Lincoln Land 

Health Information 

Exchange 

June 25, 2014 

The Substance Abuse and Mental Health Services Administration 

Attention: Public Listening Session Comments 

1 Choke Cherry Road 

Room 5-1011 

Rockville, Maryland 20857 

PrivacyRegulations@SAMHSA.hhs.gov 

Docket Number: 2014-10913 

Dear Sir or Madmn: 

Lincoln Land Health Information Exchange (LLHIE) and Illinois Health Exchange Partners (ILHEP) are 

pleased to provide comments pertaining to the Public Listening Session regarding the Confidentiality of 

Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2 ("Part 2 Regulations"). Lincoln Land 

Health Information Exchange, LLC (LLHIE, founded 2011) and Illinois Health Exchange Partners, LLC 

(ILHEP, founded 2012) together provide HIE services across more than 35 counties in central and southern 

Illinois. 

Multiple regional acute care hospitals, critical access and rural community hospitals, rural health clinics, 

Federally Qualified Health Centers, substance abuse and mental and behavioral health providers, long term 

care facilities, home health providers, and several primary care and multi-specialty clinics in the region 

participated in the planning process to establish these provider-led HIEs. Across these organizations, more 

than 75 clinical departments and 200 individuals participated to help determine how to improve the efficiency, 

effectiveness, and reliability ofhealthcare information exchange. LLHIE and ILHEP have separate 

governance structures to reflect the unique markets they serve, but share technology, infrastructure, and 

staffing resources. 

LLHIE and ILHEP started with a transaction delivery model for clinical information exchange, and is 

currently operational for EMR-integrated results delivery, referrals, and transitions of care and are in the 

process ofimplementing population health management tools and a federated community health record, which 

will be live early next year. 

We would like to thank SAMHSA for its willingness to consider revisions to the Part 2 Regulations. We share 

SAMHSA's commitment to protecting the privacy and security of information related to an individual's 

substance abuse treatment. We know firsthand the challenges oftrying to comply with the Part 2 Regulations 

while also promoting the availability of health information electronically via a Health Information Exchange 

("HIE"). Our comments to the proposed regulatory changes are grounded in our own experience with 

developing and operating an HIE in which all parties are committed, through a common trust framework, to 

exchange health information electronically in a safe and secure manner that protects the confidentially of all 

patients. We believe that our experience makes us well situated to offer comments to SAMHSA as it 

considers changes to the Part 2 Regulations. 

In the enclosed document, we offer our comments and recommendations regarding five of the seven topics 

addressed in the Public Listening Session held on June 11, 2014. While we think that many ofthe proposed 

changes could help to address the impediments to the electronic exchange of substance abuse information, we 

do not think that these changes are sufficient. We respectfully suggest that SAMHSA consider, and 

recommend to Congress, that the Part 2 Regulations and the enabling legislation be repealed. The public 

c/o Southern Illinois Healthcare Foundation 

2041 Goose Lake Road, Sauget, IL 62206 

Phone(618)332-0694 I Fax(618)332-0903 
policy drivers which led to the creation of the Part 2 confidentiality protections in the 1970's have been met 

through other, more comprehensive, legislative initiatives. The legislative history of the underlying statute and 

SAMHSA' s own 2010 FAQs make it clear that the Part 2 Regulations were enacted due to the need to protect 

the confidentiality of substance abuse treatment information so that patients would not be deterred from 

seeking treatment and would not be the subject of discrimination based on their substance abuse history. When 

Congress enacted the statutory protections for substance abuse records in 1972 and directed the Secretary to 

promulgate the Part 2 Regulations, there was no comprehensive federal legal framework for the protection of 

health information. The statute and the Part 2 Regulations appropriately filled this gap and provided patients 

of federally assisted substance abuse treatment facilities with assurance that their records were protected from 

improper disclosure. Today there is a robust set of laws and regulations, at the federal and the state level, that 

are specifically focused on protecting the privacy and security of health information. Congress, in 1996, 

passed the Health Insurance Portability and Accountability Act ("HIP AA"), which created a comprehensive 

federal statutory framework for the privacy and security of all individually identifiable health information 

related to past, present or future medical conditions. The Department of Health and Human Services ("lllfS")

promulgated the HIPAA Privacy Rule in 2000, which imposed very specific requirements on IIlPAA covered 

entities to protect the privacy of all Protected Health Information, including substance abuse treatment 

information. HHS promulgated the HIPAA Security Rule in 2003 which defined an extensive set of technical, 

physical and administrative safeguards for covered entities and their business associates to follow to assure 

that PHI is secure. HIPAA was expanded in 2009 by the HITECH Act to cover many non-healthcare 

providers, like HIEs, and make them subject to both the Privacy and the Security requirements of HIPAA. 

HHS also adopted the Breach Notification Rule in 2009 which imposed specific requirements on the content 

and timing of reporting suspected data breaches under HIPP A The HIP AA Omnibus Rule, promulgated in 

2013, further strengthened HIPAA protections including an expansion of the breach reporting requirements. 

We respectfully submit that the legitimate confidentiality interests of persons who obtain treatment of 

substance abuse issues are adequately protected by HIP AA and the Privacy Rule, as amended by HITECH and 

the HIP AA Omnibus Rule. We believe that the Part 2 statute and regulations simply create unnecessary 

confusion and actually deprive substance abuse patients of the benefits of electronic health information 

exchange. 

Thank you for your consideration. 

Respectfully submitted, 

Stephen J. Lawrence, Executive Director 

Lincoln Land Health Information Exchange 

Illinois Health Exchange Partners 

David Graham, M.D., Board Chair Lincoln Land Health Information Exchange and 

Senior Vice President/Chief Information Officer/Chief Medical Information Officer, Memorial Health 

System 

Tom Mikkelson, M.D., Board Chair lliinois Health Exchange Partners and 

Chief Operating Officer, Touchette Regional Hospital 

/ln 

2 
APPLICABILITY OF420.RPMT2 

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. 

Covered information could be defined based on what substance abuse treatment services are 

provided instead of being defined by the type of facility providing the services. 

FR Citation: 79 FR 26930 

Questions: 

• VHow would redefining the applicability of 42 CFR Part 2 impact patients, health care

provider organizations, HI Es, CCOs, HIT vendors, etc.?

• VWould this change address stakeholder concerns?

• VWould this change raise any new concerns?

Public Comment Field: 

As discussed in our transmittal letter, we believe the Part 2 Regulations are no longer needed to 

adequately protect the confidentiality of substance abuse records. When Congress enacted the 

statutory protections for substance abuse records in 1972 and directed the Secretary to promulgate 

the Part 2 Regulations, there was no comprehensive federal legal framework for the protection of 

health information. The statute and the Part 2 Regulations appropriately filled this gap and provided 

patients of federally assisted substance abuse treatment facilities with assurance that their records 

were protected from improper disclosure. 

In 1996, Congress passed HIPAA which created a comprehensive federal statutory framework for the 

privacy and security of all individually identifiable health information related to past, present or future 

medical conditions. The U.S. Department of Health and Human Services ("HHS") promulgated the 

HIPAA Privacy Rule in 2000 which imposed very specific requirements on HIPAA covered entities to 

protect the privacy of all Protected Health Information ("PHI"), including substance abuse treatment 

information. HHS promulgated the HIPAA Security Rule in 2003 which defined an extensive set of 

technical, physical and administrative safeguards that covered entities and their business associates 

should follow to assure that PHI is secure. HIPAA was expanded in 2009 by the HITECH Act to cover 

many non-healthcare providers, like HI Es, and make them subject to both the Privacy and the Security 

requirements of HIPAA. HHS also adopted the Breach Notification Rule in 2009 which imposed 

specific requirements on the content and timing of reporting suspected data breaches under HIPAA. 

The HIPAA Omnibus Rule, promulgated in 2013, further strengthened HIPAA protections including an 

expansion of the breach reporting requirements. Together these laws and regulations provide a 

comprehensive set of protections for all forms of PHI, including substance abuse information. We 

respectfully submit that the legitimate confidentiality interests of persons who obtain treatment of 

substance abuse issues are adequately protected by HIPAA and the Privacy Rule, as amended by 

HITECH and the HIPAA Omnibus Rule. Clearly, the legal and regulatory environment is very different 

today than it was in 1972. Maintaining a separate, and different, legal standard for substance abuse 

records is no longer necessary. 

