently, few 

healthcare institutions have reporting and analysis capabilities similar to 

the VA. 

While it is unclear whether electronic health information systems will ever fulfill their 

promise of better health care at lower cost, it is clear that they are not capable of providing 

those results today or in the foreseeable future. Accordingly, it is not sound health policy to 

diminish the traditional privacy rights and expectations of patients in order to facilitate the 

interests of new and unproven health delivery models to make broader use of unreliable 

electronic health information systems. 

Very truly yours, 

James C. Pyles 

On behalf of the American Psychoanalytic 

Association 
 

 

 

 

 

 

 

 

 

 

 

To Whom it May Concern: 

Thank you for the opportunity to provide comments as a result of the listening session that you 

arranged. These are the comments I made during the call. 

If additional clarification is needed, please contact me. 

Laura H. Tyler, PhD, LPC 

Administrator 

Psychiatric Research Institute 

4301 W. Markham, Slot #554 

Little Rock, AR 72205-7199 

501-526-8100 office

501-526-8199 fax

www.psychiatry.uams.edu

42 CFR, Part 2 Public Listening Session 

June 11, 2014 

a. Applicability of 42 CFR Part 2

Laura H. Tyler – University of Arkansas for Medical Sciences’ Psychiatric Research Institute 

Thank you... 

Patient protection or safety is the principle that underlines 42 CFR Part 2. Rather than offering varying 

definitions of “program”, it would be more patient-centric to offer choice by utilizing informed 

consent. Via a formal informed consent, a patient could agree to a treatment program that includes an 

integrated approach. By having the patient consent to integrated treatment including an authorization 

to disclose drug and alcohol records to the EHR, the patient could choose the condition that care would 

be integrated. The treatment program would still have to be HIPAA compliant with regard to 

Treatment, Payment and Operations and information could only be shared within the care system on a 

“need to know” basis. This could substantially improve patient access to integrated care and the 

capacity to have an integrated EHR in a program setting that was part of a larger system such as an 

academic medical institution. 

Further defining “program” would have the unintended consequence of preventing integration in 

complex treatment facilities that offer a wide array of screening, assessments, pre-treatments, brief 

interventions as well as a full continuum of services. Privacy protections should be afforded to the 

patient and managed by them. For example, a patient who is pregnant and diagnosed with a substance 

abuse disorder should be able to choose integrated care in a setting that best meets her preferences 

and needs. The patient should be allowed to “set aside” the inherent restrictions in 42 CFR Part 2 in 

favor of their choice to select a comprehensive provider who can address their holistic needs. Patient 
safety is compromised when information is segmented. Regardless of setting, the patient should be 

given the choice to have their information integrated within a system and included in an EHR. 

This approach would still require the management of Part 2 re-disclosure; however, this could be 

addressed with some expansion of the Qualified Service Organization agreements. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

e. Qualified Service Organization Agreement

Laura H. Tyler – University of Arkansas for Medical Sciences’ Psychiatric Research Institute where I serve 

as the Administrator 

Flexibility and simplicity are missing in 42 CFR Part 2 when it comes to management of the redisclosure 

of information in an environment that is increasingly electronic and individuals are increasingly being 

viewed holistically. This lack of flexibility produces barriers for patients who desire to access care as well 

as among independent providers and other stakeholders who are seeking to work collaboratively on 

behalf of a shared patient. Part 2 makes it more difficult to achieve care coordination, measure 

quality/or outcomes and receive payment. Part 2 segments the patient population it is intended to 

protect and reinforces stigma. 

If extensive overhaul of the law is not possible, there is a need for broader and more simplistic use of 

QSOAs or combined QSOAs/BAAs. The QSOA is a two-way agreement as described by the FAQs. This is 

unnecessarily constraining. Expanding the ease of use of an HIO via a website notification of the HIO’s 

members and QSOAs would expedite information exchange and ease administrative and financial 

burden associated with serving individuals with substance use disorders. Ways to more globally expand 

the use of the HIO/exchange and allow multiple-party consent are needed. Uses of QSOAs need to 

consider how to facilitate safe and less complex exchange of information thereby enhancing integration 

of care, access to care and care quality. There is also a need for revisions that have the effect of 

reducing barriers to information exchange and eliminate the need to create and maintain costly 

duplication in documentation systems. In essence, more practical approaches are needed that give 

patients more choice in how they manage their information. 

In focus groups that we held related to integration within an EHR, the vast majority of patients within 

our covered program identified their desire to have more flexibility to broadly share information to 

facilitate coordinated and safer care. Patients have asked how they could waive their protections 

related to redisclosure. Patients should be allowed to opt in and consent to set aside prohibitions on 

redisclosure. 

If broad revisions are not possible to accomplish inclusion, it is critical that more technologically friendly 

methods such as the use of a website for a list of current and future QSOAs be allowed in lieu of 

individual notices and consents for any change in QSOAs. 

Thank you for exploring ways to bring the law and current technological advancements and integration 

of care models more in synch. Ultimately, this will reduce stigma, improve access to care and enhance 

outcomes for individuals who deserve quality care that is integrated. 

Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the

intended recipient(s) and may contain confidential and privileged information. Any unauthorized 

review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please 

contact the sender by reply e-mail and destroy all copies of the original message. 
 

 

 

 

It is important to disclose substance abuse history to medical professionals as research, 

including research conducted in my own lab, has revealed that such history may have 

lasing implications in terms of immune response. It is also important that patient rights 

and privacy are maintained when sharing this information as substance abuse is still 

stigmatized by many. In my opinion, the current CODE OF FEDERAL REGULATIONS 

regarding PART 2—CONFIDENTIALITY OF ALCOHOL AND DRUG ABUSE PATIENT 

RECORDS adequately provides researchers and medical professionals access to 

patient information while still ensuring the patients right to privacy. It is important that as 

researchers, we follow the regulations set out for RESEARCH ACTIVITIES and ensure 

that our personnel are aware of issues of confidentiality. Further, it is important that we 

do our best to ensure that or employees and those with access to sensitive information 

are individuals of good judgment. 

Submitted respectively, 

Sulie L. Chang, Ph.D. 

Professor of Biological Sciences/Neuroscience 

Director, Institute of NeuroImmune Pharmacology 

Seton Hall University 

South Orange, NJ 07079 

office: 973 761 9456 

cell: 973 432 2073 

fax: 973 275 2489 

e-mail: sulie.chang@shu.edu 
 

 

 

 

 

 

 

 

 

 

Regarding: 

Agency: HHS Substance Abuse and Mental Health Services Administration 

Docket number: 2014-10913 

It looks like the proposed rule changes will substantially reduce the privacy and confidentiality of personal 

medical records. This is especially troubling in light of the current movement toward electronic health 

records. Once a piece of data gets onto the Internet, the World Wide Web, or other electronic systems, 

all control of who has access to that data is lost. This is the situation whether the access is intended (by 

health care providers or organizations) or unintended (by hackers, the NSA, or any criminal / snooping 

entity). 

Therefore I oppose these rule changes. Please: Protect the privacy of my medical records by 

abandoning these proposed rule changes. 
 

 

 

 

 

 

 

 

 

 

Hello – 

I tried to get into the queue to comment on the below during your call – please feel free sharing this 

openly. 

Jeff Livesay 

Associate Director 

Michigan Health Information Network Shared Services 

Admin Support: bom@mihin.org: Phone: 517-336-1431 

120 West Saginaw Hwy 

East Lansing, MI 48823 

Mobile: 248-802-8844 (24 x 7) 

Email: livesay@mihin.org 

Web: www.mihin.org 

Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain 

confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended 

recipient, please contact the sender by return e-mail and destroy all copies of the original message. 

From: Jeff Livesay 

Sent: Wednesday, June 11, 2014 11:00 AM 

To: 'Tatiana Melnik'; tim.pletcher@cmich.edu 

Cc: PracticeGroups@healthlawyers.org 

Subject: New Michigan Law and standard consent form: RE: SAMHSA Issues Notice of Public Listening 

Session on 42 C.F.R. Part 2, the Confidentiality of Alcohol and Drug Abuse Patient Records Regulations 

Importance: High 

Hi, 

I am having trouble with the SAMHSA webinar today but understand some states such as Illinois are 

trying to develop a statewide standard consent form for this type of information. 

Michigan has successfully created such a form and 3 weeks ago Governor Snyder signed into law a 

Public Act requiring that it be implemented by January 1, so now we are working on the statewide 

education and rollout plan. 

Attached is a presentation made last week by four of the leaders on this effort – from the slide showing 

the participants, you can see this was truly a statewide effort. I was the co-chair of the Privacy Working 

Group that carried this through for Gov. Snyder’s HIT Commission, and our Lt. Governor was also 

integral to the effort with Judge Curtis Bell from a Diversions perspective. Senator Jim Marleau, Chair of 
 

 

 

 

 

 

 

our Senate Health Policy Committee, was the legislative champion. This level of support is key for 

getting this type of legislation passed. 

Please feel free to share the attached presentation, which contains the current draft of the standard 

consent form, with anyone you wish. 

Best regards, 

Jeff Livesay 

Associate Director 

Michigan Health Information Network Shared Services 

Admin Support: bom@mihin.org: Phone: 517-336-1431 

120 West Saginaw Hwy 

East Lansing, MI 48823 

Mobile: 248-802-8844 (24 x 7) 

Email: livesay@mihin.org 

Web: www.mihin.org 

Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain 

confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended 

recipient, please contact the sender by return e-mail and destroy all copies of the original message. 

From: Tatiana Melnik [mailto:tatiana@melniklegal.com] 

Sent: Wednesday, May 14, 2014 9:18 PM

To: tim.pletcher@cmich.edu; Jeff Livesay 

Subject: FW: SAMHSA Issues Notice of Public Listening Session on 42 C.F.R. Part 2, the Confidentiality of 

Alcohol and Drug Abuse Patient Records Regulations 

Hi Tim and Jeff: 

In case you haven’t heard, please note the below and forward it to others as appropriate. The Part 2

regulations haven’t been touched since 1987, so this would be a good time to give SAMHSA input. 

Tatiana

Tatiana Melnik, Attorney 

Helping companies and individuals protect their data and information. 

*technology. *healthcare IT. *privacy. *security. *intellectual property.

Melnik Legal PLLC | Tampa, FL 33615 | Admitted in FL and MI

(734) 358-4201 | tatiana@melniklegal.com | http://www.melniklegal.com

From: Behavioral Health Task Force Leadership [mailto:PracticeGroups@healthlawyers.org] 

Sent: Wednesday, May 14, 2014 5:34 PM 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

To: tatiana@melniklegal.com 

Subject: SAMHSA Issues Notice of Public Listening Session on 42 C.F.R. Part 2, the Confidentiality of 

Alcohol and Drug Abuse Patient Records Regulations 

To: Behavioral Health Task Force Members 

From: Behavioral Health Task Force Leadership 

Jack Dempsey, Co-Chair 

Gerald "Jud" DeLoss, Co-Chair 

Teresa Meinders Burkett, Vice Chair of Membership 

David Humiston, Vice Chair of Strategic Activities 

Kristen McDermott Woodrum, Vice Chair of Educational Programs 

Suzanne Scrutton, Vice Chair of Publications 

Barbara Zabawa, Vice Chair of Research and Website 

Date: May 14, 2014 

SAMHSA Issues Notice of Public Listening Session on 

42 C.F.R. Part 2, the Confidentiality of Alcohol and 

Drug Abuse Patient Records Regulations 

By Barbara Zabawa* 

The federal rules that govern the use and disclosure of alcohol and drug 

abuse records (AODA record rules) have not been touched since 1987, 

despite the substantial revolution in health care technology, payment, 

and delivery. 

Recognizing these changes and even more on the horizon, on Monday, 

May 12 the Substance Abuse and Mental Health Services Administration 

(SAMHSA) within the U.S. Department of Health & Human Services 

issued notice of a public listening session to obtain input from 

stakeholders on updating the federal AODA record rules. In the notice of 

the listening session, found at 79 Fed. Reg. 26929 (May 12, 2014), 

SAMHSA hints at a future rulemaking and desires all interested parties 

to share their views prior to such a rulemaking. 

There are two primary driving forces behind the listening session and 

future rulemaking: (1) integrated and coordinated care initiatives, such 

as accountable care organizations or health information exchange (HIE) 

organizations; and (2) electronic health record (EHR) systems. Both of 

these forces in health care have the potential for greater sharing of 

information, including AODA records. The current AODA record rules 

create difficulties to accomplish the goals of coordinated care and EHR 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

systems. Specifically, the AODA record rules apply to federally funded 

individuals or entities that "hold themselves out as providing and 

provide, alcohol or drug abuse diagnosis, treatment or treatment 

referral," including units within a general medical facility that hold 

themselves out as providing diagnosis, treatment, or treatment referral. 

As more substance abuse treatment is provided in general health care 

settings, it is difficult to determine whether the AODA record rules apply 

to the myriad of health care organizations involved in coordinated care 

efforts. 

Furthermore, the current rules have strict consent requirements that 

prohibit listing future un-named providers on the consent form. Each 

time a new provider joins coordinated care organizations, the 

organization needs to update the consent form. 

The strict redisclosure provision of the current rule forces most EHR 

systems to separate AODA records from the rest of the patient's medical 

record or apply the AODA record protections to the entire medical 

record. Either approach may stifle efforts to share important information 

between care providers and improve patient outcomes. 

Sharing AODA records for purposes of care coordination and population 

management also is restricted by the current AODA record rules. The 

current rules prohibit the sharing of AODA records for these purposes 

without consent. 

Finally, the current AODA record rules limit the ability of payers, HIEs, 

and care coordination organizations to use AODA records for research, 

audit, or evaluation purposes, functions of growing importance as the 

health care sector moves toward using health information to improve 

health care quality and outcomes. 