Today, HIPM covered entities and their business associates must comply with both HIPAA and the 

3 
APPUCAll&.m OF 42 CFR PAAT 2 

Part 2 Rules if they maintain any substance abuse records that are governed by Part 2. The 

requirement to comply with both sets of rules creates confusion about which rules apply to which 

records. Despite the various educational documents and FAQs published by SAMHSA which try to 

clarify the scope of the Part 2 Rules, there is still a lot of confusion about the applicability of the Part 2 

Rules. We know that many health care providers err on the side of caution and segregate all records 

that might contain any substance abuse information about a patient for fear of violating the Part 2 

Rules. This ultra-conservative approach is understandable from a compliance perspective but is 

detrimental to effective patient care. It results in relevant clinical information about substance abuse 

not being available to those who treat patients even though that information is not covered by the 

Part 2 Rules. Timely access to complete and accurate clinical information is one of the key reasons the 

federal government has invested so heavily in promoting the widespread adoption and use of certified 

Electronic Health Record ("EHR") technology. The success of ACOs, medical homes, population health 

programs and other important national priorities depend upon health care providers, payers and care 

coordinators having access to complete clinical information about a patient. While this was never the 

intent, the fact is that the Part 2 Rules have resulted in important clinical information related to 

patients' substance abuse conditions and treatment being kept away from those who legitimately 

need it. Therefore, we urge SAMHSA to recommend that Congress repeal the statute. 

We understand that this decision rests with Congress and not the agency. Therefore, in the interim, 

we suggest that the Part 2 Regulations be modified to narrow the scope to apply only to inpatient 

substance abuse treatment provided in a dedicated substance abuse facility or unit that is federally 

funded. Today, there can be some Part 2 information in the inpatient record, the outpatient record 

and the physician office record. Even though the Part 2 information is only a small part of the total 

information in the record, the entire record is often withheld from being exchanged through an HIE 

due to the inability to detect and remove only the Part 2 information. Based on our experience, we 

know that most EHRs can identify records that come from a specific location, like an inpatient 

substance abuse facility, and can prevent those records from being disclosed while allowing other 

records to be made available. Most EHRs do not currently have the ability to segregate records with 

substance abuse data without a specific identifier, such as the location of service. Narrowing the 

applicability of the Part 2 Rules to inpatient substance abuse facilities will result in more health care 

providers being comfortable participating in HIEs and actually sharing their data since there will be 

less risk of an improper disclosure of Part 2 information. This will enable more exchange of health 

information for these patients which will result in greater continuity of care and a higher quality of 

patient care. We stress that this is an interim solution only since a lot of important clinical information 

would still be excluded from electronic sharing. However, we think that this is an implementable 

interim step while Congress considers the repeal of the law. 

It is very important that SAMHSA clarify that any revisions to the regulations do not result in the 

applicability of the regulations actually being broader than it is today. We are very concerned that any 

revision which ties the applicability of the Part 2 Regulations to substance abuse services rather than 

the facility where the services are provided could result in the regulations being applicable to a much 

broader range of providers than are currently included under the Part 2 Regulations. We do not 

believe it is SAMHSA's intent to broaden the scope of Part 2 Regulations, but are concerned that it 

may be an unintended consequence should the applicability be redefined to services rather than the 

type of facility. SAMHSA has asked three specific questions about redefining the applicability of the 

Part 2 Regulations from a facility-based framework to a services-based framework. We have 

addressed those questions in our narrative above, but to avoid any confusion we can summarize our 

4 
	 

	 

	 

o,42CFRPART2 

comments as follows: 

•	 How would redefining the applicability of 42 CFR Part 2 impact patients, health care 

provider organizations, HI Es, CCOs, HIT vendors, etc.? 

If the Part 2 Regulations are not repealed, they should be narrowed as much as possible in order 

to allow health care provider organizations, HIEs, CCOs, and others that have a legitimate 

HIPAA-compliant reason to use and disclose substance abuse records to do so using electronic 

exchange technology. We suggest that the Part 2 Regulations be narrowed to inpatient care 

only, since records from those facilities can be identified and segregated using current EHR 

technology. While this is not an optimal solution, it is substantial progress that would be 

immediately beneficial to health care providers and others. 

•	 Would this change address stakeholder concerns? 

Narrowing the applicability of Part 2 to inpatient only does address the concern of those 

stakeholders that insist that substance abuse records must be treated differently than other 

types of "sensitive health information" such as HIV information and behavioral health 

information. While we do not agree that this is correct, we understand that these stakeholders 

sincerely believe that this is necessary. 

•	 Would this change raise any new concerns? 

Changing the applicability requirement to a services-based framework creates a significant risk 

of unintentionally expanding the scope of the Part 2 Regulations to cover more substance abuse 

records than the law currently covers. As discussed above, we are concerned that this will lead 

to more confusion about the applicability of the Part 2 Regulations and will further restrict 

access to substance abuse records by those who have a legitimate and HIPAA-compliant need to 

use and disclose them. 

5 
CoNSENT REClulREMENTS 

While technical solutions for managing consent collection are possible, SAMHSA is examining 

the consent requirements in § 2.31 to explore options for facilitating the flow of information 

within the health care context while ensuring the patient is fully informed and the necessary 

protections are in place. Specifically, we are analyzing the current requirements and 

considering the impact of adapting them to: 

1. ... Allow the consent to include a more general description of the individual, 

organization, or health care entity to which disclosure is to be made. 

2. ... Require the patient be provided with a list of providers or organizations that may 

access their information, and be notified regularly of changes to the list. 

3. ... Require the consent to name the individual or health care entity permitted to 

make the disclosure. 

4. ... Require that if the health care entity permitted to make the disclosure is made 

up of multiple independent units or organizations that the unit, organization, or 

provider releasing substance abuse related information be specifically named. 

5. ... Require that the consent form explicitly describe the substance abuse treatment 

information that may be disclosed. 

FR Citation: 79 FR 26931 

Questions: 

• Would these changes maintain the privacy protections for patients? 

• Would these changes address the concerns of HIEs, health homes, ACOs, and CCOs? 

• Would these changes raise any new concerns? 

Public Comment Field: 

We agree that the consent requirements in the Part 2 Regulations must be substantially revised in 

order for Part 2 records to be exchanged using HIEs and other electronic health networks. Today, 

most HI Es require that their data sources exclude any records from Part 2 providers in order to avoid 

the possibility of accidentally disclosing substance abuse records without a Part 2 compliant consent. 

We also know that many health care providers treat all substance abuse records as if they are covered 

by the Part 2 Regulations because of widespread confusion about the applicability of Part 2 and 

because it is simply too complicated to maintain one consent management process for Part 2 records 

and another consent management process for other substance abuse records. This means that health 

care providers are being denied access to important information about a patient's substance abuse 

treatment. This does not benefit patients, providers, or the healthcare system as a whole. 

The requirements of a Part 2 compliant consent are simply incompatible with participants in an HIE 

being able to query for patient records. We believe that SAMHSA understands this. While we 

appreciate SAMHSA's efforts to address this problem, we believe the alternatives which SAMHSA has 

identified are not sufficient because they are still based on a "point to point" model of information 

6 
Consent Requirements Ó



exchange. Let's consider each of the suggested revisions to the Part 2 consent requirements to see 

why they do not address the problem. 

1. ? Allow the consent to include a more general description of the individual, organization, 

or health care entity to which disclosure is to be made. 

Modifying the Part 2 consent requirement to only require a "general description" of the person 

or organization to whom the disclosure is being made does not address one of the core 

problems that HIEs face today. When a Part 2 provider makes its records available through an 

HIE to be queried by the HIE Participants (who have all signed an HIE trust agreement and are 

bound by the privacy and security requirements of the HIE), the Part 2 provider does not know 

which of those participants is going to submit a query for the records. Simply allowing a more 

general description of the individual, organization or health care provider to which the 

disclosure is made is not going to resolve this problem. 

2. ? Require the patient be provided with a list of providers or organizations that may access 

their information, and be notified regularly of changes to the list. 

This suggested revision is certainly a step in the right direction. HI Es can make available a list of 

their participants that health care providers can give to patients. The problem with this 

approach is that most HI Es have agreements with other HIEs (sometimes referred to as "Partner 

Networks") that expand the number of data sources available to the HIE's participants thereby 

increasing the value of the HIE participation. HI Es will not be able to make participant lists for 

all of its Partner Networks available without incurring substantial costs that the HIEs cannot 

afford. 

3. ? Require the consent to name the individual or health care entity permitted to make the 

disclosure. 

This requirement will prevent Part 2 records from being made available by Part 2 providers for 

exchange through HIEs. When a health care provider obtains a patient's consent for records, 

the provider may not know that there are Part 2 records or will almost certainly not know where 

those records are located. This is one of the primary drivers behind the "query" based exchange 

model of electronic health information exchange; to allow those who are treating a patient to 

discover relevant records about the patient from multiple sources without having to establish 

individual point to point data sharing agreements. HIEs are not based on point to point 

exchange relationships in which both the party requesting the record and the party disclosing 

the record are known. 

One of the primary reasons we are involved in HIE activity is because it is not possible to 

develop and support the large number of "point to point" exchanges that we need. This is not a 

new conclusion; the federal government realized this many years ago when it embarked on 

developing the Nationwide Health Information Exchange, now called the eHealth Exchange. If 

the Part 2 compliant consent continues to require the identity of each discloser and recipient 

and a patient consent for each exchange, then most HIEs will continue to not support the 

exchange of substance abuse records. It would be possible for HI Es to provide a list all of its HIE 

participants, which would serve to identify who might be asked to disclose Part 2 records of hey 

7 
CoNHN'T REQUIREMEN'JS 

have them 

4. / Require that If the health care entity permitted to make the disclosure is made up of 

multiple mdependent un;ts or organizations that the unit, organization, or provider 

releasing substance abuse related information be spedfically named. 

The model that nearly all HIEs follow is that the HIE enters into a trust agreement with heath 

care providers or other organizations that serve as participants in the HIE. Health care provider 

organizations made up of multiple units or organizations will decide which of these is the proper 

party to become an HIE participant. In some cases this is the ultimate parent organization while 

in other cases it is one, or more, of the subsidiaries. HI Es should be able to provide a list of all 

participants, but this is not necessarily going to list every source of information within complex 

health care provider organizations. Therefore, we believe that this requirement will deter the 

ability of HI Es to exchange substance abuse records. 

5. È Require that the consent form explicitly describe the substance abuse treatment È



information that may be disclosed. È



We do not know what is meant by "explicitly describe" and would like to better understand 

what SAMHSA means by this. However, one of the great benefits of HIEs is that they allow 

participants to seek information about their patients without knowing exactly what information 

exists or who has the information. This allows the treating health care provider to obtain a 

more complete picture of a patient's medical information which improves the quality of care the 

provider can deliver. If SAMHSA retains the requirement that the Part 2 compliant consent 

identify the information being sought, this will defeat one of the key benefits of an HIE. 

We appreciate that SAMHSA is exploring ways in which to revise the requirements of a Part 2 

compliant consent while retaining the basic model. As we have already discussed, we recommend 

that the Part 2 Regulations be repealed. If that does not occur, we recommend that the Part 2 

consent requirements be revised to incorporate a tiered approach to patient consent. If the purpose 

of the disclosure is for treatment, payment or health care operations (as defined by HIPAA, "TPO") 

then a HIPAA-like general consent would be sufficient to support disclosure of Part 2 records. For 

those disclosures that are not for TPO purposes, we believe a higher level of documentation should be 

required. For these situations, we would support maintaining the current requirements for a Part 2 

compliant consent. We believe that this is a reasonable approach because it leverages the extensive 

legal framework that HIPAA has created. This legal framework has been in place for 14 years and has 

effectively protected PHI from improper use and disclosure. It is familiar to those who hold and use 

PHI since they are either HIPAA covered entities or business associates of covered entities. Most H!Es 

have trust agreements with their participants that require the participant to comply with the HIE's 

policies and procedures on privacy and security. Most HIEs require a treatment relationship with the 

patient before a query for information can be initiated by an HIE participant. All of this assures that 

records are not being queried for improper purposes. 

8 
Redisclosure p 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on 

redisclosure only applies to information that would identify an individual as a substance 

abuser, and allows other health-related information shared by the Part 2 program to be 

redisclosed, if legally permissible. This would allow HIT systems to more easily identify 

information that is subject to the prohibition on redisclosure enabling them to utilize other 

technological approaches to manage redisclosure. If data are associated with information 

about where the data were collected (data provenance) which reveals that the data were 

collected by a practice that exclusively treats addiction, the data would still be protected under 

the proposed change. 

FR Citation: 79 FR 26931 

Questions: 

• p Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 

in an EHR or HIE environment? 

• p Would these changes maintain the privacy protections for patients? 

Public Comment Field: 

We appreciate SAMHSA's willingness to consider revising the Part 2 redisclosure prohibition in order 

to limit it only to information that would identify the patient as a substance abuser. Based on our 

experience, we do not think that this approach is supported today by health information technology 

and it might take some time for that to occur. The technology that drives the exchange of health 

information today is very sophisticated when compared to what existed only 20 years ago. The ability 

to create software interfaces that allow discrete systems to communicate (i.e., interoperability) has 

opened the door for HIEs and other information sharing models. The development of patient 

matching algorithms, such as Master Patient Indexes ("MPls"), and the ability to use Record Locator 

Services to quickly search through vast amounts of data to find relevant information has truly 

revolutionized health IT. 

Even with these amazing advances, however, we still struggle with identifying and isolating specific 

data elements within a patient record. While "discrete" data, such as a lab result, that has its own 

unique digital label can be identified and isolated, this is not yet widely possible with "non-discrete" or 

"free text" data. This means that text which identifies a patient as a substance abuser cannot be 

identified and removed from key clinical documents such as History and Physical, Discharge 

Summaries, Procedure Notes, or narrative imaging reports. These records might contain information 

that identifies the patient as a substance abuser and could not be rediscfosed under SAMHSA's 

suggested revision. We do know that several companies are working very hard to develop software 

that will scan free text documents for key terms and then redact them. This work has been spurred on 

by the Part 2 Regulations but it has proven to be more difficult than many expected. We do not think 

that revising the redisclosure rule will accelerate the technical solution. 

Part 2 providers have largely chosen to not participate in HIEs due to the requirement of the Part 2 

compliant consent. This means that their records are not available to other HIE participants to query, 

9 
MEDtcALEMERGENCV 

SAMHSA is considering adapting the medical emergency exception to make it more in-line with 

the statutory language and to give providers more discretion as to when a bona fide 

emergency exists. For example, amending this standard to allow providers to use the medical 

emergency provision to prevent emergencies or to share information with a detoxification 

center when a patient is unable to provide informed consent due to their level of intoxication. 

FR crratlon: 79 FR 26931 

Questions: 

• What factors should providers take into consideration in determining whether a medical

emergency exists?

• Are there specific use cases SAMHSA should take into consideration? Show citation box

• Are there patient concerns about the impact of this change on their privacy?

Public Comment Field: 

We support SAMHSA's recommendation that the emergency exception be revised to match the 

statutory language of a "bona fide medical emergency." This will give providers the flexibility to seek 

substance abuse records when they are truly needed to treat the patient or to prevent harm to the 

patient. We do not believe that this should be limited to specific use cases since this will create more 

confusion about which rule applies when. 

10 

Redisclosure

even in a treatment situation. This means that patients are suffering because their health care 

providers do not have access to important clinical information that would be useful to the provider in 

the treatment of the patient. We are very concerned that the suggested revision to the rule will serve 

only to continue forcing Part 2 providers, and others that maintain records which contain substance 

abuse information, to withhold those records for fear that they will be improperly redisclosed. This is 

not beneficial to the patient. 

Our recommendation is to remove the redisclosure prohibition for any recipient who is required to 

comply with HIPAA. This would include all covered entities, all business associates, and those who are 

contractually required to comply with HIPAA that are not already either covered entities or business 

associates. As a discloser, I know that the recipient is subject to HIPAA and that they will not 

redisclose this information except as permitted by HIPAA. For requesters of information that are not 

subject to HIPAA, either by virtue of being a covered entity or a business associate or by contract, we 

are comfortable with retaining the Part 2 redisclosure prohibition. Covered entities and business 

associates, including HIEs, are already familiar with the HIPAA rules related to redisclosure and have 

incorporated these rules into their daily operations. It is already difficult for them to comply with the 

stringent Part 2 Regulations today with paper records. It is virtually impossible for them to do so with 

electronic records. 
11 

Medical Emergency

We also urge SAMHSA to substantially lessen the documentation requirement on the Part 2 provider 

when it releases records for an emergency. The Part 2 Regulation requires the Part 2 provider to 

document the following: 

• The name and affiliation of the medical personnel to whom the disclosure was made;

• The name of the individual making the disclosure;

• The date and time of the disclosure; and

• The nature of the emergency.