The overarching concern with regard to any updates to the AODA record 

rules is ensuring that the rules continue to adequately protect patient 

privacy. SAMHSA indicates its wish is to facilitate information exchange 

while respecting the legitimate privacy concerns of patients due to the 

potential for discrimination and legal consequences of sharing sensitive 

AODA information. SAMHSA realizes that protecting the confidentiality of 

AODA records is still necessary so that patients feel free to seek 

treatment without fear of compromising their privacy. 

To find the appropriate balance between sharing AODA records and 

protecting patient privacy, SAMHSA welcomes attendance at the 

listening session, to be held on Wednesday, June 11 from 9:30 am to 

4:30 pm, either in person or via webcast. In addition, SAMHSA invites 

comments regarding the need for updates to the AODA record 

rules. Learn more about the listening session and the areas SAMHSA 

invites for comment. 

 


 

*We would like to thank Barbara J. Zabawa (WPS Health Insurance,

Monona, WI) for authoring this email alert.

The Behavioral Health Task Force is supported by the following work 

groups: Military/Veterans; Payers; Providers/Clinicians; Risk 

Management; Rural; and State/Government. 

Member benefit educational opportunity: 

Participate in the webinar about acute and post-acute relationships in an 

ACO world: the devilish details (May 22). 

Disclaimer: The information obtained by the use of this service is for reference use only and does not 

constitute the rendering of legal, financial, or other professional advice by the American Health Lawyers 

Association. 

© 2014 American Health Lawyers Association 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The Substance Abuse and Mental Health Services Administration
 

Public Listening Session Comment Template
 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2
 
 

This document is meant to provide the public with a simple and organized way to submit comments on the 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2, and respond to questions 

presented in meeting notice which is published in the Federal Register at 79 FR 26929. While use of this document is 

entirely voluntary, commenters may find it helpful to organize their comments. 

This document alone is not intended to provide a full and complete opportunity to comment on all of the provisions 

within the regulation. Please keep in mind that it only reflects those topics included in the meeting notice and a section 

for “other” comments. 

To be considered, all comments (including comments provided through this document) must be submitted according to 

the instructions in the meeting notice: https://www.federalregister.gov/articles/2014/05/12/2014-

10913/confidentiality-of-alcohol-and-drug-abuse-patient-records. 

Applicability of 42 CFR Part 2 

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. Covered information could 

be defined based on what substance abuse treatment services are provided instead of being defined by the type of 

facility providing the services. 

FR Citation: 79 FR 26930 

Questions: 

• How would redefining the applicability of 42 CFR Part 

CCOs, HIT vendors, etc.? 

• Would this change address stakeholder concerns? 

• Would this change raise any new concerns? 

2 impact patients, health care provider organizations, HIEs, 

Public Comment Field: 

I believe it is vital to keep protecting the confidentiality of persons receiving AOD (SUD) treatment under 42 CFR Part 2. 

County entities tend to serve those whose voice is compromised (e.g. mandated treatment, multiple systems involved) and 

so it is understandable that they would propose lighter restrictions for ease of information flow between providers and 

other practitioners, etc. However, instead of it being a stigma issue, I would argue that these protections increase safety for 

more people to seek services, especially for employees or professionals. Further, electronic health records are not secure, 

no matter what “protections” are in place – those with AOD disorders need to be informed, and consent to, this 

information release. 

HIPAA’s sanctions have become horrendous – throwing AOD under this would make it even less attractive to enter this 

(or any) health field and make fewer persons want to open a business serving this population. One breach (recent 

example: $1 million fine for the front desk failing to check the ID of expected auditors) can take a substance abuse facility 

or a small community clinic down. 

For example, I had maybe 2-4 visits with a mental health provider (related to a major decision as to whether to move 

abroad and possible change citizenship status) within my large health provider network (Kaiser) in 2003 or 2004. For this, 

they gave me the diagnosis of “depression.” However, this is still listed as a “chronic” condition on my health record even 

though I have not had any related services since then. They have also not honored my request to remove this. Imagine if 

this was for an AOD disorder! Impossible – I would never go to my health provider for this type of service based on this 

experience. I would go to a private entity and pay out of pocket. However, some people might not have the option to see a 

private provider based on cost. I might consider using my insurance only if I could be guaranteed confidentiality in my 

health record, through 42 CFR Part 2. 

Page 1 of 5 
 

 

 

 

 

 

 

 

 

 

 

 

 

Consent Requirements 

While technical solutions for managing consent collection are possible, SAMHSA is examining the consent requirements 

in § 2.31 to explore options for facilitating the flow of information within the health care context while ensuring the 

patient is fully informed and the necessary protections are in place. Specifically, we are analyzing the current 

requirements and considering the impact of adapting them to: 

1. Allow the consent to include a more general description of the individual, organization, or health care entity to which 

disclosure is to be made. 

2. Require the patient be provided with a list of providers or organizations that may access their information, and be 

notified regularly of changes to the list. 

3. Require the consent to name the individual or health care entity permitted to make the disclosure. 

4. Require that if the health care entity permitted to make the disclosure is made up of multiple independent units or 

organizations that the unit, organization, or provider releasing substance abuse related information be specifically 

named. 

5. Require that the consent form explicitly describe the substance abuse treatment information that may be disclosed. 

FR Citation: 79 FR 26931 

Questions: 

• Would these changes maintain the privacy protections for patients? 

• Would these changes address the concerns of HIEs, health homes, ACOs, and CCOs? 

• Would these changes raise any new concerns? 

Public Comment Field: 

1. No 

2. No 

3. Yes, and to whom 

4. No 

5. Yes 

Again, unless there is a clear distinction of who the information may go to, there is no protection. If at all, I believe information 

should only be limited to the physician or provider (not nurses) without an explicit consent in place. 

The only possible exception is a centralized list of medications and a medication history across HIEs, health homes, ACOs, and 

CCOs – this is important to avoid drug-seeking behavior and over medication for the AOD population, but all 

behavioral/health and PHC clients. 

Redisclosure 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on redisclosure only applies to 

information that would identify an individual as a substance abuser, and allows other health-related information shared 

by the Part 2 program to be redisclosed, if legally permissible. This would allow HIT systems to more easily identify 

information that is subject to the prohibition on redisclosure enabling them to utilize other technological approaches to 

manage redisclosure. If data are associated with information about where the data were collected (data provenance) 

which reveals that the data were collected by a practice that exclusively treats addiction, the data would still be 

protected under the proposed change. 

FR Citation: 79 FR 26931 

Page 2 of 5 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

Questions: 

• Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 in an EHR or HIE 

environment? 

• Would these changes maintain the privacy protections for patients? 

Public Comment Field: 

Yes. But the concern is that the exception would be overlooked, especially by those not in the substance abuse field. 

Medical Emergency 

SAMHSA is considering adapting the medical emergency exception to make it more in-line with the statutory language 

and to give providers more discretion as to when a bona fide emergency exists. For example, amending this standard to 

allow providers to use the medical emergency provision to prevent emergencies or to share information with a 

detoxification center when a patient is unable to provide informed consent due to their level of intoxication. 

FR Citation: 79 FR 26931 

Questions: 

• What factors should providers take into consideration in determining whether a medical emergency 

• Are there specific use cases SAMHSA should take into consideration? Show citation box 

• Are there patient concerns about the impact of this change on their privacy? 

exists? 

Public Comment Field: 

Agree. Medical emergency = when there is a serious threat to safety of self/others. This includes overdose or severe withdrawal, 

where risk of seizures, hallucinations, chronic lack of sleep (several days), etc. 

NOTE: Postpartum psychosis is always a medical emergency due to the high risk of suicide (5%) and infanticide (4%). See Postpartum 

Support International and any reference document on this. This should extend to mood disorders as postpartum psychosis is of a 

manic quality. This has implications for perinatal substance abuse treatment. 

Privacy goes under the bus to save a life. However, re-disclosure should be limited to stabilization of the emergency only. 

Qualified Service Organization (QSO) 

SAMHSA is analyzing the regulations to identify options for allowing Part 2 data to flow to health care entities for the 

purpose of care coordination and population management while maintaining patient protections. One potential solution 

includes expanding the definition of a qualified service organization (QSO; § 2.11) to explicitly include care coordination 

services and to allow a QSO Agreement (QSOA) to be executed between an entity that stores Part 2 information, such as 

a payer or an ACO that is not itself a Part 2 program, and a service provider. 

FR Citation: 79 FR 26931 

Questions: 

• Are there other use cases we should be taking into consideration? 

• Are there specific patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

PHI is not safe. It is leaky at best, even with encryptions in place. It’s a slippery slope. 

I am very concerned that this will include County databases that may expose data to CPS and probation entities 

healthcare entities, especially for those with co-occurring disorders. 

in addition to 

Page 3 of 5 
 

 

 

 

 

 

 

 

Qualified Service Organization (QSO) 

There are HIPAA breaches reported frequently, from STD status to health records, blasted on Face book by employees who should 

know better. AOD information has potential serious consequences (“bad” vs. “sick” to those not in the AOD field), more so than any 

other health condition, including mental health (“sick” vs. “bad”). This cannot be overlooked. I have seen AOD information affect the 

treatment of health providers who are in recovery by other health providers who are not. Remember, people in recovery are doctors 

and lawyers too! 

Even 12-Step meetings have a guideline (tradition) that protects anonymity. 

Research 

SAMHSA is considering expanding the authority for releasing data to qualified researchers/research organizations to 

health care entities that receive and store Part 2 data, including third-party payers, health management organizations, 

HIEs, and care coordination organizations. 

FR Citation: 79 FR 26932 

Questions: 

• Are there factors that should be considered related to how current health care entities are organized, how they 

function or how legal duties and responsibilities attach to entities that make up an umbrella organization? 

• Would this change address concerns related to research? 

• Are there specific privacy concerns associated with expanding the authority or releasing data to qualified 

researchers/research organizations in this way? 

• Are there additional use cases that should be considered in the research context? 

Public Comment Field: 

Audits and specific research is already covered under 42CFR part 2 so I am not sure why this additional permission is necessary, 

except as it pertains to the QSO which I believe compromises health data (see above). 

There are so many layers of administration already over services provided. I see this as potentially opening the door toward 

providers having to use a variety of scales (according to different agendas) that will further reduce actual services being provided 

and increase the administrative load. 

Addressing Potential Issues With Electronic Prescribing and Prescription Drug Monitoring Programs (PDMPs) 

Part 2 protections include a prohibition on the redisclosure of information received directly from a Part 2 program. A 

pharmacy that receives electronic prescription information directly from a Part 2 program must obtain patient consent 

to send that information to a PDMP, and patient consent is also required for the PDMP to redisclose that information to 

those with access to the PDMP. 

Preamble FR Citation: 79 FR 26932 

Questions: 

• How do pharmacy information system vendors anticipate addressing this issue? Are there specific technology 

barriers SAMHSA should take into consideration? 

• Are there other concerns regarding 42 CFR Part 2 and PDMPs? Please describe relevant use cases and provide 

recommendations on how to address the concerns. 

• Are there patient concerns about the impact of e-prescribing and PDMPs on their privacy? 

Page 4 of 5 
 

 

Research 

Public Comment Field: 

There should be a centralized pharmacy database that is mandatory for all health providers! 

But, this would not require consent but fall under HIPAA already. 

Meaning, surely the Part 2 program should not be the agency releasing this information anyway; rather, it should be the 

doctor/doctor’s office, which is governed by HIPAA? The exception would be a physician employed by a part 2 program but surely 

their health records are already separate from the AOD data? 

Other Comments 

Topic: 

Public Comment Field: 

Please consider all recovery addicts/alcoholics when you decide to compromise privacy. Many stakeholders (the alleged 85% in 

support of change) may not actually be in recovery themselves or even understand the recovery model. Similarly, most health 

practitioners use the medical model and do not understand the social model of recovery. It is easy to be gallant with other people’s 

information but would they use the same measure on themselves? 

Health providers and, especially, insurance providers, are subject to judgment of others too. There are unforeseen repercussions not 

just by the probation and child welfare system. A possible solution: Mandatory CEs for health providers on AOD recovery. 

Medications are a health issue and all Rx meds should be able to be shared. 

Page 5 of 5 
 

 

 

 

 

 

 

 

 

Comments to the Proposed Rule by the Substance Abuse and Mental Health Services 

Administration related to Confidentiality of Alcohol and Drug Abuse Patient Records 

FR Doc. 2014-10913 

As providers of Substance Abuse and Mental Health Services we support changes to Federal Statute 

United States Code, Title 42, section 290dd-2 governing the confidentiality of substance abuse treatment 

information. While confidentiality of information for persons receiving substance abuse treatment is vital 

and should be protected, new models of integrated care to better serve this population are needed. 

Further, the use of electronic medical records and prescription drug programs require sharing of pertinent 

medical information across providers caring for patients. 

Of most concern is the need to achieve better coordination and integration of medical and behavioral 

health care for persons with addiction. Coordinated care programs have demonstrated significant 

efficiency, outcome, and cost benefits and as a provider of such programs, we would like to eliminate 

barriers to delivery models where behavioral health and substance abuse services are coordinated with 

medical care sites. 

a. Applicability of 42 CRF Part 2

The strategy of defining covered information based on what substance abuse treatment services are 

provided, rather than by the type of facility providing the services, may be beneficial to “screening and 

pre-treatment providers” but still represents a challenge to comprehensive providers of substance abuse, 

behavioral health and medical care. Certainly, information privacy can also be separately addressed for 

providers of more complex or specialty care while excluding those involved solely in pre-treatment & 

screening services. 

b. Consent Requirements

Under an integrated care model “future un-named providers” should not apply to members within the 

integrated health care system that become involved with the care of the patient through direct referral of a 

licensed professional and an affiliated care manager. We are in favor of the proposal that Consent 

should include a more general description of the health care entity to which disclosure is to be made and 

that the “individuals” would be restricted to those within the health care system directly involved in the 

patient’s care. Electronic medical records generally do have capabilities of restricting access by 

provider/caregiver and a means to audit who has gained access to an individual’s record. 

The requirement that the patient be provided with a list of providers or organizations that may access their 

information, and be notified regularly of changes to the list, is unwieldy. Rather, a patient should be 

informed that only persons associated with an organization who are directly providing care for a patient 

would have access to their record. Billing and associated back office functions generally have limited 

access to pertinent billing data or data required by law or regulation. 