In a traditional point to point model, where the requester of the data is in direct contact with the Part 

2 provider, it might be feasible to obtain this information. However, in a medical emergency time is of 

the essence and delays in obtaining potentially critical information could mean the difference 

between life and death for the patient. An HIE allows the emergency provider to send a query 

seeking all relevant records for the patient that are available from other HIE participants and any 

partner networks. This information can be returned immediately. The documentation requirements 

of the Part 2 Regulation will interrupt the response to a query by Part 2 providers. The risk to the 

patient is clear, that important medical information might not be available in a timely fashion, not 

because of barriers in technology but because of policy barriers. This should not be allowed to be the 

case, especially since there are alternatives that allow for timely access to clinical information without 

compromising the patient's privacy. Unlike paper records, EMRs allow us to track every time records 

are viewed which provides even more protection to the patient. While the documentation 

requirements in medical emergencies certainly served a purpose decades ago, we firmly believe that it 

no longer does. Therefore, we urge SAM HSA to eliminate these requirements. 
Public Comment Field: 

We certainly support the expansion of the types of organizations that are included as QSOs. However, 

we believe that the entire construct of the QSO and the QSOA has been superseded by HIPAA and the 

business associate rule. When the Part 2 Regulations were promulgated, the concept of a trusted 

partner for sharing clinical information was a new concept. That is no longer the case. We have 14 

years of experience with the HIPAA Privacy Rule's business associate provisions. The definition of who 

is a business associate, and their obligations, has been expanded over time, most recently by the 

HIPAA Omnibus Final Rule that was finalized in 2013. SAMHSA has made it clear that Part 2 providers 

are required to comply with both the HIPAA business associate requirements and the Part 2 QSO 

requirements. We do not believe there is any reason to maintain this parallel structure any longer. 

The Privacy Rule's requirements for Business Associate Agreements are very extensive and are actually 

broader than the Part 2 QSO requirements. Therefore, we see no reason to continue to require HIPAA 

covered entities to maintain both BAAs and QSOAs. 

If SAMHSA decides to continue the QSO framework, then we strongly support expanding the 

definition of a QSO to include those involved in care coordination. We recommend a broadly worded 

I definition of "care coordination" to allow flexibility to include medical home, ACOs, population health I initiatives, and other innovative models. 

12 

Qualified Service Organization (QSO)

SAMHSA is analyzing the regulations to identify options for allowing Part 2 data to flow to 

health care entities for the purpose of care coordination and population management while 

maintaining patient protections. One potential solution includes expanding the definition of a 

qualified service organization (QSO; § 2.11) to explicitly include care coordination services and 

to allow a QSO Agreement (QSOA) to be executed between an entity that stores Part 2 

information, such as a payer or an ACO that is not itself a Part 2 program, and a service 

provider. 

j FR Citation: 79 FR 26931 

Questions: 

• Are there other use cases we should be taking into consideration?

• Are there specific patient concerns about the impact of this change on their privacy?
RaeAICH 

SAMHSA is considering expanding the authority for releasing data to qualified 

researchers/research organizations to health care entities that receive and store Part 2 data, 

including third-party payers, health management organizations, HI Es, and care coordination 

organizations. 

FR Citation: 79 FR 26932 

Questions: 

• Are there factors that should be considered related to how current health care entities are

organized, how they function or how legal duties and responsibilities attach to entities that

make up an umbrella organization?

• Would this change address concerns related to research?

• Are there specific privacy concerns associated with expanding the authority or releasing data to

qualified researchers/research organizations in this way?

• Are there additional use cases that should be considered in the research context?

Public Comment Field: 

No comments 

13 
AoolmlNG PomfTtAt lssUBwmt E1KTloNtc PmallaiN&MD PusauPn0N DRu8 

MONITORING PROGMMs(PDM Ps) 

Part 2 protections include a prohibition on the redisclosure of information received directly 

from a Part 2 program. A pharmacy that receives electronic prescription information directly 

from a Part 2 program must obtain patient consent to send that information to a PDMP, and 

patient consent is also required for the PDMP to redisclose that information to those with 

access to the PDMP.

FR Citation: 79 FR 26932 

Questions: 

• How do pharmacy information system vendors anticipate addressing this issue? Are there

specific technology barriers SAMHSA should take into consideration?

• Are there other concerns regarding 42 CFR Part 2 and PDMPs? Please describe relevant use

cases and provide recommendations on how to address the concerns.

• Are there patient concerns about the impact of e-prescribing and PDMPs on their privacy?

Public Comment Field: 

No comments 

14 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

June 25, 2014 

The Substance Abuse and Mental Health Services Administration 

Attention: Public Listening Session Comments 

1 Choke Cherry Road 

Room 5-1011 

Rockville, Maryland 20857 

PrivacyRegulations@SAMHSA.hhs.gov 

Dear Sir or Madam: 

Mary Washington Hospital Snowden at Fredericksburg is pleased to provide comments pertaining to the 

Public Listening Session regarding the Confidentiality of Alcohol and Drug Abuse Patient Records 

Regulations, 42 CFR Part 2 (“Part 2 Regulations”). Mary Washington Hospital has a long history of 

providing psychiatric services to the Fredericksburg region, dating back more than 115 years. Snowden at 

Fredericksburg, developed in 1991, is a 40 bed inpatient and outpatient behavioral health facility 

supporting adult and adolescent patients with psychiatric and chemical dependency. As a not-for-profit, 

premier mental health resource, Snowden at Fredericksburg has an unwavering commitment to the 

community. Our experienced behavioral health care providers serve our patients with the utmost 

confidentiality and discretion in a secure and caring environment. 

We would like to thank SAMHSA for its willingness to consider revisions to the Part 2 Regulations. We 

share SAMHSA’s commitment to protecting the privacy and security of information related to an 

individual’s substance abuse treatment. We know firsthand the challenges of trying to comply with the 

Part 2 Regulations while also promoting the availability of health information electronically via a Health 

Information Exchange (“HIE”). Our comments to the proposed regulatory changes are grounded in our 

own experience with developing and operating an HIE in which all parties are committed, through a 

common trust framework, to exchange health information electronically in a safe and secure manner that 

protects the confidentially of all patients. We believe that our experience makes us well situated to offer 

comments to SAMHSA as it considers changes to the Part 2 Regulations. 

In the enclosed document, we offer our comments and recommendations regarding five of the seven 

topics addressed in the Public Listening Session held on June 11, 2014. While we think that many of the 

proposed changes could help to address the impediments to the electronic exchange of substance abuse 

information, we do not think that these changes are sufficient. We respectfully suggest that SAMHSA 

consider, and recommend to Congress, that the Part 2 Regulations and the enabling legislation be 

repealed. The public policy drivers which led to the creation of the Part 2 confidentiality protections in 

the 1970’s have been met through other, more comprehensive, legislative initiatives. The legislative 

history of the underlying statute and SAMHSA’s own 2010 FAQs make it clear that the Part 2 

Regulations were enacted due to the need to protect the confidentiality of substance abuse treatment 

information so that patients would not be deterred from seeking treatment and would not be the subject of 

discrimination based on their substance abuse history. When Congress enacted the statutory 

protections for substance abuse records in 1972 and directed the Secretary to promulgate the Part 

2 Regulations, there was no comprehensive federal legal framework for the protection of health 

information. The statute and the Part 2 Regulations appropriately filled this gap and provided 

patients of federally assisted substance abuse treatment facilities with assurance that their records 

were protected from improper disclosure. Today there is a robust set of laws and regulations, at 

the federal and the state level, that are specifically focused on protecting the privacy and security 

of health information. Congress, in 1996, passed the Health Insurance Portability and Accountability 

Mary Washington Healthcare 
 

 

 

 

 

June 25, 2014 

Mary Washington Healthcare 

Comments on Public Listening Session re: Confidentiality of Part 2 Records 

Act (“HIPAA”), which created a comprehensive federal statutory framework for the privacy and security 

of all individually identifiable health information related to past, present or future medical conditions. 

The Department of Health and Human Services (“HHS”) promulgated the HIPAA Privacy Rule in 2000, 

which imposed very specific requirements on HIPAA covered entities to protect the privacy of all 

Protected Health Information, including substance abuse treatment information. HHS promulgated the 

HIPAA Security Rule in 2003 which defined an extensive set of technical, physical and administrative 

safeguards for covered entities and their business associates to follow to assure that PHI is secure. 