We agree that the consent form should explicitly describe when substance abuse treatment 

information may be released outside of the treating organization. 
 

 

 

 

 

 

 

 

 

c. Redisclosure

Redisclosure presents problems for integrated health care since data segmentation is the antithesis of 

coordinated care across an integrated health care network. We agree that SAMHSA should clarify that 

redisclosure only applies to information that would identify an individual as a substance abuser, but to 

allow other pertinent health-related information shared by the Part 2 program to be redisclosed to a 

patient’s direct caregivers within the organization. 

d. Medical Emergency

We agree that SMAHSA should amend the standard to allow providers to use the medical emergency 

provision to prevent emergencies or to share information with a detoxification center when a patient is 

unable to provide informed consent due to their level of intoxication. 

e. Qualified Service Organization (QSO)

We support options for allowing Part 2 data to flow to health care entities for the purpose of care 

coordination and population management while maintaining patient protection including expanding the 

definition of a qualified service organization (QSO; § 2.11) to explicitly include care coordination services 

and to allow a QSO Agreement (QSOA) to be executed between an entity that stores Part 2 information, 

such as a payer or an ACO that is not itself a Part 2 program, and a service provider. 

Darleen Won 

Darleen Won 

Director, Population Health 

LifeBridge Health 

2401 West Belvedere Avenue 

Baltimore, MD 21215 

ph: 410-601-8121 

fax: 410-601-6489 

dwon@lifebridgehealth.org 

THE INFORMATION CONTAINED IN THIS MESSAGE IS LEGALLY PRIVILEGED 

AND CONFIDENTIAL INFORMATION INTENDED FOR THE USE OF THE ADDRESSEE LISTED 

ABOVE. 

This record has been disclosed in accordance with Subtitle 3 of 

Title 4 of the Health-General Article of the Annotated Code of 

Maryland. Further disclosure of medical information contained 

herein is prohibited. 

If you are neither the intended recipient nor the individual 

responsible for delivering this message to the intended 

recipient, you are hereby notified that any disclosure of 

patient information is strictly prohibited. If you have received this 

email in error, immediately notify us by telephone or return email. 
 

 

 

I told my male dentist I take methadone for my R/A as a personal choice. The younger the 

Doctor, the more likely they will respond positively to your methadone use. I did not specify my 

dose, and he did not ask. I was given Xanax instead of Vicodin for pain and sleep after each 

extraction. He knew Vicodin would not be effective in methadone users. Also, women doctors 

have 100% responded negatively to my methadone use, even though I have been clean for 5 

years. 

So, request a younger, male doctor, and be prepared to change doctors if you Can't reach a 

respectful relationship. 

You must use common sense in your disclosures. No, I do NOT want my Methadone use in my 

electronic records. It is my decision, not the government. 
 

June 18, 2014 

Kate Tipping 

Public Health Advisor 

Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road, Room 5-1011 

Rockville, MD 20857 

Via email: PrivacyRegulations@SAMHSA.hhs.gov 

42 CFR Part 2 – Confidentiality of Alcohol and Drug Abuse Patient Records 

Dear Ms. Tipping: 

The National Association of Chain Drug Stores (NACDS) thanks the Substance Abuse 

and Mental Health Services Administration (SAMHSA) for conducting a listening 

session to gather stakeholder perspectives in advance of updating the rules under 

42 CFR Part 2 related to the confidentiality of alcohol and drug abuse patient 

records. We appreciate this opportunity to respond specifically to SAMHSA’s 

questions related to potential issues with electronic prescribing and prescription 

drug monitoring programs (PDMPs.) 

NACDS represents traditional drug stores and supermarkets and mass merchants 

with pharmacies. Chains operate more than 40,000 pharmacies, and NACDS’ 125 

chain member companies include regional chains, with a minimum of four stores, 

and national companies. Chains employ more than 3.8 million individuals, including 

175,000 pharmacists. They fill over 2.7 billion prescriptions yearly, and help 

patients use medicines correctly and safely, while offering innovative services that 

improve patient health and healthcare affordability. NACDS members also include 

more than 800 supplier partners and nearly 40 international members representing 

13 countries. For more information, visit www.NACDS.org. 

Over the years, 49 states have enacted laws and/or rules that require pharmacies to 

report prescription information to state PDMPs when dispensing controlled 

substances. Each state’s PDMP laws and/or rules dictate the specific schedules of 

controlled substances that pharmacies must report upon dispensing. Notably, no 

state allows patients to opt out of having a particular prescription medication 

reported to the PDMP. Where language under 42 CFR Part 2 is inconsistent with 

states’ PDMP laws and/or rules in this regard, we encourage SAMHSA to harmonize 

the rules with states’ prescription reporting requirements. 

PDMPs are useful tools for practitioners to identify and prevent misuse and abuse of 

prescription drugs. For this reason, it is imperative that PDMP databases be 

populated with complete and accurate prescription information so that 
 

 

 

 

 

 

 

 

NACDS Comments to SAMHSA 

42 CFR Part 2 – Confidentiality of Alcohol and Drug Abuse Patient Records 

June 18, 2014 

Page 2 

practitioners can make informed healthcare decisions for their patients. This holds
­

true for the provision of quality care to patients undergoing substance abuse
­

treatment.
­

Excluding controlled substances prescriptions written as part of substance abuse
­

treatment services from PDMP reporting undermines the effectiveness of PDMPs
­

and practitioners’ ability to use the information within these programs to the
­

benefit of their patients. During the June 11 listening session that SAMHSA
­

conducted on 42 CFR Part 2, it was noted repeatedly that patients can be reluctant
­

to share their full prescription history with their healthcare providers out of fear of
­

the stigma associated with taking certain medications used in substance abuse
­

treatment. However, this information is critical for practitioners to have so that they
­

can provide the best care possible to their patients. In addition, in most cases,
­

pharmacies do not know a patient’s diagnosis, so it would be impossible for a
­

pharmacy to know when a medication is being used for substance abuse treatment.
­

NACDS thanks SAMHSA for considering our comments regarding updates to 42 CFR 

Part 2. Please do not hesitate to contact me at 703-837-4183 or
­

knicholson@nacds.org if we can provide any further insight or assistance on this
­

matter.
­

Sincerely,
­

Kevin N. Nicholson, R.Ph., J.D.
­

Vice President, Public Policy and Regulatory Affairs
­
 

I am the chair of the board of directors for a 300-employee mental health system and have 

continuing contact with staff and with people in the surrounding communities. As compared to 

20-30 years ago, I find that even new employees are highly sensitized to the issue of patient 

privacy. This has been part of their training and the culture of the organization reinforces this 

training. Privacy for people seeking mental health and substance abuse treatment seems to be a 

common value even beyond the service organization -- in other agencies and even among 

community members. It is very rare that we ever encounter a privacy incident with a patient. All 

these observations have convinced me that privacy regulations can be modified where it will be 

in the interest of stronger, more efficient services. 

Jerry Evans, Ph.D. 

Director of Research & Evaluation 

Community Health Initiatives 

309 Deer Run 

Carbondale, CO 81623-8776 

970-704-0587 voice 

www.CHI-Colorado.org/ 
I fully support the Privacy/Regulations policies. 

Joseph J. Bevilacqua, Ph.D 
Public Listening Session: Confidentiality of Alcohol and 
 

Drug Abuse Patient Records 
 

Substance Abuse and Mental Health Services Administration (SAMHSA) 
 

June 11, 2014 
 

Testimony of Jessica V. Barnett on Behalf of the 
 

Massachusetts Center for Health Information and Analysis 
 

Consent Requirements Session (10:45-11:45 a.m.): 

Good morning. My name is Jessica Barnett, and I am the Chief 

Privacy Officer for the Massachusetts Center for Health Information and 

Analysis, also known as CHIA. CHIA is an independent state agency, which 

houses, among other things, the Massachusetts All Payer Claims Database 

or APCD. As a matter of state law, public and private payers are required to 

report claims and enrollment data to CHIA, data that may include 

identifying information about patients receiving substance abuse 

treatment. 

The public notice for the consent requirements session referenced 

HI Es, health homes, ACOs, and CCOs. In addition to these entities, CHIA 

respectfully urges SAMHSA to consider APCDs and similar data repositories 

when eva1uating any proposed amendments. 

APCDs, such as CHIA, are uniquely situated to serve the substance 

abuse patient population by providing a comprehensive source of multipayer data that will enable state agencies and other qualified researchers 

to evaluate the success of policy initiatives, such as state and federal 

Mental Health Parity laws, which are designed to improve coverage for and 

increase access to substance abuse treatment for those in need. 
MA Center for Health Information and Analysis 

Page 2 of 4 

In order to best serve this population, policymakers, researchers, 

advocates, and the patients themselves need to know whether these laws 

are working, and if not, where to focus future efforts at improvement. 

However, if the consent requirements of 42 CFR Part 2 are amended 

in a way that prohibits or renders impracticable the integration of 

substance abuse treatment data into APCDs and similar data repositories, 

the revised regulation will have the unintended consequence of preventing 

CHIA and other agencies like it from fulfilling their role as a critical data 

resource for evaluating public policy initiatives that are designed to serve 

the very same population that 42 CFR Part 2 seeks to protect. 

In order to balance the need to maintain patient privacy and to 

permit APCDs and other state-mandated data repositories to serve the 

substance abuse patient population, CHIA proposes that SAMHSA amend 

the consent requirements of 42 CFR Part 2 to make clear that holders of 

Part 2 data, including those that are not Part 2 programs, such as payers, 

may comply with state laws requiring the disclosure of Part 2 data to APCDs 

or other data repositories without obtaining patient consent. 

As a corollary to this proposed no-consent rule for disclosures 

required by state law, and to ensure that patient privacy is protected, the 

revised regulation should specify that APCDs and other data repositories 

that receive Part 2 data in this manner become holders of Part 2 data 

themselves and are subject to applicable privacy and security requirements 

contained in the regulation. The revised regulation should then make 

explicit which of its requirements apply to APCDs and similar holders of Part 

2 data and spell out the uses and disclosures that are permitted for such 

entities. 

CHIA intends to submit more detailed written comments on this 

proposal to SAMHSA by the June 25thdeadline. I would also be glad to 

answer any questions. 

Thank you again for the opportunity to speak. 
MA Center for Health Information and Analysis 

Page 3 of 4 

Qualified Service Organization (QSO) Session (1:15-2:00 p.m.): 

Good afternoon. My name is Jessica Barnett, and I am speaking for 

the second time today on behalf of the Massachusetts Center for Health 

Information and Analysis, or CHIA, which houses the Massachusetts All 

Payer Claims Database, or APCD. 

SAM HSA has indicated that it is considering expanding the definition 

of QSO to include care coordination services and to allow a QSO agreement 

to be executed between an entity that stores Part 2 information, such as a 

payer or an ACO that is not itself a Part 2 program, and a service provider. 

You have also inquired whether there are other use cases that should be 

considered with respect to QSOs. 

CHIA respectfully submits that to the extent APCDs and other statemandated repositories for health information become holders of Part 2 

information, such entities should also be authorized to execute QSO 

agreements with service providers, including agreements for services such 

as data processing and analysis; services related to treatment or 

coordination of care; and legal, consulting, or other professional services. 

Such services are necessary for APCDs to conduct their operations 

and to fulfill their statutory mission of providing high-quality data and 

analysis in support of health care policy initiatives. For example, this would 

permit a state agency to which Part 2 is reported to engage an expert in the 

area of substance abuse to analyze the data in furtherance of a specific 

project or initiative, such as monitoring compliance with Mental Health 

Parity laws. An agency that holds Part 2 data would also be able to engage 

expert assistance in profiling specific data elements that may include Part 2 

information, in order to improve data quality. 

CHIA intends to address this topic in further detail in its written 

comments to SAMHSA. I am also available to address any questions. Thank 

you. 
MA Center for Health Information and Analysis 

Page 4 of 4 

Research Session (2:00-2:45 p.m.): 

Good afternoon. My name is Jessica Barnett, and I am speaking for 

the third time today on behalf of the Massachusetts Center for Health 

Information and Analysis, or CHIA, which houses the Massachusetts All 

Payer Claims Database, or APCD. 

CHIA respectfully urges SAMHSA to include state-mandated APCDs 

and other similar repositories for health care information on the list of 

organizations that are explicitly authorized to release Part 2 data to 

qualified researchers and research organizations. As discussed earlier 

today, APCDs are uniquely situated to serve the substance abuse patient 

population by providing a critical source of multi-payer data for the 

evaluation of public policy initiatives in the area of substance abuse 

treatment. 

I have mentioned the evaluation of state and federal Mental Health 

Parity laws as one example. Other examples include an effort by the 

Massachusetts Senate to evaluate access to substance abuse treatment in 

Massachusetts; an initiative by MassHealth, the Massachusetts Medicaid 

program, to improve continuity of care for its members; and a proposed 

project by the Massachusetts Department of Public Health, Bureau of 

Substance Abuse Services, to use APCD data to identify populations in need 

of substance abuse treatment and those with unmet or underserved needs. 

APCDs can best fulfill their role as a data source for such projects if 

they are permitted to disclose Part 2 data to state agencies and other 

qualified entities for approved research purposes, with appropriate 

protections for patient privacy. CHIA intends to address this topic more 

fully, and to propose specific privacy protections that SAMHSA may wish to 

include, in the written comments that we are preparing. Again, I would be 

happy to answer any questions. Thank you. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

TWO BOYLSTON STREET 

BOSTON, MA 02116 

T 617.988.3100 

F 617.727.7662 

www.mass.gov/chia 

June 24, 2014 

VIA ELECTRONIC MAIL 

The Substance Abuse and Mental Health 

Services Administration (SAMHSA) 

1 Choke Cherry Road 

Rockville, MD 20857 

Comments of the Massachusetts Center 

for Health Information and Analysis Concerning 

Proposed Changes to 42 CFR Part 2 

Please accept the following written comments concerning proposed changes to the 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2, in 

response to S!MHS!’s public notice at FR Doc. 2014-10913. 

Introduction: The Role of APCDs in Health Care Reform 

As SAMHSA has acknowledged, in the 25 years since the confidentiality regulations for 

alcohol and drug abuse patient records set forth at 42 CFR Part 2 were last updated, “significan t 

changes have occurred within the U.S. health care system that were not envisioned by these 

regulations, including new models of integrated care that are built on a foundation of 

information sharing.” These models involve new types of health care organizations, such as 

Health Information Exchanges (HIEs) and Accountable Care Organizations (ACOs), as to which 

S!MHS! has specifically requested guidance in order to “clarify the requirements [of 42 CFR 

Part 2].” 

The Massachusetts Center for Health Information and Analysis (CHIA) respectfully urge s 

that in considering changes to 42 CFR Part 2, SAMHSA consider and explicitly address the needs 

of another new type of health care entity, the All-Payer Claims Database (APCD), as well as oth er 

similar state-mandated repositories for health care information. CHIA is the home of the 

Massachusetts APCD, as well as a repository for many other types of health care information, 

including Total Medical Expense and Relative Price data, hospital financial data, and hospital 

inpatient discharge, emergency department, and outpatient observation data. Public and 

private payers and providers are required by Massachusetts law to report this data to CHIA. 
 

 

 

 

 

 

 

 

 

 

 

MA Center for Health Information and Analysis 

Page 2 of 5 

State-mandated APCDs and data repositories, such as CHIA, have an important role to 

play in federal and state health care reform efforts across the country. For example, by 

providing a source of comprehensive multi-payer data, APCDs provide a critical resource for 

understanding patterns and trends in health care costs, delivery, and utilization; increasing 

transparency in the health care market; and evaluating various health care reform initiatives, 

such as patient-centered medical home pilots, ACOs, and health insurance rate review. 

In addition, as a central repository for claims information, across payers, for a broad 

range of services, including medical, pharmacy, and dental claims, APCDs have the potential to 

play an important role in the treatment and coordination of care of patients. APCD data may 

also be used to enhance clinical data for specific studies or outcome measures. 

Among the many potential uses for APCD data are analyses designed to support policy 

efforts aimed at improving coverage for and access to substance abuse treatment, such as 

federal and state Mental Health Parity Laws. In order to best serve the substance abuse 

population, policymakers, researchers, advocates, and the patients themselves need to know 

whether these laws are working, and if not, where to focus future efforts at improvement. 

However, if 42 CFR Part 2 is amended in a way that prohibits or renders impracticable 

the integration of substance abuse treatment data into APCDs and similar data repositories, the 

revised regulation will have the unintended consequence of preventing CHIA and other agencies 

like it from fulfilling their role as a critical data resource for evaluating public policy initiatives 

that are designed to serve the very same population that 42 CFR Part 2 seeks to protect. 

CHIA has elected to comment on three of the topics identified by SAMHSA, specifically 

as they relate to state-mandated APCDs and health care data repositories: (1) consent 

requirements; (2) qualified service organizations (QSOs); and (3) research. 

Topic 1: Consent Requirements 

S!MHS! has solicited comments on “patient privacy concerns as well as the anticipated 

impact of the consent requirements on integration of substance abuse treatment data into HIEs, 

health homes, !COs, and CCOs.” CHI! respectfully submits that S!MHS! should also consider 

the impact of consent requirements on the integration of data covered by 42 CFR Part 2 (“Part 2 

data”) into !PCDs and other repositories of health information. 

In order to facilitate the compliance of payers, providers, and other entities with state 

health care information reporting requirements, without undermining the privacy protections of 

42 CFR Part 2, CHIA proposes the following clarifications of 42 CFR Part 2: 

 The revised regulation should clarify that Part 2-covered entities (including 

substance abuse treatment providers and programs, third-party payers, and other 

entities as defined in a revised regulation) may disclose Part 2 data to state agencies 
 

 

 

 

 

 

 

 

 

	 

	 

	 

	 

	 

	 

	 

	 

	 

	 

	 

	 

	 

	 

	 

	 

	 

	 

MA Center for Health Information and Analysis 

Page 3 of 5 

or other entities housing state-mandated APCDs or health care data repositories, as 

required by state law, without obtaining patient consent. 

	 As a corollary to this proposed no-consent rule for disclosures required by state law, 

and to ensure that patient privacy is protected, the revised regulation should specify 

that APCDs and other data repositories that receive Part 2 data in this manner 

become “holders” of Part 2 data and are subject to applicable privacy and security 

requirements contained in the regulation. 

	 The revised regulation should then make explicit which of its requirements apply to 

APCDs and similar holders of Part 2 data and spell out the uses and disclosures that 

are permitted for such entities. At a minimum, permitted uses and disclosures 

should include: 

o	 Disclosures within the agency or between the agency and an entity that 

has direct administrative control over the agency; 

o	 Disclosures to a qualified service organization, which provides services 

to the agency, such as data processing or analysis, or legal, consulting, 

or other professional services; 

o	 Disclosures with Part 2-compliant patient consent; 

o	 Disclosures without patient consent for the purposes of: 

 Medical Emergencies; 

 Qualified Research Activities; or 

 Audit and Evaluation Activities; and 

o Disclosures in compliance with an authorizing court order. 

Topic 2: Qualified Service Organizations (QSOs) 

SAMHSA has indicated that it is considering expanding the definition of QSO to include 

care coordination services and to allow a QSO agreement to be executed between an entity that 

stores Part 2 information, such as a payer or an ACO that is not itself a Part 2 program, and a 

service provider. SAMHSA also has inquired whether there are other use cases that it should 

take into consideration. 

CHIA respectfully proposes that SAMHSA should, in connection with the revisions 

proposed above under Topic 1 (Consent Requirements), revise 42 CFR Part 2 to authorize state 

agencies or other entities that house state-mandated APCDs or data repositories that receive, 

process, and store Part 2 data, but that are not Part 2 programs, to execute QSO agreements 

with providers of services necessary for the running of such APCDs and data repositories, e.g., 
 

 

 

 

 

 

 

 

 

 

 

MA Center for Health Information and Analysis 

Page 4 of 5 

data processing and analysis; services related to treatment or coordination of care; and legal, 

consulting, or other professional services. 

Such services are necessary for APCDs to conduct their operations and to fulfill their 

statutory mission of providing high-quality data and analysis in support of health care policy 

initiatives. For example, this would permit a state agency to which Part 2 data is reported to 

engage an expert in the area of substance abuse to analyze the data in furtherance of a specific 

project or initiative, such as monitoring compliance with Mental Health Parity laws. An agency 

that holds Part 2 data would also be able to engage expert assistance in profiling specific data 

elements that may include Part 2 information, in order to improve data quality. 

Topic 3: Research 

S!MHS! has indicated that it is “considering expanding the authority for releasing data 

to qualified researchers/research organizations to health care entities that receive and store 

Part 2 data, including third-party payers, health management organizations, HIEs, and care 

coordination organizations.” S!MHS! also has inquired whether there are additional use cases 

that should be considered in the research context. 

CHIA respectfully proposes that SAMHSA should include state agencies and other 

entities that house state-mandated APCDs or other health care data repositories, such as CHIA, 

among the types of organizations that are explicitly authorized to release Part 2 data to qualified 

researchers and research organizations. As discussed above, APCDs provide a valuable source of 

comprehensive multi-payer data that may be utilized in support of health care reform efforts: 

to analyze trends in health care costs, delivery, and utilization; to promote transparency; and to 

evaluate specific health care reform initiatives. 

CHIA has received requests for data from state agencies and other researchers for 

projects specifically intended to benefit the substance abuse patient population. For example, 

the Massachusetts Senate has requested an analysis of access to substance abuse treatment in 

Massachusetts; MassHealth, the Massachusetts Medicaid program, is engaged in an effort to 

improve continuity of care for its members; and the Massachusetts Department of Public 

Health, Bureau of Substance Abuse Services, has proposed to use APCD data to identify 

populations in need of substance abuse treatment and those with unmet or underserved needs. 

APCDs can best fulfill their role as a data source for such projects if they are permitted to 

disclose Part 2 data to state agencies and other qualified entities for approved research 

purposes, with appropriate protections for patient privacy. 

To ensure adequate protection for patient privacy, SAMHSA could require APCDs, and 

other data repositories seeking to release Part 2 data for research purposes, to establish criteria 

for review of research requests that will permit the reviewing entity to determine whether: 

 the data recipient is qualified to conduct the research; 
 

MA Center for Health Information and Analysis 

Page 5 of 5 

 the data recipient has a research protocol under which the Part 2 information: 

o	 will be maintained in accordance with the security requirements set 

forth in 42 CFR Part 2; 

o will not be redisclosed except as permitted by 42 CFR Part 2; 

 the rights and welfare of patients will be adequately protected; and 

 the risks in disclosing the Part 2 information are outweighed by the potential 

benefits of the research. 

Please feel free to contact CHIA with any questions about the above proposal. 

Respectfully submitted, 

Áron Boros, Executive Director 

Jessica V. Barnett, Chief Privacy Officer 

Commonwealth of Massachusetts 

Center for Health Information and Analysis 

2 Boylston Street 

Boston, MA 02116 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

05/14/2014 17:07 3523440205 OFFICE MAX 137g PAGE 02/05 

Page l of 4 

Agencies
 

Department of Health and HumanServices
 

Substance Abuse and Mental Health Services Administration
 

FR Doc.2014-10913 Filed 5-9-14: 8:45 am
 

Billing Code 4162-20-P
 

Document Citations:
 

79 FR 26929
 

79 FR 26930
 

79 FR 26931
 

Page:
 

26929 -26932 (4 pages)

CFR:
 

42 CFR 2 

Document Number:
 

2014-10913
 

Shorter URL: 

https://federalregister.gov/a/2014-10913
 

June 14, 2014 

Comments from Rick Waldema r, M.A., CAP, 

P.0. Box 2456,

Inverness, FL 34451

To Whom it May Concern: 

Thank you for the opportunity to comment on proposed changes to Confidentiality

Rules/42 CFR 42, I have spent 40 years in professional settings that have operated under

confidentiality rules, and have continued to gain respect for my clients' desires and 

needs for confidentiality andprivacy. 

I worked in a community mental health center for 20+ years, and have now been 

working for 16 years at West Central Florida Driver Improvement Inc., a DUI School 

serving 5 counties under licensure from the Florida Department of Highway Safety and 

Motor Vehicles, I am employed in the capacity of Clinical Supervisor, Evaluator, and 

Class Instructor. The DUI School makes referrals on a daily basis to a wide range of 

counseling settings, communicates with courts, DHSMV, and other entities, and 42 CFR 

2 is a governing way of life. The following comments are mine and not those of West 

Central Florida Driver Improvement. 

My overall response to any consideration of changing 42 CFR 2 is to recommend that 

individual protections always be strengthened, never loosened, and that considerations 

driven by changing technologies and service delivery systems take a distant back seat to 

the individual's protection. It appears that most of the current proposals run very 

contrary to my priorities. 
 

Page 2 of 4 To: Department of Health and Human services

Substance Abuse and Mental Health Services Administration 

F:rom Rick Waldemar M.A., CAP Inverness, FL 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

05/14/2014 17:07 3523440205 OFFICE MAX 1379 PAGE 03/05 

Re: BACKGROUND section, Federal Register: 

"...significant changes have occurred within the U.S. health care system that were not envisioned 

by these regulations, including new models of integrated care that are built on a foundation of 

information sharing ... 

"...SAMHSA has heard from stakeholders that some of the current consent requirements make it 

difficult for these new health care organizations including health information exchange 

organizations (HIEs), Accountable Care Organizations (ACOs), and others to share substance 

abuse treatment information." 

It is possible that "making it difficult...to share substance abuse treatment information" 

is a good feeling for the individual. I personally do not want my information shared in 

any cavalier fashion, between entities of which I have no knowledge. I am certain that 

few advocates for the changes would consider the relaxed protocols cavalier, but that 

may well be the actual effect. 

"...There continues to be a need for confidentiality protections that encourage patients to seek 

treatment without fear of compromising their privacy. SAMHSA strives to facilitate information 

exchange while respecting the legitimate privacy concerns of patients due to the potential for 

discrimination and legal consequences... " 

Several years ago, while working in a counseling setting in Florida, I was required to 

fill out many SISAR data forms, where individuals' information was sent to 

Tallahassee. The clients I was working with at the time were likely not especially 

aware of the State of Florida’s data-mining. I was concerned, however. From my 

SISAR experiences, I realized that there are already efforts "compromising their 

privacy." I read the present proposals with even more concern than simple SISAR 

forms. 

SAMHSA has raised discrimination and legal consequences as the basis of "legitimate 

privacy concerns." This view has its own level of alarm and caution because it totally 

ignores the right of individuals' privacy for privacy's sake. The long-standing concept 

of ''its none of your business" has much higher standing in my mind than either 

discrimination or legal consequences (as important as these may be.) 

Your omission here is telling. 

Re: APPLICABILITY of 42 CFR Part 2 section, Federal Register: 

"...the regulations could be applied to any federally assisted health care provider that provides 

a patient with specialty substance abuse treatment services. In this scenario, providers would 

not be covered if the provided only substance abuse screening, brief intervention, or other 

similar pre-treatment substance abuse services ... 

... Would this change raise any new concerns?” 

This is a significant list! The services cited, albeit, as "examples," substance abuse 

screening, brief intervention, or other so-called pre-treatment services, should certainly 

be included in Confidentiality Rules and protections. 

Re: CONSENT REQUIREMENTS section, Federal Register: 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

06/14/2014 17:07 3523440206 OFFICE MAX 1379 PAGE 04/05 

Page 3 of 4 To: Department of Health and Human services

Substance Abuse and Mental Health Services Administration 

F:rom Rick Waldemar M.A., CAP Inverness, FL 

Re, the “To Whom” consent requirement: “...Currently, a Part 2 compliant consent cannot 

include future un-named providers which requires the collection of updated consent forms 

whenever new providers join these organizations ...” 