HIPAA was expanded in 2009 by the HITECH Act to cover many non-healthcare providers, like HIEs, 

and make them subject to both the Privacy and the Security requirements of HIPAA. HHS also adopted 

the Breach Notification Rule in 2009 which imposed specific requirements on the content and timing of 

reporting suspected data breaches under HIPPA. The HIPAA Omnibus Rule, promulgated in 2013, 

further strengthened HIPAA protections including an expansion of the breach reporting requirements. 

We respectfully submit that the legitimate confidentiality interests of persons who obtain treatment of 

substance abuse issues are adequately protected by HIPAA and the Privacy Rule, as amended by 

HITECH and the HIPAA Omnibus Rule. We believe that the Part 2 statute and regulations simply create 

unnecessary confusion and actually deprive substance abuse patients of the benefits of electronic health 

information exchange. 

Thank you for your consideration. 

With appreciation, 

Joyce Hanscome 

SVP/CIO 

2 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Mary Washington Healthcare 

Comments on Public Listening Session re: Confidentiality of Part 2 Records 

APPLICABILITY OF 42 CFR PART 2 

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. 

Covered information could be defined based on what substance abuse treatment services are 

provided instead of being defined by the type of facility providing the services. 

FR Citation: 79 FR 26930 

Questions: 

• How would redefining the applicability of 42 CFR Part 2 impact patients, health care 

provider organizations, HIEs, CCOs, HIT vendors, etc.? 

• Would this change address stakeholder concerns? 

• Would this change raise any new concerns? 

Public Comment Field: 

As discussed in our transmittal letter, we believe the Part 2 Regulations are no longer needed to 

adequately protect the confidentiality of substance abuse records. When Congress enacted the 

statutory protections for substance abuse records in 1972 and directed the Secretary to promulgate 

the Part 2 Regulations, there was no comprehensive federal legal framework for the protection of 

health information. The statute and the Part 2 Regulations appropriately filled this gap and provided 

patients of federally assisted substance abuse treatment facilities with assurance that their records 

were protected from improper disclosure. 

In 1996, Congress passed HIPAA which created a comprehensive federal statutory framework for the 

privacy and security of all individually identifiable health information related to past, present or future 

medical conditions. The U.S. Department of Health and Human Services (“HHS”) promulgated the 

HIPAA Privacy Rule in 2000 which imposed very specific requirements on HIPAA covered entities to 

protect the privacy of all Protected Health Information (“PHI”), including substance abuse treatment 

information. HHS promulgated the HIPAA Security Rule in 2003 which defined an extensive set of 

technical, physical and administrative safeguards that covered entities and their business associates 

should follow to assure that PHI is secure. HIPAA was expanded in 2009 by the HITECH Act to cover 

many non-healthcare providers, like HIEs, and make them subject to both the Privacy and the Security 

requirements of HIPAA. HHS also adopted the Breach Notification Rule in 2009 which imposed 

specific requirements on the content and timing of reporting suspected data breaches under HIPAA. 

The HIPAA Omnibus Rule, promulgated in 2013, further strengthened HIPAA protections including an 

expansion of the breach reporting requirements. Together these laws and regulations provide a 

comprehensive set of protections for all forms of PHI, including substance abuse information. We 

respectfully submit that the legitimate confidentiality interests of persons who obtain treatment of 

substance abuse issues are adequately protected by HIPAA and the Privacy Rule, as amended by 

HITECH and the HIPAA Omnibus Rule. Clearly, the legal and regulatory environment is very different 

today than it was in 1972. Maintaining a separate, and different, legal standard for substance abuse 

records is no longer necessary. 

Today, HIPAA covered entities and their business associates must comply with both HIPAA and the 

Part 2 Rules if they maintain any substance abuse records that are governed by Part 2. The 

3 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Mary Washington Healthcare 

Comments on Public Listening Session re: Confidentiality of Part 2 Records 

APPLICABILITY OF 42 CFR PART 2 

requirement to comply with both sets of rules creates confusion about which rules apply to which 

records. Despite the various educational documents and FAQs published by SAMHSA which try to 

clarify the scope of the Part 2 Rules, there is still a lot of confusion about the applicability of the Part 2 

Rules. We know that many health care providers err on the side of caution and segregate all records 

that might contain any substance abuse information about a patient for fear of violating the Part 2 

Rules. This ultra-conservative approach is understandable from a compliance perspective but is 

detrimental to effective patient care. It results in relevant clinical information about substance abuse 

not being available to those who treat patients even though that information is not covered by the 

Part 2 Rules. Timely access to complete and accurate clinical information is one of the key reasons the 

federal government has invested so heavily in promoting the widespread adoption and use of certified 

Electronic Health Record (“EHR") technology. The success of ACOs, medical homes, population health 

programs and other important national priorities depend upon health care providers, payers and care 

coordinators having access to complete clinical information about a patient. While this was never the 

intent, the fact is that the Part 2 Rules have resulted in important clinical information related to 

patients’ substance abuse conditions and treatment being kept away from those who legitimately 

need it. Therefore, we urge SAMHSA to recommend that Congress repeal the statute. 

We understand that this decision rests with Congress and not the agency. Therefore, in the interim, 

we suggest that the Part 2 Regulations be modified to narrow the scope to apply only to inpatient 

substance abuse treatment provided in a dedicated substance abuse facility or unit that is federally 

funded. Today, there can be some Part 2 information in the inpatient record, the outpatient record 

and the physician office record. Even though the Part 2 information is only a small part of the total 

information in the record, the entire record is often withheld from being exchanged through an HIE 

due to the inability to detect and remove only the Part 2 information. Based on our experience, we 

know that most EHRs can identify records that come from a specific location, like an inpatient 

substance abuse facility, and can prevent those records from being disclosed while allowing other 

records to be made available. Most EHRs do not currently have the ability to segregate records with 

substance abuse data without a specific identifier, such as the location of service. Narrowing the 

applicability of the Part 2 Rules to inpatient substance abuse facilities will result in more health care 

providers being comfortable participating in HIEs and actually sharing their data since there will be 

less risk of an improper disclosure of Part 2 information. This will enable more exchange of health 

information for these patients which will result in greater continuity of care and a higher quality of 

patient care. We stress that this is an interim solution only since a lot of important clinical information 

would still be excluded from electronic sharing. However, we think that this is an implementable 

interim step while Congress considers the repeal of the law. 

It is very important that SAMHSA clarify that any revisions to the regulations do not result in the 

applicability of the regulations actually being broader than it is today. We are very concerned that any 

revision which ties the applicability of the Part 2 Regulations to substance abuse services rather than 

the facility where the services are provided could result in the regulations being applicable to a much 

broader range of providers than are currently included under the Part 2 Regulations. We do not 

believe it is SAMHSA’s intent to broaden the scope of Part 2 Regulations, but are concerned that it 

may be an unintended consequence should the applicability be redefined to services rather than the 

type of facility. SAMHSA has asked three specific questions about redefining the applicability of the 

Part 2 Regulations from a facility-based framework to a services-based framework. We have 

addressed those questions in our narrative above, but to avoid any confusion we can summarize our 

4 
 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Mary Washington Healthcare 

Comments on Public Listening Session re: Confidentiality of Part 2 Records 

APPLICABILITY OF 42 CFR PART 2 

comments as follows: 

• How would redefining the applicability of 42 CFR Part 2 impact patients, health care 

provider organizations, HIEs, CCOs, HIT vendors, etc.? 

If the Part 2 Regulations are not repealed, they should be narrowed as much as possible in order 

to allow health care provider organizations, HIEs, CCOs, and others that have a legitimate 

HIPAA-compliant reason to use and disclose substance abuse records to do so using electronic 

exchange technology. We suggest that the Part 2 Regulations be narrowed to inpatient care 

only, since records from those facilities can be identified and segregated using current EHR 

technology. While this is not an optimal solution, it is substantial progress that would be 

immediately beneficial to health care providers and others. 

• Would this change address stakeholder concerns? 

Narrowing the applicability of Part 2 to inpatient only does address the concern of those 

stakeholders that insist that substance abuse records must be treated differently than other 

types of “sensitive health information” such as HIV information and behavioral health 

information. While we do not agree that this is correct, we understand that these stakeholders 

sincerely believe that this is necessary. 

• Would this change raise any new concerns? 

Changing the applicability requirement to a services-based framework creates a significant risk 

of unintentionally expanding the scope of the Part 2 Regulations to cover more substance abuse 

records than the law currently covers. As discussed above, we are concerned that this will lead 

to more confusion about the applicability of the Part 2 Regulations and will further restrict 

access to substance abuse records by those who have a legitimate and HIPAA-compliant need to 

use and disclose them. 

5 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Mary Washington Healthcare 

Comments on Public Listening Session re: Confidentiality of Part 2 Records 

CONSENT REQUIREMENTS 

While technical solutions for managing consent collection are possible, SAMHSA is examining 

the consent requirements in § 2.31 to explore options for facilitating the flow of information 

within the health care context while ensuring the patient is fully informed and the necessary 

protections are in place. Specifically, we are analyzing the current requirements and 

considering the impact of adapting them to: 

1. Allow the consent to include a more general description of the individual, 

organization, or health care entity to which disclosure is to be made. 

2. Require the patient be provided with a list of providers or organizations that may 

access their information, and be notified regularly of changes to the list. 

3. Require the consent to name the individual or health care entity permitted to 

make the disclosure. 

4. Require that if the health care entity permitted to make the disclosure is made 

up of multiple independent units or organizations that the unit, organization, or 

provider releasing substance abuse related information be specifically named. 

5. Require that the consent form explicitly describe the substance abuse treatment 

information that may be disclosed. 

FR Citation: 79 FR 26931 

Questions: 

• Would these changes maintain the privacy protections for patients? 

• Would these changes address the concerns of HIEs, health homes, ACOs, and CCOs? 

• Would these changes raise any new concerns? 

Public Comment Field: 

We agree that the consent requirements in the Part 2 Regulations must be substantially revised in 

order for Part 2 records to be exchanged using HIEs and other electronic health networks. Today, 

most HIEs require that their data sources exclude any records from Part 2 providers in order to avoid 

the possibility of accidentally disclosing substance abuse records without a Part 2 compliant consent. 

We also know that many health care providers treat all substance abuse records as if they are covered 

by the Part 2 Regulations because of widespread confusion about the applicability of Part 2 and 

because it is simply too complicated to maintain one consent management process for Part 2 records 

and another consent management process for other substance abuse records This means that health 

care providers are being denied access to important information about a patient’s substance abuse 

treatment. This does not benefit patients, providers, or the healthcare system as a whole. 

The requirements of a Part 2 compliant consent are simply incompatible with participants in an HIE 

being able to query for patient records. We believe that SAMHSA understands this. While we 

appreciate SAMHSA’s efforts to address this problem, we believe the alternatives which SAMHSA has 

identified are not sufficient because they are still based on a “point to point” model of information 

exchange. Let’s consider each of the suggested revisions to the Part 2 consent requirements to see 

6 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Mary Washington Healthcare 

Comments on Public Listening Session re: Confidentiality of Part 2 Records 

CONSENT REQUIREMENTS 

why they do not address the problem. 

1. Allow the consent to include a more general description of the individual, organization, 

or health care entity to which disclosure is to be made. 

Modifying the Part 2 consent requirement to only require a “general description” of the person 

or organization to whom the disclosure is being made does not address one of the core 

problems that HIEs face today. When a Part 2 provider makes its records available through an 

HIE to be queried by the HIE Participants (who have all signed an HIE trust agreement and are 

bound by the privacy and security requirements of the HIE), the Part 2 provider does not know 

which of those participants is going to submit a query for the records. Simply allowing a more 

general description of the individual, organization or health care provider to which the 

disclosure is made is not going to resolve this problem. 

2. Require the patient be provided with a list of providers or organizations that may access 

their information, and be notified regularly of changes to the list. 

This suggested revision is certainly a step in the right direction. HIEs can make available a list of 

their participants that health care providers can give to patients. The problem with this 

approach is that most HIEs have agreements with other HIEs (sometimes referred to as “Partner 

Networks”) that expand the number of data sources available to the HIE’s participants thereby 

increasing the value of the HIE participation. HIEs will not be able to make participant lists for 

all of its Partner Networks available without incurring substantial costs that the HIEs cannot 

afford. 

3. Require the consent to name the individual or health care entity permitted to make the 

disclosure. 

This requirement will prevent Part 2 records from being made available by Part 2 providers for 

exchange through HIEs. When a health care provider obtains a patient’s consent for records, 

the provider may not know that there are Part 2 records or will almost certainly not know where 

those records are located. This is one of the primary drivers behind the “query” based exchange 

model of electronic health information exchange; to allow those who are treating a patient to 

discover relevant records about the patient from multiple sources without having to establish 

individual point to point data sharing agreements. HIEs are not based on point to point 

exchange relationships in which both the party requesting the record and the party disclosing 

the record are known. 

One of the primary reasons we are involved in HIE activity is because it is not possible to 

develop and support the large number of “point to point” exchanges that we need. This is not a 

new conclusion; the federal government realized this many years ago when it embarked on 

developing the Nationwide Health Information Exchange, now called the eHealth Exchange. If 

the Part 2 compliant consent continues to require the identity of each discloser and recipient 

and a patient consent for each exchange, then most HIEs will continue to not support the 

exchange of substance abuse records. It would be possible for HIEs to provide a list all of its HIE 

participants, which would serve to identify who might be asked to disclose Part 2 records of hey 

have them 

7 
 

 

 

 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Mary Washington Healthcare 

Comments on Public Listening Session re: Confidentiality of Part 2 Records 

CONSENT REQUIREMENTS 

4. Require that if the health care entity permitted to make the disclosure is made up of 

multiple independent units or organizations that the unit, organization, or provider 

releasing substance abuse related information be specifically named. 

The model that nearly all HIEs follow is that the HIE enters into a trust agreement with heath 

care providers or other organizations that serve as participants in the HIE. Health care provider 

organizations made up of multiple units or organizations will decide which of these is the proper 

party to become an HIE participant. In some cases this is the ultimate parent organization while 

in other cases it is one, or more, of the subsidiaries. HIEs should be able to provide a list of all 

participants, but this is not necessarily going to list every source of information within complex 

health care provider organizations. Therefore, we believe that this requirement will deter the 

ability of HIEs to exchange substance abuse records. 

5. Require that the consent form explicitly describe the substance abuse treatment 

information that may be disclosed. 

We do not know what is meant by “explicitly describe” and would like to better understand 

what SAMHSA means by this. However, one of the great benefits of HIEs is that they allow 

participants to seek information about their patients without knowing exactly what information 

exists or who has the information. This allows the treating health care provider to obtain a 

more complete picture of a patient’s medical information which improves the quality of care the 

provider can deliver. If SAMHSA retains the requirement that the Part 2 compliant consent 

identify the information being sought, this will defeat one of the key benefits of an HIE. 

We appreciate that SAMHSA is exploring ways in which to revise the requirements of a Part 2 

compliant consent while retaining the basic model. As we have already discussed, we recommend 

that the Part 2 Regulations be repealed. If that does not occur, we recommend that the Part 2 

consent requirements be revised to incorporate a tiered approach to patient consent. If the purpose 

of the disclosure is for treatment, payment or health care operations (as defined by HIPAA, “TPO”) 

then a HIPAA-like general consent would be sufficient to support disclosure of Part 2 records. For 

those disclosures that are not for TPO purposes, we believe a higher level of documentation should be 

required. For these situations, we would support maintaining the current requirements for a Part 2 

compliant consent. We believe that this is a reasonable approach because it leverages the extensive 

legal framework that HIPAA has created. This legal framework has been in place for 14 years and has 

effectively protected PHI from improper use and disclosure. It is familiar to those who hold and use 

PHI since they are either HIPAA covered entities or business associates of covered entities. Most HIEs 

have trust agreements with their participants that require the participant to comply with the HIE’s 

policies and procedures on privacy and security. Most HIEs require a treatment relationship with the 

patient before a query for information can be initiated by an HIE participant. All of this assures that 

records are not being queried for improper purposes. 

REDISCLOSURE
 

8 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Mary Washington Healthcare 

Comments on Public Listening Session re: Confidentiality of Part 2 Records 

REDISCLOSURE 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on 

redisclosure only applies to information that would identify an individual as a substance 

abuser, and allows other health-related information shared by the Part 2 program to be 

redisclosed, if legally permissible. This would allow HIT systems to more easily identify 

information that is subject to the prohibition on redisclosure enabling them to utilize other 

technological approaches to manage redisclosure. If data are associated with information 

about where the data were collected (data provenance) which reveals that the data were 

collected by a practice that exclusively treats addiction, the data would still be protected under 

the proposed change. 

FR Citation: 79 FR 26931 

Questions: 

• Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 

in an EHR or HIE environment? 

• Would these changes maintain the privacy protections for patients? 