This restriction should absolutely remain in place. The individual should be in charge

of who gets access.

I am skeptical of a loosening up of where information goes, while “ensuring the patient

is fully informed and the necessary protections are in place.” You can't have it both

ways. “Necessary protections” in my opinion, would prevent “future un-named

providers” from access. Obviously, the proposals are moving in a direction favorable to

these “future un-named providers” at the expense of individuals’ protections.

“...1. Allow the consent to include a more general description of the individual, organization, or 

health care entity to which disclosure is to be made. 

“2. Require the patient be provided with a list of providers or organizations that may access their
 

information, and be notified regularly of changes to the list...”
 

Notified regularly? A logistical nightmare after the fact. Does the proposal envision

organizations Emailing lists of new providers every few weeks or months? Does the

patient/client/individual have any recourse for non-disclosure as these lists grow and

grow? Will organizations have a patient sign paperwork at registration that if the patient

wants any updates, they can go to website www.so-and-so? In that case the burden is

shifted to the individual to keep up with developments and obviously the average

patient will not do that. 

“SAMHSA welcomes comments on patient privacy concerns as well as the anticipated impact of 

the consent requirements on integration of substance abuse treatment data into HIEs, health 

homes, ACOs, and CCOs. 

Would these changes maintain the privacy protections for patients?” 

No. Absolutely not.

“Would these changes raise any new concerns?'' 

Yes- every time another organization is added to any of these lists.

Re: RE-DISCLOSURE section, Federal Register: 

The question is asked, “Would these changes maintain the privacy protections for patients?'' 
 

 

 

 

 

 

 

 

06/14/2814 17:07 3523440205 OFFICE MAX 1379 PAGE 85/85 

Page 4 of 4 To Department of Health and Human Services
 

Department of Health and Human services Substance Abuse and 

Mental Health Services Administration F:rom Rick Waldemar 

M.A., CAP Inverness, FL
 

No, they would not. 

Thank you again for the opportunity to offer input. I don't like the direction we are headed, and l

hope my concerns are shared by SAMHSA. It is time to return to recognizing the importance of each

individual's privacy. I look forward to hearing from you. 

Sincerely, 

Rick Waldemar M.A., CAP
 

Certified Addictions Professional #689, 

conferred by Florida Certification Board 

P.O. Box 2456 Inverness,
 

FL 34451 

RSW; dms 
 

 

 

 

 

 

 

 

 

 

 

 

To whom it may concern, 

Federal substance abuse privacy laws are antiquated because of modern technology. These laws were 

designed to protect patient privacy in an era before electronic records. In the current reality of health 

information exchanges, such as Quality Health Networks in western Colorado, the law actually interferes 

with good patient care. 

Our physicians here at Grand River Health, as well as all others in western Colorado have direct access to 

all clinical information in the Quality Health Networks exchange except for this very important mental 

health information. Patient safety is compromised in many ways, e.g. drug to drug interactions. Patient 

harm can and does occur waiting for charts to be copied and sent. It is also possible that the patient’s 

mental health condition will cause them to refuse to sign a release of information to their 

detriment. Please help us to join the digital age in this area and improve patient care and safety. 

Thank-you for listenting, 

Bill Noel | Chief Operating Officer 

Grand River Health | 

501 Airport Road 

PO Box 912 

Rifle, CO 81650 

970.625.6448 | Office 

970.625.6486 | Fax 

Grand River Hospital and Medical Center, exceptional healthcare, locally 

NOTICE: This email message is for the sole use of the intended recipient(s) and may contain 

confidential and privileged information. Any unauthorized review, use, disclosure or distribution 

is prohibited. If you are not the intended recipient, please contact the sender by reply email and 

destroy all copies of the original message including attachments and any other method of 

retention. 
 

 

Dear Sir/Madame, 

I have taught a confidentiality law course for 20 years and know both the CFR 42 Part 2 and the HIPAA 

law well. I would not recommend any changes at this time. 

Robert L. Malphrus 

Skagit Valley College 

Mt. Vernon, Washington 
 

 

 STATE OF MARYLAND 

DHMH
	

Maryland Department of Health and Mental Hygiene 

201 W. Preston Street • Baltimore, Maryland 21201 

 Martin O’Malley, Governor – Anthony G. Brown, Lt. Governor – Joshua M. Sharfstein, M.D., Secretary 

 

 

I. Sharing information with other providers for purposes of treatment: 

June 18, 2014 

The Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road, Room 5-1011 

Rockville, MD 20857 

To Whom It May Concern: 

In response to SAMHSA’s solicitation of comments concerning the confidentiality of alcohol 

and drug abuse patient records regulations, 42 CFR Part 2, the Maryland Department of Health 

and Mental Hygiene (Department) offers the following comments regarding current restrictions 

on re-disclosure of patient information. Further, the Department requests that the exceptions to 

the requirement for specific individual consent – in order to share patient and treatment 

information – be broadened for the purposes of enhancing the provision of care and formulating 

and implementing policy that meets the needs of persons receiving substance use disorder 

treatment. The section below provides a brief discussion of the Department’s comments. 

Under the current regulations, treatment providers who are covered programs may provide 

information regarding that treatment to the Maryland Alcohol and Drug Abuse Administration 

(ADAA). However, ADAA is prohibited from then re-disclosing that information to other 

treatment providers who are also providing treatment to the same individual, except with specific 

consent of the individual or in the case of a medical emergency. Thus, ADAA cannot share 

information with correctional institution medical clinics or other treatment providers who are 

currently or may in the future be providing care to an individual with a substance abuse disorder. 

This delays clinically appropriate assessments and treatment recommendations when addressing 

emergent situations in those with substance use disorders, without prior patient consent. DHMH 

requests that the re-disclosure restrictions be revised to permit sharing information for purposes 

of providing treatment beyond the current emergency exception. This will ensure better 

continuity of care for the patient and improved clinical decision making. 
II.	 Sharing information among State agencies for purposes of managing care and payment 

for treatment: 

The State of Maryland makes use of more than one State agency in managing care for persons 

receiving federally-funded treatment services and in arranging for payment for such services; 

e.g., the State’s substance use disorder agency, administrative services organizations, managed 

care organizations, and the State’s Medicaid agency. Current regulations do not permit sharing 

information between these agencies without specific consent, which severely hampers the State’s 

ability to efficiently and effectively pay for and plan for treatment services for these individuals. 

The Department requests that the regulations be amended to adopt the HIPAA rule for sharing 

information among state agencies. 

III. Limited Data Sets: 

Currently, rules for data sets are too restrictive under 42 CFR Part 2 and do not allow for the use 

of database identifier codes. Existing HIPAA rules governing “limited data sets” do permit such 

use. The Department requests that the regulations be amended to adopt the HIPAA rule for 

research and for public health operations under Data Use Agreements. 

IV. Sharing information for research and planning purposes: 

The Department requests that additional exceptions be permitted for government agencies when 

using or creating Centralized Data Banks for public health research and planning purposes. 

Specifically, the elimination of specific patient consent to re-disclose data for matching purposes 

is needed to conduct cross references when obtaining, matching and sending data between 

government agencies for research and planning purposes. Likewise, patient data provided to a 

qualified researcher employed or obtained by a state agency may not be re-disclosed to other 

agencies for cross referencing, unless specific patient consent is obtained. Current regulations 

require redundant safeguards when creating databases to cross reference information, resulting in 

unnecessary costs and reduced efficiency. 

V.	 Opioid Treatment Program Information Sharing with Somatic Care: 

Current regulations do not permit opioid treatment programs to share treatment information with 

somatic care providers without specific consent from the patient, whose condition may preclude 

him or her from making an informed and advantageous decision as to the consent. As most states 

currently have operational prescription drug monitoring programs (PDMP), opioid treatment 

programs-based practitioners can often easily identify whether their patients are receiving 

prescriptions for controlled substances from somatic care providers. However, because opioid 

treatment programs providers are precluded from sharing treatment information with either 

PDMP programs or health care providers, the latter often must provide care without knowing 

what has been prescribed by the opioid treatment programs provider. This can lead to poor 

treatment outcomes including inappropriate prescribing, increased morbidity, and increased risk 

of overdose. 

In light of the risk of adverse reactions, including overdose, from the simultaneous use of 

methadone and other controlled substances, requiring patient consent places providers in the 
 

 

 

untenable position of choosing between continuing to provide care without the ability to 

coordinate with other prescribers and denying care completely. The regulations should be revised 

to permit the opioid treatment programs to contact the prescriber without patient consent, or 

require opioid treatment programs to report PDMPs, or both. 

VI. Clarification of Central Registry Use:

Current regulations do not specify whether various entities may be included in the Central 

Registry; specifically: pain management clinics that do not use methadone, providers of 

buprenorphine clinics, prescription drug monitoring programs, etc. The Department requests 

further clarification on this issue in order to maintain effective Central Registries. 

VII. Programs Treating Co-Occurring Mental Health and Substance Use Disorders:

42 CFR Part II applies to programs that hold themselves out as a drug treatment program and to 

information that would identify a patient as an alcohol or drug abuser either directly by reference 

to other publicly available information or through verification of such an identification by 

another person. 42 CRF 2.12(a)(1)(i). These regulations are not applicable unless the program 

holds itself out as a drug treatment program, but not all information maintained by the drug 

treatment program is covered by the regulations. Therefore, for programs treating those with cooccurring disorders, whose number is expanding in response to changes in healthcare, the 

various types of health information are to be managed differently: information that is not drug 

treatment information is covered by HIPAA, while health information that is drug treatment 

information is covered by 42 CFR Part II. Segmenting health information based on its type is 

challenging and fraught with potential unintended violations of 42 CFR Part II. The Department 

requests that the regulations be amended to be no more restrictive than HIPAA in the limitations 

imposed on drug treatment programs. 

Thank you for the opportunity to submit comments on the confidentiality of alcohol and drug 

abuse patient records regulations, 42 CFR Part 2. While the Maryland Department of Health and 

Mental Hygiene plans to participate in the upcoming Public Listening Session, questions 

regarding these comments may be directed to: Kathleen Rebbert-Franklin, Acting Director of 

the DHMH Alcohol and Drug Abuse Administration, at Kathleen.rebbertfranklin@maryland.gov or (410) 402-8615. 

Sincerely, 

Charles E. Lehman 

Acting Deputy Secretary 

Health Care Financing 

Gayle Jordan-Randolph, M.D. 

Deputy Secretary 

Behavioral Health and Disabilities 
 

 

 

 

 

 

 

 

Whenever the patient has any dependency on a caregiver/family for food, clothing, shelter,
 

transportation to doctors appointments, supervising medications and providing the general support
 

around the persons illness-they need to know certain information-such as when the next appointment is,
 

what meds they should be taking and dose, why are they taking them, their diagnosis, what are the 

symptoms of their diagnosis vs side affects of meds.
 

Care givers need to know the patients general plan of care-otherwise it continues the crazy making 

relationship found in no other illness where the patient is dependent.
 

Caregivers/family do not need to know private conversations, whats discussed in psychotherapy unless
 

there is a duty to report "danger to self and others"
 

I hope SAMHSA recognizes there is a vast difference in care for those patients who lack capacity and 

insight into their illness, and have dependencies on family members (as physical health care does) vs
 

those who are self reliant....or you are again demonstrating you are incapable of managing brain 

disorders such as schizophrenia, and illnesses that can manifest symptoms of psychosis, delusion,
 

confusion, agitation and hallucinations.
 

there already is vast difference in health care delivery and philosophy between SAMHSA/Behavioral
 

health care and Medicine, for those that lack capacity to understand an informed consent. Your decisions
 

and actions here, will prove or disprove your general overall ability to manage and treat ILLNESS vs
 

focusing only focusing on recovery and mental HEALTH.
 

Unless you can incorporate physical health care standards within your philosophy, policies and
 

procedures, I like many others believe its well out of your "scope of practice" and understanding to 

continue managing brain/mental disorders.
 

Mary Palafox RN 

714-323-0423 
 

Document Citation: 

79 FR 26929 

Page: 

26929 -26932 (4 pages) 

CFR: 

42 CFR 2 

Document Number: 

2014-10913 

Applicability of 42 CFR Part 2 

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. Covered 

information could be defined based on what substance abuse treatment services are provided instead 

of being defined by the type of facility providing the services. 

FR Citation: 79 FR 26930 

Questions: 

 • How would redefining the applicability of 42CFRPart 2 impact patients, health care 

provider organizations, HIEs,CCOs, HIT vendors, etc.? 

• Would thischange raise any newconcerns? 

 • Would this change address stakeholder concerns? 

Public Comment Field: 

I’m sorry but I could not write on your PDF form. Please accept this. 

As a school-based NJ Student Assistance Coordinator, I [and our program] intervene, assess without 

formal diagnostic evaluation, and refer, and do follow-up substance abuse counseling. 

The existing 42 CFR Part 2 is a critical component in much of my success. Students will share detailed 

personal information with me subsequent to my review of 42 CFR Part 2 boundaries with them. We 

establish rapport and a working relationship when they understand that I “cannot turn them in”! 

I read some of the questions and potential modifications to the requirements. If what I do is considered 

officially within your definition of assessment and brief intervention, I would vote to MAINTAIN the 

strict requirements as they are. They are a powerful tool that make a difference for teenagers to trust a 

counselor in these personal, alcohol and other drug use concerns. 

Thank you.
	

Raymond Danziger
	

[professional affiliation below]
	

C: Tim Conway, Lakeland Regional High School Director of Guidance 

CONFIDENTIALITY NOTICE! 
 

This EMAIL may contain confidential information protected by Federal Law which is intended only 

for the use of the addressee written above. IF you are not the intended person nor addressee who is to 

receive this information, nor the receiving employee or agency responsible for delivery, any dissemination 

or copying of this EMAIL, or the taking of any action in reliance on the contents of this information 

is strictly prohibited. 

If you have received this EMAIL in error, please notify me immediately by phone (973.835.1900 ext. 