Public Comment Field: 

We appreciate SAMHSA’s willingness to consider revising the Part 2 redisclosure prohibition in order 

to limit it only to information that would identify the patient as a substance abuser. Based on our 

experience, we do not think that this approach is supported today by health information technology 

and it might take some time for that to occur. The technology that drives the exchange of health 

information today is very sophisticated when compared to what existed only 20 years ago. The ability 

to create software interfaces that allow discrete systems to communicate (i.e., interoperability) has 

opened the door for HIEs and other information sharing models. The development of patient 

matching algorithms, such as Master Patient Indexes (“MPIs”), and the ability to use Record Locator 

Services to quickly search through vast amounts of data to find relevant information has truly 

revolutionized health IT. 

Even with these amazing advances, however, we still struggle with identifying and isolating specific 

data elements within a patient record. While “discrete” data, such as a lab result, that has its own 

unique digital label can be identified and isolated, this is not yet widely possible with “non-discrete” or 

“free text” data. This means that text which identifies a patient as a substance abuser cannot be 

identified and removed from key clinical documents such as History and Physical, Discharge 

Summaries, Procedure Notes, or narrative imaging reports. These records might contain information 

that identifies the patient as a substance abuser and could not be redisclosed under SAMHSA’s 

suggested revision. We do know that several companies are working very hard to develop software 

that will scan free text documents for key terms and then redact them. This work has been spurred on 

by the Part 2 Regulations but it has proven to be more difficult than many expected. We do not think 

that revising the redisclosure rule will accelerate the technical solution. 

Part 2 providers have largely chosen to not participate in HIEs due to the requirement of the Part 2 

compliant consent. This means that their records are not available to other HIE participants to query, 

9 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Mary Washington Healthcare 

Comments on Public Listening Session re: Confidentiality of Part 2 Records 

REDISCLOSURE 

even in a treatment situation. This means that patients are suffering because their health care 

providers do not have access to important clinical information that would be useful to the provider in 

the treatment of the patient. We are very concerned that the suggested revision to the rule will serve 

only to continue forcing Part 2 providers, and others that maintain records which contain substance 

abuse information, to withhold those records for fear that they will be improperly redisclosed. This is 

not beneficial to the patient. 

Our recommendation is to remove the redisclosure prohibition for any recipient who is required to 

comply with HIPAA. This would include all covered entities, all business associates, and those who are 

contractually required to comply with HIPAA that are not already either covered entities or business 

associates. As a discloser, I know that the recipient is subject to HIPAA and that they will not 

redisclose this information except as permitted by HIPAA. For requestors of information that are not 

subject to HIPAA, either by virtue of being a covered entity or a business associate or by contract, we 

are comfortable with retaining the Part 2 redisclosure prohibition. Covered entities and business 

associates, including HIEs, are already familiar with the HIPAA rules related to redisclosure and have 

incorporated these rules into their daily operations. It is already difficult for them to comply with the 

stringent Part 2 Regulations today with paper records. It is virtually impossible for them to do so with 

electronic records. 

MEDICAL EMERGENCY 

SAMHSA is considering adapting the medical emergency exception to make it more in-line with 

the statutory language and to give providers more discretion as to when a bona fide 

emergency exists. For example, amending this standard to allow providers to use the medical 

emergency provision to prevent emergencies or to share information with a detoxification 

center when a patient is unable to provide informed consent due to their level of intoxication. 

FR Citation: 79 FR 26931 

Questions: 

• What factors should providers take into consideration in determining whether a medical 

emergency exists? 

• Are there specific use cases SAMHSA should take into consideration? Show citation box 

• Are there patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

We support SAMHSA’s recommendation that the emergency exception be revised to match the 

statutory language of a “bona fide medical emergency.” This will give providers the flexibility to seek 

substance abuse records when they are truly needed to treat the patient or to prevent harm to the 

patient. We do not believe that this should be limited to specific use cases since this will create more 

10 
 

 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Mary Washington Healthcare 

Comments on Public Listening Session re: Confidentiality of Part 2 Records 

MEDICAL EMERGENCY 

confusion about which rule applies when. 

We also urge SAMHSA to substantially lessen the documentation requirement on the Part 2 provider 

when it releases records for an emergency. The Part 2 Regulation requires the Part 2 provider to 

document the following: 

• The name and affiliation of the medical personnel to whom the disclosure was made; 

• The name of the individual making the disclosure; 

• The date and time of the disclosure; and 

• The nature of the emergency. 

In a traditional point to point model, where the requester of the data is in direct contact with the Part 

2 provider, it might be feasible to obtain this information. However, in a medical emergency time is of 

the essence and delays in obtaining potentially critical information could mean the difference 

between life and death for the patient. An HIE allows the emergency provider to send a query 

seeking all relevant records for the patient that are available from other HIE participants and any 

partner networks. This information can be returned immediately. The documentation requirements 

of the Part 2 Regulation will interrupt the response to a query by Part 2 providers. The risk to the 

patient is clear, that important medical information might not be available in a timely fashion, not 

because of barriers in technology but because of policy barriers. This should not be allowed to be the 

case, especially since there are alternatives that allow for timely access to clinical information without 

compromising the patient’s privacy. Unlike paper records, EMRs allow us to track every time records 

are viewed which provides even more protection to the patient. While the documentation 

requirements in medical emergencies certainly served a purpose decades ago, we firmly believe that it 

no longer does. Therefore, we urge SAMHSA to eliminate these requirements. 

11 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Mary Washington Healthcare 

Comments on Public Listening Session re: Confidentiality of Part 2 Records 

QUALIFIED SERVICE ORGANIZATION (QSO) 

SAMHSA is analyzing the regulations to identify options for allowing Part 2 data to flow to 

health care entities for the purpose of care coordination and population management while 

maintaining patient protections. One potential solution includes expanding the definition of a 

qualified service organization (QSO; § 2.11) to explicitly include care coordination services and 

to allow a QSO Agreement (QSOA) to be executed between an entity that stores Part 2 

information, such as a payer or an ACO that is not itself a Part 2 program, and a service 

provider. 

FR Citation: 79 FR 26931 

Questions: 

• Are there other use cases we should be taking into consideration? 

• Are there specific patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

We certainly support the expansion of the types of organizations that are included as QSOs. However, 

we believe that the entire construct of the QSO and the QSOA has been superseded by HIPAA and the 

business associate rule. When the Part 2 Regulations were promulgated, the concept of a trusted 

partner for sharing clinical information was a new concept. That is no longer the case. We have 14 

years of experience with the HIPAA Privacy Rule’s business associate provisions. The definition of who 

is a business associate, and their obligations, has been expanded over time, most recently by the 

HIPAA Omnibus Final Rule that was finalized in 2013. SAMHSA has made it clear that Part 2 providers 

are required to comply with both the HIPAA business associate requirements and the Part 2 QSO 

requirements. We do not believe there is any reason to maintain this parallel structure any longer. 

The Privacy Rule’s requirements for Business Associate Agreements are very extensive and are actually 

broader than the Part 2 QSO requirements. Therefore, we see no reason to continue to require HIPAA 

covered entities to maintain both BAAs and QSOAs. 

If SAMHSA decides to continue the QSO framework, then we strongly support expanding the 

definition of a QSO to include those involved in care coordination. We recommend a broadly worded 

definition of “care coordination” to allow flexibility to include medical home, ACOs, population health 

initiatives, and other innovative models. 

12 
 

 

 

 

June 25, 2014 

Mary Washington Healthcare 

Comments on Public Listening Session re: Confidentiality of Part 2 Records 

RESEARCH 

SAMHSA is considering expanding the authority for releasing data to qualified 

researchers/research organizations to health care entities that receive and store Part 2 data, 

including third-party payers, health management organizations, HIEs, and care coordination 

organizations. 

FR Citation: 79 FR 26932 

Questions: 

• Are there factors that should be considered related to how current health care entities are 

organized, how they function or how legal duties and responsibilities attach to entities that 

make up an umbrella organization? 

• Would this change address concerns related to research? 

• Are there specific privacy concerns associated with expanding the authority or releasing data to 

qualified researchers/research organizations in this way? 

• Are there additional use cases that should be considered in the research context? 

Public Comment Field: 

No comments 

13 
 

 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Mary Washington Healthcare 

Comments on Public Listening Session re: Confidentiality of Part 2 Records 

ADDRESSING POTENTIAL ISSUES WITH ELECTRONIC PRESCRIBING AND PRESCRIPTION DRUG 

MONITORING PROGRAMS (PDMPS) 

Part 2 protections include a prohibition on the redisclosure of information received directly 

from a Part 2 program. A pharmacy that receives electronic prescription information directly 

from a Part 2 program must obtain patient consent to send that information to a PDMP, and 

patient consent is also required for the PDMP to redisclose that information to those with 

access to the PDMP. 