166) or by email, and please trash and delete this email. 

Raymond Danziger, Ph.D. 

Student Assistance Coordinator, 

Peer Leader Advisor 

Chair, AWARE ASAP (Municipal Alliance) 

Lakeland Regional High School 

205 Conklintown Road 

Wanaque, NJ 07465 

973.835.1900 x166 

rdanziger@lakeland.k12.nj.us 
 

 

 

 

 

 

 

 

 

 

 

 

 

June 18, 2014 

Dear SAMSHA, 

I feel that letting all medical providers gain access to the medical records of those on methadone 

treatment would be a huge mistake . Given the many years of experience I have had in the addiction and 

mental health field I can state there are many providers that harbor bias towards methadone 

therapy. The patient's who have put their lives back together using methadone therapy face numerous 

obstacles and prejudice from those who know nothing about opioid treatment including medical 

professionals. Please keep the medical records of those on methadone therapy away from the 

mainstream medical professionals and only to those professionals who the patients request . 

Thanks 

C. CURZIO

IMPORTANT NOTICE : This message and any attachments are solely for the intended recipient and may 

contain confidential information which is, or may be, legally privileged or otherwise protected by law from 

further disclosure. If you are not the intended recipient, any disclosure, copying, use, or distribution of the 

information included in this e-mail and any attachments is prohibited. If you have received this 

communication in error, please notify the sender by reply e-mail and immediately and permanently delete 

this e-mail and any attachments. 
 

I just want to register my support of SAMHSA’s efforts to REDUCE barriers to sharing data presented by 

42 CFR, Part 2, especially in the QSOA and research categories listed on your comment template (I was 

unable to add comments directly to the pdf). 

Through my organization, the UCLA Integrated Substance Abuse Programs, I have worked with primary 

care organizations including FQHCs to integrate care for years. During that time, many thousands of 

patients have been asked to sign a release of information to get around 42 CFR Part 2, and our partners 

have reported that not a single one of them has declined. Patients want and expect this information to 

be shared across their health care providers. The regulations have, however, served to greatly confuse 

and concern provider staff and administrators. Please do not make these regulations any stricter, and 

do whatever you can to allow integrated care to work. 

Thank you. 

Darren Urada, Ph.D. 

Associate Research Psychologist 

UCLA Integrated Substance Abuse Programs 

Semel Institute for Neuroscience and Human Behavior 

11075 Santa Monica Blvd., Suite 200, Los Angeles, CA 90025 

ofc: (310)267-5227 fax: (310)312-0538 

If your e-mail to this address bounces, please try durada@pacbell.net 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Dear Congress, House of Representatives, Senate, and Mr. President: 

On behalf of the USA, and all citizen's, especially the soldiers placing 

their lives on the lines for OUR CIVIL FREEDOMS. 

42 C.F.R. Part 2’s core privacy protections MUST be maintained I 

recently LOST my job over the fact that after a letter was sent to my 

HR and boss, with my "general restrictions" when I returned to work, 

wasn't ENOUGH of an explanation for my Company, and I am a single 

mother who CAN'T afford to be without work. 

I followed all the HR rules, the 7 medical doctors I had all sent letters, 

and explained that I was under their care for at least 2 weeks. My 

Company, sent a response that they needed MORE information as to 

my "medical issues." My doctors offered to fill out ANY and ALL state 

FMLA, STD, or Company forms. NOTHING was sent to my doctors on 

my behalf. My doctors even went as far as calling my HR department 

and got no returned calls. 

I URGE you to look at the statics for not only social stigma, but right 

away once they heard the words Neuro/Mental, I was let go, told they 

didn't think it would work out. I followed the rules and still lost. Now 

getting a job in my field, with that information on my file, will follow 

me. DO NOT VIOLATE ANYMORE OF OUR CIVIL RIGHTS! 

42 C.F.R. Part 2’s core privacy 

protections MUST be maintained. 

While behavioral health care should be integrated with physical health 

care, and communication between health care providers should be 

encouraged, the regulations’ protections are as necessary today as 

they were when they were issued in the 1970s in light of ongoing 

stigma and discrimination faced by people with substance use 

disorders. 

42 C.F.R. Part 2 enables people with substance use disorders to seek 

treatment without fear of exposure of their treatment records— 

without their permission—to law enforcement, employers, insurers, 
other health care providers, or others. Changes to the regulations 

would threaten these critical patient protections. 
 

 

I believe its my right as an addict currently in MMT to be the one to tell my doctors that I'm on 

methadone. Not every doctor is that understanding and knowledgeable about methadone 

maintenance treatment. It's disheartening when you do tell a doctor about your medication and 

all of a sudden there whole demeanor changes. As addicts we are hard enough on ourselves, we 

don't need doctors to do it along with us. 
 

 

 


 


 


 


 

From: yvonne parker [mailto:julio1912@yahoo.com]
 

Sent: Wednesday, June 18, 2014 9:03 PM
 

To: Privacy Regulations (SAMHSA)
 

Subject: Privacy
 

Since a large number of substance abusers also have a mental illness the concern 

should be the necessity for outside agencies to acquire private information without an 

individual's consent. I think since stigma is alive and well and that's not going to change 

anytime soon. Therefore, I think it's important that the individual's consent is requested 

whenever possible unless it is life and death situation where the individual can not give 

consent. 
 

 

 

 

 

 

 

 

To Whom it May Concern: 

The cost of methadone treatment is prohibitive only as it is due to the stigma that's associated 

with care of the individual. People die for lack of care - not here, not in this community, not 

enough treatment slots, and fear for lack of education. It is almost criminal to have to defend 

individuals' rights to treatment of an illness so destructive to the person and community as a 

whole. 

If medical personal at this juncture are ill prepared to comprehend addictive disorders, the needs 

of the patients involved, the array of available comprehensive treatment including the efficacy of 

methadone treatment, notwithstanding effects on their own practices, how can ,stigma die? We 

should not have to assure medical records of patients treated with methadone are kept so 

privately as a physician to whom the patient may be referred may inappropriately instruct the 

patient (by telling the patient to end treatment) and then refuse to treat the illness for which 

referred. 

SAMHSA must be a formidable force seen as promoting healthy lifestyles for all without 

prejudice and despite political affiliates. Health care is a human right. 

As a nurse committed to practicing for all equally, it seems a serious offensive to maintain such 

an antiquated outlook in delivery of health care today. We ought to set the standard for all. Let us 

stop stigma now by educating the masses - one group at a time. 

"Drops do pierce the stubborn flint, not by force, but often falling" (a quote). 

Thanks for listening. 

Desrie B Renaud, RN, MSHS, EDD 

Educational/Nursing Leadership Consultant 

Phone#: 631 654 5141 

Dr. Desrie 

DESRIE B. RENAUD, RN, MSHS, EDD 

Educational/Nursing Leadership Consultant 

AlmaDor Business Resources, LLC 

Phone - 631-654-5141; Fax - 631-654-5103 

E-mail: dbro@email.phoenix.edu 
For the last 7 years I have been sick and have not received the care or support that I have needed

. When I was a young adult in my early twenties I was pretty stupid and made bad choices , and 

some of those choices got me put in rehabs and a mental hospital once! But ever sense then my 

medical care has gone to crap all because the nurses and doctors take one look at my charts and 

immediately pas judgement and don't listen to my concerns or cries.

 

I'm always told that it's all in my head without any doctor or nurse taking the time to 

actually physically check, I'm so afraid to go to a doctor or er or anything medical related place, 

to get help now , I won't even go if I'm having seizures. , and it scares my family to death! But 

going to another medical industry "professional ", and having them treat me like a person who 

isn't worthy of their care, is worse to me and would do more damage to myself , then just getting 

through my medical issues. They have damaged me more then any drug I have ever taken in the 

past, could have ever done . I will never trust another " medical professional " as long as I live! 
 

 

 

 


 


 


 


 

















From: Michelle Jackson [mailto:michahjackson@gmail.com]
 

Sent: Thursday, June 19, 2014 7:02 AM
 

To: Privacy Regulations (SAMHSA)
 

Subject:
 

Thank you for the opportunity to comment. The policy is both helpful and harmful. From a 

community support perspective it 

Perpetuates the problem with systemic barriers. It makes the task of care coordination 

complicated and results in frustration creating more gaps in system. On the other hand it 

provides protection that often time dither enables an individual in active addiction to 

manipulate the system resulting in waste, redundancy and lack of progress. 

Sent from Gmail Mobile 
 

 

 

 

 

 

 

 

 

 

 

Regulations need to change to open the door for innovative care and the delivery of that 

care. Easing the confidentiality restrictions that would allow for licensed providers to open up 

satellite clinics in medical facilities and truly sharing the patients rather than segregating the 

SUD patients for confidentiality reasons. 

42CFR holds providers to a higher standard then witnessed in medical settings. On 

numerous occasions I have personally visited patients admitted to a hospital only to have medical 

professionals enter the room discuss the patients condition in front of me or even discuss the 

patients treatment and condition with me. No release is in place or requested. 

Concerns regarding electronic signatures on releases. Many doctors offices are having patients 

sign paperwork sight unseen. I have experienced office visits where I'm told I'm signing the 

HIPAA confidentiality statement but not offered a copy of the statement or the ability to read it 

prior to signing. 

Medical information is being shared with more and more people via HIE and in NYS PSYCKES 

(mental health information). I'm sure the patient is not fully aware of all of the people their 

personal health information is made available to. We can not expect the patient to understand 

what all these services and acronyms stand for. 

We are encouraged to enter into QSOA's with a network of providers to share confidential health 

information. Of concern is that if one of our QSOA providers experiences a breach in their EHR 

we are automatically held responsible for notifying our patients whose record may have been 

breached via our QSOA. In other words the OMIG will be all over all agencies connected or a 

part of the QSOA. 

SUD providers are asked to uphold a standard that has not necessarily been recognized or 

enforced in numerous states. We often encounter federal agencies, federal agents and federal 

courts that do not follow guidelines to obtain confidential information. Many will often state as 

a federal agency the regulations do not apply to them. In my career only one court made a week 

attempt at following the federal guidelines to obtain records. This was after I sent a letter and the 

federal regulations to the court. Legally I have been advised to send a letter of notification of the 

federal regulations and if the court chooses to ignore it send them whatever they want. The 

regulations only cover SUD providers so the secondary market for sharing the information is 

wide open. 

We go through all types of precautions to protect the records on one hand and then with HIE, 

Health Homes, DSRIP, etc. we are encouraged to enter into agreements, partnerships, etc. to 

disclose as much information as possible. Medical institutions freely share information with the 

patients friends and families. Sharing a persons SUD records with a medical provider will open 

the floodgates as to how many more people will know about the persons use and treatment 

history. 

I would suggest reviewing the regulations to allow for SUD programs to provide services in 

other medical settings. And open up the APG guidelines to allow SUD programs to provide a 

full line of medical care by including M.D.'s as a part of their overall service. 
 

 

 

 

 

 

 

 

 

 

Best regards, 

Robert Schaffer, LCSW 

This information is being disclosed to you from records protected by Federal Confidentiality Rules (42 CFR Part 2 and HIPAA). The Federal 

Rules prohibit you from making further disclosure of this information unless further disclosure is expressly permitted by the written consent of 

the person to whom it pertains - or as otherwise permitted by 42 CFR Part 2 and HIPAA. A general authorization for the release of medical or 

other information is NOT sufficient for this purpose. The Federal Rules restrict any use of this information to criminally investigate or 

prosecute any alcohol or drug abuse patients. 

IMPORTANT WARNING: This message is intended for the use of the person or entity to which it is addressed and may contain information 

that is privileged and confidential, the disclosure of which is governed by applicable law. If the reader of this message is not the intended 

recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any dissemination, 

distribution use or copying of this information is STRICTLY PROHIBITED. If you have this information by error, please notify sender 

immediately and destroy or return the information. 

“PURSUANT TO SECTION 33.25 OF THE MENTAL HYGIENE LAW, THE 

ATTACHED RECORDS AND REPORTS SHALL NOT BE FURTHER 

DISSEMINATED, EXCEPT THAT YOU MAY SHARE THE REPORT WITH: (i) 

A HEALTH CARE PROVIDER (ii) A BEHAVIORAL HEALTH CARE 

PROVIDER, (iii) LAW ENFORCEMENT, IF YOU BELIEVED A CRIME HAS 

BEEN COMMITTED; OR (iv) YOUR ATTORNEY.” 
The Substance Abuse and Mental Health Services Administration
 

Public Listening Session – Submission of Written Comments
 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2
 

Comments relating to Consent Requirements and Redisclosure: 

Regulations may be changed per recommendations without need for statutory 

amendment: 

The statutory authority for these regulations imposes protections for patient identifying 

records maintained by a covered program in connection with substance abuse education, 

prevention, training, treatment, rehabilitation, or research by restricting disclosure except 

in specified circumstances. The statute permits disclosures: 

• Without consent –

• With prior written consent, in accordance with prescribed regulations

o To medical personnel to extent necessary to meet medical emergency

o To qualified personnel for research, audit, or evaluation; such personnel

may not identify individuals in any reports

If authorized by court order based on good cause

Of note, 42 USC § 290dd-2 imposes no prohibition on redisclosure of records 

The regulations adopted under this statutory authority spell out details that operate to 

impose more restrictive conditions for disclosure of patient identifying information. The 

regulations may be amended according to the recommendations herein and remain 

compliant with the provisions of the statute. 

Regulations restrict patient choice and impede quality of care and safety: 

As currently written, the consent and redisclosure regulations restrict a patient’s choice 

relating to sharing of treatment information with a health information exchange, 

integrated service delivery system, or accountable care organization. The requirements 

that the consent must specifically identify the person/entity permitted to make a 

disclosure, as well as the specific person/entities to whom a disclosure may be made, and 

the prohibition on redisclosure by the recipient of protected information, stymie the whole 

purpose of permitting one’s information to be part of a HIE, integrated system, or ACO – to 

facilitate access/sharing of a comprehensive health record by/with all providers within the 

HIE, integrated system, or ACO who may end up treating the patient. Inability to authorize 

this type of information sharing may have profound impact on care received. Additionally, 

the absolute prohibition on redisclosure also impedes efforts to avoid adverse drug 

interactions, drug overdoses, and prescription medication abuse through prescription drug 

monitoring programs. 

Modifying these regulations where the purpose of consent to disclosure is for treatment, 

payment, or operations purposes, or to support prescription drug monitoring programs, can 

support the appropriate sharing of information –focused on patient care and safety, and 

o
patient choice - while preserving the high level of protection for this information in other 

contexts, e.g. law enforcement. We suggest the following changes to the existing 

regulations: 

Recommended amendments: 

§ 2.31 Form of written consent.

(a) Required elements. A written consent to a disclosure under these regulations must

include:

 

(1) The specific name or general designation of the program or person permitted to

make the disclosure. Where a patient has consented to disclosure by a participant in a

health information exchange, integrated service delivery system, or accountable care

organization, that consent also authorizes disclosures by and among all participants in

the health information exchange, service delivery system, or accountable care

organization for purposes of treatment, payment, or healthcare operations as those

terms are defined at 45 CFR 164.501.

 

 

(2) The name or title of the individual or the name of the organization to which

disclosure is to be made. For disclosures to a health information exchange, integrated

service delivery system, or accountable care organization, this element is satisfied by

identifying the health information exchange, integrated service delivery system, or

accountable care organization, and thereby authorizes the use and exchange by and

among participants in the health information exchange, integrated service delivery

system, or accountable care organization for purposes of treatment, payment, or

healthcare operations as those terms are defined at 45 CFR 164.501. Health

information exchanges, integrated service delivery systems, and accountable care

organizations must provide to the patient a list of current participants in the health

information exchange, integrated service delivery system, or accountable care

organization, and identify a place where the individual may access a current list of

participants at any time in the future.

(3) The name of the patient.

(5) How much and what kind of information is to be disclosed. This element may be

satisfied by a list of categories of information to be shared.

(7) The date on which the consent is signed.

(6) The signature of the patient and, when required for a patient who is a minor, the

signature of a person authorized to give consent under § 2.14; or, when required for a

patient who is incompetent or deceased, the signature of a person authorized to sign

under § 2.15 in lieu of the patient.

(8) A statement that the consent is subject to revocation at any time except to the

extent that the program or person which is to make the disclosure has already acted in

reliance on it. Acting in reliance includes the provision of treatment services in reliance

on a valid consent to disclose information to a third party payer.

(9) The date, event, or condition upon which the consent will expire if not revoked

before. This date, event, or condition must insure that the consent will last no longer

than reasonably necessary to serve the purpose for which it is given.

 

(b) Consent for disclosure of patient identifying information to a health information

exchange. Where state law provides for disclosure of patient identifying information to a

health information exchange without a patient’s express authorization or consent, after 

(4) The purpose of the disclosure.
the patient has been given prior notice of the intent to disclose information to the health 

information exchange and patient is given an opportunity to opt-out of the disclosure, 

documentation of the required notice and patient’s decision not to opt-out of disclosure to 

the health information exchange shall constitute written consent for purposes of these 

regulations. 

§ 2.32 Prohibition on redisclosure.

Notice to accompany disclosure. Each disclosure made with the patient's written 

consent, with the exception of disclosures made to a health information exchange, 

integrated service delivery system, accountable care organization, or pharmacy, must be 

accompanied by the following written statement: 

This information has been disclosed to you from records protected by Federal 

confidentiality rules (42 CFR part 2). The Federal rules prohibit you from making any 

further disclosure of this information unless further disclosure is expressly permitted by the 

written consent of the person to whom it pertains or as otherwise permitted by 42 CFR part 

2. A general authorization for the release of medical or other information is NOT sufficient 

for this purpose. The Federal rules restrict any use of the information to criminally

investigate or prosecute any alcohol or drug abuse patient.

Information disclosed to a health information exchange, integrated service delivery 

system, accountable care organization, or pharmacy may be redisclosed only in the 

following circumstances: 

(a) By and among participants in a health information exchange, integrated service

delivery system, or accountable care organization for purposes of treatment, payment,

or healthcare operations as those terms are defined at 45 CFR 164.501;

(b) By and among healthcare providers, as that term is defined at 45 CFR 160.103, for

purposes of processing and filling electronic prescriptions, and

(c) To statutorily authorized pharmacy oversight bodies for purposes of state or federal

prescription drug monitoring programs. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Agency:	 Department of Health and Human Services, Substance Abuse and Mental 

Health Services Administration 

Docket:	 2014 – 10913 

Regarding:	 Potential changes to the Confidentiality of Alcohol and Drug Abuse Patient 

Records Regulations, 42 CFR Part 2 

Founded in 2006, Community Oriented Correctional Health Services (COCHS) is a 

philanthropically funded nonprofit organization that works to improve connectivity 

between jails and the greater health care system. We thank you for your commitment to 

improving access to mental health and substance use disorder services for all 

Americans, and we appreciate the opportunity to comment on potential changes to the 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2. 

A significant number of people with substance use disorders come into contact, at some 

point in their lives, with the criminal justice system. Jails admit approximately 12 million 

people each year, usually for a brief period of time, and often for behavior that is directly 

related to substance use. Sixty to eighty percent of all people booked into jail have at 

least one illegal substance in their bodies at the time of booking; more than two-thirds of 

all jail inmates meet the DSM-IV criteria for substance dependence or abuse; and the 

prevalence of substance use disorders is approximately six times higher among jail 

inmates than it is among non-institutionalized adults. 

The possibility that law enforcement agencies could use information obtained from 

treatment providers to pursue criminal charges could deter many people who need 

treatment from seeking it out, particularly people with past justice-system contact. It is 

important that any changes to 42 CFR Part 2 maintain the regulations’ current balancing 

of confidentiality and consent-enabled communication, where treatment information 

cannot be used to investigate or prosecute a patient without a specific court order. We 

support changes that would facilitate information-sharing between treatment providers, 

researchers, pharmacies, and other health care partners, but it is crucial that the 

regulations continue to prevent law enforcement agencies from having open access to 

treatment information, which would deter many of society’s most vulnerable individuals 

from pursuing the treatment they need. 
 

 

 

I would like to address the confidentiality issue at hand on putting methadone/suboxone clients 

into a database that allows doctors to automatically be notified that a patient of theirs is being 

treated for alcohol and/or drug dependence. I feel that releasing information about being on 

methadone or suboxone is a personal matter and should be handled as such. I feel, as a 

methadone patient myself, that I would feel much more comfortable letting a doctor know about 

my personal issue myself when I feel comfortable enough to do so, rather than have my doctor 

already know this information about me before I even get the chance to build a relationship with 

a doctor. I hope this helps in making a compassionate decision based on how other clients of 

methadone/suboxone feel as well. It is our right to have privacy when it comes to our medical 

issues, and/or addiction issues, and how we choose to handle these issues. Thank you for your 

attention to this matter. 
PRO-A Pennsylvania Recovery Organizations Alliance 

900 S Arlington Ave, Suite 254A 

Harrisburg, PA 17109-1014 

U.S. Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road, Room 5-1011 

Rockville, MD 20857 

June 20, 2014 

RE: 	 Confidentiality of Alcohol & Drug Abuse Patient Records Regulations, 42 C.F.R. Part 2.79 Fed. 

Reg. 26929; Docket No. 2014-10913. 

To Whom It May Concern: 

We are writing you today in response to the request for public comment on 42 CFR Part 2 confidentiality regulations. 

We are the Pennsylvania Recovery Organization -Alliance, the statewide recovery community organization of 

Pennsylvania. Founded in 1998, PRO-A is focused on decreasing barriers to life saving services, reducing stigma 

associated with drug and alcohol dependency and to advocate for individuals and their families that are coping with this 

devastating illness. 

To be clear, we are deeply opposed to any movement to weaken existing confidentiality protections. 

42CFR Part 2 regulations are critically important to our recovery communities across Pennsylvania. We are opposed to 

modifying these fundamentally important regulations and in our experience know that without the strong protections it 

has provided over the last 40 years, access to services will be impeded and we will face even more discrimination than 

we already do. 

The right of confidential communications is paramount for us to seek life saving access to services without very real 

repercussions. Addiction is a highly stigmatized disease process. The erosion of these regulations and reliance on the 

much weaker HIPAA standards would result in patient records being easily accessed in order to criminally investigate or 

prosecute our families, to deny us of insurance, housing and employment, or to be used against us in divorce or child 

custody proceedings among a myriad of other ways. Many of us many will be afraid to enter treatment or to seek help. 

Even more lives will be lost. 

As an example of the pressure put on our systems to provide unnecessary but incredibly sensitive and personal 

information, we recently conducted a large survey of our drug and alcohol counselor workforce of Pennsylvania. We 

obtained between a 20 and 25 percent response rate from the entire workforce, with 837 respondents. Among our 

other findings, 58% of the respondents indicated that they are pressured to provide more information than is necessary 

and allowable under the confidentiality laws. 42 CFR Part 2 regulations are a bulwark to the integrity of the patient 

counselor relationship. They must be preserved. 

We believe that citizens seeking help must be able retain the power to decide when and to whom their records are 

disclosed, even for treatment and payment purposes, given the continued prevalence of discrimination in our society. 

This includes disclosures to the general health care system, HIEs, health homes, ACOs, and CCOs and beyond. The best 

way for patients to re t powe~_retain~rotections currently delineated within 42 CFR part 2. 

cc: Hon able PA DDAP Secretary Gary Tennis 

The Legal Action Center 

PRO-A 900 S Arlington Ave, Suite 254A Harrisburg, PA 17109 

717-545-8929 F 717-545-9163 www.pro-a.org Billstauffer@pro-a.org 
Page 1 of 4 

 

 

 

 

 

 

 

 

 

 

The Substance Abuse and Mental Health Services Administration
 

Public Listening Session Comment Template
 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2 

This document is meant to provide the public with a simple and organized way to submit comments on the 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2, and respond to 

questions presented in meeting notice which is published in the Federal Register at 79 FR 26929. While use of 

this document is entirely voluntary, commenters may find it helpful to organize their comments. 

This document alone is not intended to provide a full and complete opportunity to comment on all of the 

provisions within the regulation. Please keep in mind that it only reflects those topics included in the meeting 

notice and a section for “other” comments. 

To be considered, all comments (including comments provided through this document) must be submitted 

according to the instructions in the meeting notice: 

https://www.federalregister.gov/articles/2014/05/12/2014-10913/confidentiality-of-alcohol-and-drug-abusepatient-records. 

Applicability of 42 CFR Part 2 

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. Covered information could 

be defined based on what substance abuse treatment services are provided instead of being defined by the type of 

facility providing the services. 

FR Citation: 79 FR 26930 

Questions: 

• How would redefining the applicability of 42 CFR Part 2 impact patients, health care provider organizations, HIEs, 

CCOs, HIT vendors, etc.? 

• Would this change address stakeholder concerns? 

• Would this change raise any new concerns? 

Public Comment Field: 
 

 

 

 

 

 

 

 

 

 

 

 

Consent Requirements 

While technical solutions for managing consent collection are possible, SAMHSA is examining the consent requirements 

in § 2.31 to explore options for facilitating the flow of information within the health care context while ensuring the 

patient is fully informed and the necessary protections are in place. Specifically, we are analyzing the current 

requirements and considering the impact of adapting them to: 

1. Allow the consent to include a more general description of the individual, organization, or health care entity to which 

disclosure is to be made. 

2. Require the patient be provided with a list of providers or organizations that may access their information, and be 

notified regularly of changes to the list. 

3. Require the consent to name the individual or health care entity permitted to make the disclosure. 

4. Require that if the health care entity permitted to make the disclosure is made up of multiple independent units or 

organizations that the unit, organization, or provider releasing substance abuse related information be specifically 

named. 

5. Require that the consent form explicitly describe the substance abuse treatment information that may be disclosed. 

FR Citation: 79 FR 26931 

Questions: 

• Would these changes maintain the privacy prote 

• Would these changes address the concerns of HI 

• Would these changes raise any new concerns? 

ctions for patients? 

Es, health homes, ACOs, and CCOs? 

Public Comment Field: 

Redisclosure 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on redisclosure only applies to 

information that would identify an individual as a substance abuser, and allows other health-related information shared 

by the Part 2 program to be redisclosed, if legally permissible. This would allow HIT systems to more easily identify 

information that is subject to the prohibition on redisclosure enabling them to utilize other technological approaches to 

manage redisclosure. If data are associated with information about where the data were collected (data provenance) 

which reveals that the data were collected by a practice that exclusively treats addiction, the data would still be 

protected under the proposed change. 

FR Citation: 79 FR 26931 

Questions: 

• Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 in an EHR or HIE 

environment? 

• Would these changes maintain the privacy protections for patients? 

Public Comment Field: 

Page 2 of 4 
 

 

 

 

 

 

 

 

 

 

 

Medical Emergency 

SAMHSA is considering adapting the medical emergency exception to make it more in-line with the statutory language 

and to give providers more discretion as to when a bona fide emergency exists. For example, amending this standard to 

allow providers to use the medical emergency provision to prevent emergencies or to share information with a 

detoxification center when a patient is unable to provide informed consent due to their level of intoxication. 

FR Citation: 79 FR 26931 

Questions: 

• What factors should providers take into consideration in determining whether 

• Are there specific use cases SAMHSA should take into consideration?Show cita 

• Are there patient concerns about the impact of this change on their privacy? 

 a medical emergency exists? 

tion box 

Public Comment Field: 

Qualified Service Organization (QSO) 

SAMHSA is analyzing the regulations to identify options for allowing Part 2 data to flow to health care entities for the 

purpose of care coordination and population management while maintaining patient protections. One potential solution 

includes expanding the definition of a qualified service organization (QSO; § 2.11) to explicitly include care coordination 

services and to allow a QSO Agreement (QSOA) to be executed between an entity that stores Part 2 information, such as 

a payer or an ACO that is not itself a Part 2 program, and a service provider. 

FR Citation: 79 FR 26931 

Questions: 

• Are there other use cases we should be taking into consideration? 

• Are there specific patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

Research 

SAMHSA is considering expanding the authority for releasing data to qualified researchers/research organizations to 

health care entities that receive and store Part 2 data, including third-party payers, health management organizations, 

HIEs, and care coordination organizations. 

FR Citation: 79 FR 26932 

Questions: 

• Are there factors that should be considered related to how current health care entities are organized, how they 

function or how legal duties and responsibilities attach to entities that make up an umbrella organization? 

• Would this change address concerns related to research? 

• Are there specific privacy concerns associated with expanding the authority or releasing data to qualified 

researchers/research organizations in this way? 

• Are there additional use cases that should be considered in the research context? 

Public Comment Field: 

Page 3 of 4 
 

 

 

 

 

 

 

Addressing Potential Issues With Electronic Prescribing and Prescription Drug Monitoring Programs (PDMPs) 

Part 2 protections include a prohibition on the redisclosure of information received directly from a Part 2 program. A 

pharmacy that receives electronic prescription information directly from a Part 2 program must obtain patient consent 

to send that information to a PDMP, and patient consent is also required for the PDMP to redisclose that information to 

those with access to the PDMP. 

Preamble FR Citation: 79 FR 26932 

Questions: 

• How do pharmacy information system vendors anticipate addressing this issue? Are there specific technology 

barriers SAMHSA should take into consideration? 

• Are there other concerns regarding 42 CFR Part 2 and PDMPs? Please describe relevant use cases and provide 

recommendations on how to address the concerns. 

• Are there patient concerns about the impact of e-prescribing and PDMPs on their privacy? 

Public Comment Field: 

Other Comments 

Topic: 

Public Comment Field: 

Page 4 of 4 
 

 

 


 


 


 


 

From: Maria LaFriniere [mailto:MariaL@ctsi.nsn.us]
 

Sent: Friday, June 20, 2014 12:29 PM
 

To: Privacy Regulations (SAMHSA)
 

Subject: Patient Confidentiality Comments
 

Please find attached comments. 

In Wellbriety 

Maria LaFriniere 

Strategic Prevention Framework 

Project Coordinator 

(541) 444-8267 

Confederated Tribes of Siletz 

Behavioral Health 

PO Box 320 

Siletz, OR 97380 
-----Original Message-----

From: Hatcher, Anne [mailto:hatchera@msudenver.edu] 

Sent: Friday, June 20, 2014 3:33 PM 

To: Privacy Regulations (SAMHSA) 

Subject: comments to proposed changes 

Changes to 42CFR Part 2 Proposals 

The following are my responses to the questions posed: 

Consent Requirements 

The patient should be provided with a list of providers or organizations that may access their 

information and be notified regularly of changes to the list. 

The name of the individual or health care entity permitted to make the disclosure should be provided to 

the patient. 

The consent form signed by the patient should explicitly describe the substance abuse treatment 

information that may be disclosed. 

Redisclosure 

I agree with the SASHA proposal to limit redisclosure to information related to the individual as a 

substance abuser and allows other health information to be shared/redisclosed. 

Medical Emergency 

I agree with the SAMSHA proposed changes 

Qualified Service Organizations 

I agree with the proposed changes 

Research 

I object to sharing treatment data to third-party payers, health management organizations, HIEs and 

care coordination organizations. 

Potential Issues with Electronic Prescribing and Prescription Drug Monitoring Programs The primary 

concern about electronic prescriptions is the privacy issue for persons in addiction treatment . 

Anne S. Hatcher, 

NAADAC Ethics Chair 

Anne S. Hatcher, EdD, CACIII, NCACII 

Professor Emeritus, Center for Addiction Studies Department of Human Services Metropolitan State 

University Denver 
June 20, 2014

The Substance Abuse and Mental Health Services Administration

1 Choke Cherry Road, Room 5-1011

Rockville, MD 20857

Sent Via Email: PrivacyRegulations@SAMHSA.hhs.gov

 

RE: Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2 

FR Doc. 2014-10913 Filed 5-9-14

To Whom It May Concern: 

On behalf of the Oregon Primary Care Association (OPCA) I submit the following comments in 

support of amending 42 CFR Part 2 to allow better care coordination while maintaining the ability 

of patients to keep information confidential. OPCA is a non-profit membership organization 

comprising Oregon’s 32 community health centers. Our members operate 201 health clinics 

statewide that provide coordinated care to 340,000 rural and/or medically underserved patients 

annually. Oregon’s community health center patients are primarily uninsured or insured through 

Medicaid.

OPCA’s member health centers have struggled with the confusing and burdensome current consent 

requirements that have resulted in difficulty coordinating with Oregon’s Coordinated Care 

Organizations (CCOs) and others in the sharing of necessary information for appropriate medical, 

mental health and dental treatment. This can result in patients being prevented from fully 

participating in integrated care efforts even when they are willing to provide consent.

Our member health centers believe in care coordination and the improved health outcomes it 

produces, and we empower our patients to be engaged in their care and to make important decisions 

about their treatment. This includes supporting our patients to choose to keep their records 

confidential, or to decide with whom to share them. 

OPCA is encouraged that SAMHSA strives to facilitate information exchange while respecting the 

legitimate privacy concerns of patients due to the potential for discrimination and legal 

consequences. And we support SAMHSA’s stated intent to clarify the rules associated with 

information exchange in our new coordinated care world to reduce burdens associated with specific 

consent requirements that do not serve to protect patient privacy or facilitate patient care.

On behalf of Oregon’s 32 community health centers and the 340,000 patients we annually serve, I 

thank you for considering our input. 

Sincerely,

John Hummel 

State and Federal Policy Director

310 SW 4th Ave ∙ Suite 200 ∙ Portland OR 97204 ∙ 503.228.8852 office ∙ 503.228.9887 fax ∙ www.orpca.org
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Suggest repealing the governing statute and align with industry standards around labeling data as sensitive. IHE and 

HL7 are doing a lot of work here from a technical stand point; HIPAA and the corresponding DURSA requirements at 

the HIE level cover a lot of the related policy issues.

The Substance Abuse and Mental Health Services Administration 

Public Listening Session Comment Template
&

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2 

This document is meant to provide the public with a simple and organized way to submit comments on the 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2, and respond to 

questions presented in meeting notice which is published in the Federal Register at 79 FR 26929. While use of 

this document is entirely voluntary, commenters may find it helpful to organize their comments. 

This document alone is not intended to provide a full and complete opportunity to comment on all of the 

provisions within the regulation. Please keep in mind that it only reflects those topics included in the meeting 

notice and a section for “other” comments. 

To be considered, all comments (including comments provided through this document) must be submitted 

according to the instructions in the meeting notice: 

https://www.federalregister.gov/articles/2014/05/12/2014-10913/confidentiality-of-alcohol-and-drug-abusepatient-records. 

Applicability of 42 CFR Part 2 

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. Covered information could 

be defined based on what substance abuse treatment services are provided instead of being defined by the type of 

facility providing the services. 

FR Citation: 79 FR 26930 

Questions: 

• How would redefining the applicability of 42 CFR Part 2 impact patients, health care provider organizations, HIEs, 

CCOs, HIT vendors, etc.? 

• Would this change address stakeholder concerns? 

• Would this change raise any new concerns?

Public Comment Field: 

Page 1 of 4
&
 

 

 

 

 

 

Consent could more closely follow SSA guidelines; Again HIPAA has good governance around this. Consideration could 

also be given around notifications as an addition to the workflow for patient engagement. TPO is interesting but could 

be onerous to implement; needs to consider emerging care coordination.

 

 

 

 

 

 

 

 

 

 

Consent Requirements 

While technical solutions for managing consent collection are possible, SAMHSA is examining the consent requirements 

in § 2.31 to explore options for facilitating the flow of information within the health care context while ensuring the 

patient is fully informed and the necessary protections are in place. Specifically, we are analyzing the current 

requirements and considering the impact of adapting them to: 

1. Allow the consent to include a more general description of the individual, organization, or health care entity to which

disclosure is to be made. 

2. Require the patient be provided with a list of providers or organizations that may access their information, and be

notified regularly of changes to the list. 

3. Require the consent to name the individual or health care entity permitted to make the disclosure.

4. Require that if the health care entity permitted to make the disclosure is made up of multiple independent units or

organizations that the unit, organization, or provider releasing substance abuse related information be specifically 

named. 

5. Require that the consent form explicitly describe the substance abuse treatment information that may be disclosed.

FR Citation: 79 FR 26931 

Questions: 

• Would these changes maintain the privacy protections for patients? 

• Would these changes address the concerns of HIEs, health homes, ACOs, and CCOs? 

• Would these changes raise any new concerns? 

Public Comment Field: 

Redisclosure 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on redisclosure only applies to 

information that would identify an individual as a substance abuser, and allows other health-related information shared 

by the Part 2 program to be redisclosed, if legally permissible. This would allow HIT systems to more easily identify 

information that is subject to the prohibition on redisclosure enabling them to utilize other technological approaches to 

manage redisclosure. If data are associated with information about where the data were collected (data provenance) 

which reveals that the data were collected by a practice that exclusively treats addiction, the data would still be 

protected under the proposed change. 

FR Citation: 79 FR 26931 

Questions: 

• Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 in an EHR or HIE 

environment? 

• Would these changes maintain the privacy protections for patients? 

Public Comment Field: 

Page 2 of 4
&

This is certainly worth pursuing: marking data as sensitive based on the sending source; CCDA and XDS can 

accommodate this. Also need to consider source of requestor of information -- this same group should have higher 

access.
 

 

 

 

 

 

 

This seems too restrictive; what in the case when early intervention would removethe need for emergent encounters. 

Need to consider entire spectrum of careand who else might be engaged on collaborative care. Are the patients 

capableof determining what is in their own best interest?

 

 

 

 

 

 

 

 

 

As stated above; try to leverage existing policies, procedures, workflows around this type of sensitive data. Substance 

abuse is as personal as protecting a pregnant teen for example.

 

 

 

 

 

 

Medical Emergency 

SAMHSA is considering adapting the medical emergency exception to make it more in-line with the statutory language 

and to give providers more discretion as to when a bona fide emergency exists. For example, amending this standard to 

allow providers to use the medical emergency provision to prevent emergencies or to share information with a 

detoxification center when a patient is unable to provide informed consent due to their level of intoxication. 

FR Citation: 79 FR 26931 

Questions: 

• What factors should providers take into consideration in determining whether a medical emergency exists? 

• Are there specific use cases SAMHSA should take into consideration?Show citation box 

• Are there patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

Qualified Service Organization (QSO) 

SAMHSA is analyzing the regulations to identify options for allowing Part 2 data to flow to health care entities for the 

purpose of care coordination and population management while maintaining patient protections. One potential solution 

includes expanding the definition of a qualified service organization (QSO; § 2.11) to explicitly include care coordination 

services and to allow a QSO Agreement (QSOA) to be executed between an entity that stores Part 2 information, such as 

a payer or an ACO that is not itself a Part 2 program, and a service provider. 

FR Citation: 79 FR 26931 

Questions: 

• Are there other use cases we should be taking into consideration? 

• Are there specific patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

Research 

SAMHSA is considering expanding the authority for releasing data to qualified researchers/research organizations to 

health care entities that receive and store Part 2 data, including third-party payers, health management organizations, 

HIEs, and care coordination organizations. 

FR Citation: 79 FR 26932 

Questions: 

• Are there factors that should be considered related to how current health care entities are organized, how they 

function or how legal duties and responsibilities attach to entities that make up an umbrella organization? 

• Would this change address concerns related to research? 

• Are there specific privacy concerns associated with expanding the authority or releasing data to qualified 

researchers/research organizations in this way? 

• Are there additional use cases that should be considered in the research context? 

Public Comment Field: 

Page 3 of 4
&

Technology exists to anonymous data -- with the ability to re-identify patients if a study should prove beneficial. 
 

 

 

 

 

 

 

 

 

 

The recognition that change is required is very encouraging; the presumption that Substance abuse folks are any more 

special than sexual health or behavioral health patients is inaccurate, demeaning and proscriptive. Consider adopting

existing policies where possible and engaging in the wider population to learn and engage in the wider body to help 

determine future courses of action. SAMHSA and the broader community will all benefit from a more collaborative 

approach.

Addressing Potential Issues With Electronic Prescribing and Prescription Drug Monitoring Programs (PDMPs) 

Part 2 protections include a prohibition on the redisclosure of information received directly from a Part 2 program. A 

pharmacy that receives electronic prescription information directly from a Part 2 program must obtain patient consent 

to send that information to a PDMP, and patient consent is also required for the PDMP to redisclose that information to 

those with access to the PDMP. 

Preamble FR Citation: 79 FR 26932 

Questions: 

• How do pharmacy information system vendors anticipate addressing this issue? Are there specific technology 

barriers SAMHSA should take into consideration? 

• Are there other concerns regarding 42 CFR Part 2 and PDMPs? Please describe relevant use cases and provide 

recommendations on how to address the concerns. 

• Are there patient concerns about the impact of e-prescribing and PDMPs on their privacy? 

Public Comment Field: 

Other Comments 

Topic: 

Public Comment Field: 

Page 4 of 4
&

Surescripts and other pharmacy vendors should be included in the over-all care coordination team. The technology and 

policies exist and are emerging to protect a variety of protected classes.
 

I also do not believe patient records from Drug and Alcohol treatment centers or behavioral 

treatment centers of any kind should ever be made available to healthcare workers (of any kind). 

These records especially should be left confidential and private unless the patients themselves 

have asked otherwise. This could cause a great amount of damage to those of us who have been 

in treatment. 
 

To whom it may Concern,
 

I'm a fairly new MMT patient.
 

I need my privacy and don't feel it's right to get this taken away.
 

It's not like we're criminals and need to be red flagged anywhere anytime.
 

It's imperative for this basic human right to be taken away.