FR Citation: 79 FR 26932 

Questions: 

• How do pharmacy information system vendors anticipate addressing this issue? Are there 

specific technology barriers SAMHSA should take into consideration? 

• Are there other concerns regarding 42 CFR Part 2 and PDMPs? Please describe relevant use 

cases and provide recommendations on how to address the concerns. 

• Are there patient concerns about the impact of e-prescribing and PDMPs on their privacy? 

Public Comment Field: 

No comments 

OTHER COMMENTS 

Topic: 

Public Comment Field: 

Please take our feedback into consideration when making your decisions. 

14 
 

 

 

 

 

 

 

 

 

 

 

 

Agency: Substance Abuse and Mental Health Services Administration, Department of Health and Human 

Services 

Document Number: 2014-10913, Notice of Public Listening Session: Confidentiality of Alcohol and Drug 

Abuse Patient Records 

Comments on proposed changes to regulations submitted on behalf of Allegheny County Department of 

Human Services, Allegheny County, Pennsylvania. 

Commenter Background: The Allegheny County Department of Human Services (DHS) provides and 

administers publicly-funded human services to approximately 220,000 county residents each year. DHS 

provides drug and alcohol services through direct service to clients as well as through contracted 

providers. The wide range of other services DHS provides includes services for older adults; child 

protective services; at-risk child development and education; hunger services; emergency shelters and 

housing for the homeless; non-emergency medical transportation; job training and placement for public 

assistance recipients and older adults; and services for individuals with a diagnosis of intellectual 

disability. Our mission is “to create an accessible, culturally competent, integrated and comprehensive 

human services system that ensures individually tailored, seamless and holistic services to Allegheny 

County residents, in particular, the county’s vulnerable populations.” Unnecessarily restrictive rules 

around patient records hinder DHS’ ability to provide integrated services. We offer the following 

comments on the proposed changes to 42 CFR Part 2, under topic headings matching the Federal 

Register notice. 

Consent Requirements: 

We support allowing the consent to include a more general description of the individual, organization, 

or health care entity to which disclosure is to be made. The name of the program or entity to receive 

the information should be sufficient to allow informed consent. Besides federal and/or state 

regulations, individuals working for these organizations are also governed by codes of professional 

ethics, and we support an environment of trust among providers. Broadening the description from an 

individual’s name or title will prevent barriers to communication due to personnel changes. 

It is our position that the proposed requirement that patients be provided with a list of providers or 

organizations that may access their information, and be notified regularly of changes to the list is 

unnecessary. Maintaining and distributing such a list is impractical and inefficient for organizations like 

ours, and regularly receiving copies of the list is not an effective way for an individual client to exercise 

control over his or her information. 

We also believe that the requirement that if the health care entity permitted to make the disclosure is 

made up of multiple independent units or organizations that the unit, organization, or provider releasing 

substance abuse related information be specifically named is counterproductive to the goal of 

integration of services. DHS strives to provide individualized and holistic treatment, and being able to 

share information across service areas is a necessary part of achieving that goal. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Redisclosure 

We support the proposed clarification that prohibition on redisclosure applies only to information that 

would identify the individual as a substance abuser. Such a clarification would facilitate broader sharing 

of information among providers and programs in support of integrated service provision. 

Medical Emergency 

We support amending this standard to allow, for example, providers to use the medical emergency 

provision to prevent emergencies or to share information with a detoxification center when a patient is 

unable to provide informed consent due to their level of intoxication. It is crucial that providers have 

the discretion to interpret the definition of emergency to include prevention of a condition that would 

pose threat of immediate harm. Again, providers are governed by codes of ethics beyond these 

regulations, and entrusting them with greater freedom to act in patients’ best interests will allow them 

to more effectively serve our clients. 

Qualified Service Organization (QSO) 

Again, we support expanded sharing of information. We favor monitoring employees’ access/use at the 

organization level rather than at the federal regulation level. Providers should be free to use discretion 

and enter into agreements with organizations that will maximize the quality of care they are able to 

provide to patients. 

Research 

We fully support expanding the authority for releasing data to qualified researchers. We see research as 

essential to our mission, and the inability to use person-based data or to share data with certain types of 

organizations ties our hands. This is another area where we support greater freedom for organizations 

to work according to their guiding principles and professional ethics. 

Addressing Potential Issues With Electronic Prescribing and Prescription Drug Monitoring Programs 

(PDMPs) 

We agree that the current model of requiring a pharmacy to obtain consent to put information in a 

PDMP and further consent to re-disclose that information to those with access to the PDMP is 

needlessly cumbersome, and such barriers to access to information will prevent the programs from 

operating effectively. 

Other Comments 

We would like to reiterate that providers and administrators of services are not bound only by 

regulations, but also by codes of professional ethics. Broadening the regulations to allow providers and 

administrators greater discretion would allow organizations like ours to work within our governing 

principles to achieve our mission of providing holistic, integrated services. 
 

 

 

We would also suggest that SAMHSA and DHHS consider urging states to update their regulations, 

considering the same issues that SAMHSA is examining here. Pennsylvania’s regulations, for example, 

are particularly restrictive and even if there is sweeping change to the regulations at the federal level 

our organization would not be able to significantly change how we provide services in Allegheny County. 
State of Vermont 

Department of Health 

Office of the Commissioner 

108 Cherry Street - PO Box 70 

Burlington, VT 05402-0070 

healthvermont.gov 

 Agency of Human Services 

[phone] 802-863-7280 

[fax] 802-951-1275 

[tdd] 800-464-4343 

VIA	EMAIL

June 25,	2014	

Department	of	Health	and	Human	Services	(HHS)	

Substance	Abuse	and	Mental	Health	Services	Administration	(SAMHSA)		

Room	5‐1011	

1	Choke	Cherry	Road

Rockville,	MD	20857	

Re: Comments on Possible Changes to 42 C.F.R. Part 2 [79 FR 26929; 	 	 		 Document Number 2014‐10913]

The	Vermont	Departments	of	Health	and	Health	Access1 appreciate	the	opportunity	

to	offer	comments	to	SAMHSA	on	its	suggestions	for	updating	42	CFR	Part	2.		First,	we	want	

to	emphasize	that	we	fully	support	updating	the	regulation.		As	SAMHSA	states	the new	

models	of	integrated	care	and	the	electronic	infrastructure	for	managing	and	coordinating

that	care	were	not	envisioned	when	this	regulation	was	enacted	in	the	1970’s	or	when	it	

was	last	updated	25	years	ago.			Unfortunately,	to	date	integration	of	addiction	treatment	

has	been	severely	hampered	by	42	C.F.R.	Part	2	despite	efforts	to	clarify	the	regulation	by	

SAMHSA	in	its	two	sets	of	Frequently	Asked	Questions.	Unless	the	regulation	is	updated	

addiction	treatment	will	continue	to	be	left	out	of	coordinated systems	of	care	to	the	

detriment	of	the	system	as	a	whole	and	especially	to	those	patients	in	addiction	treatment.		

Our	comments	below	address	several	of	the	specific	issue	areas	on which	SAMHSA	

requested	feedback.

                                   

                              

                                 

     

1

The state office of alcohol and drug abuse programs operates within the Vermont Department of Health (VDH),

Vermont’s Blueprint for Health operates within the Department of Vermont Health Access (DVHA). Together these

programs jointly developed five (5) regional hubs that are or will provide specialty health homes and medication

assisted therapy services.

	 	 	 	 	 	 	 	 	 	 	 	 		

	 	 	 	 	 A. Applicability of 42 CFR Part 2

Covered	information	could	be	defined	based	on	what	substance	abuse	treatment	services	

are	provided	instead	of	being	defined	by	the	type	of	facility	providing	the	services.	For	

example,	the	regulations	could	be	applied	to	any	federally	assisted	health	care	provider	that	

provides	a	patient	with	specialty	substance	abuse	treatment	services.	In	this	scenario,	

providers	would	not	be	covered	if	they	provided	only	substance	abuse	screening,	brief	

intervention,	or	other	similar	pre‐treatment	substance	abuse	services	
	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 		 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

		 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 		 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 		 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

			

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 		 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 				

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 		 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 			 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 		 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

		 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

			

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 		

	 How	would	redefining	the	applicability	of	42	CFR	Part	2	impact	patients,	health	care

provider	organizations, HIEs,	CCOs,	HIT	vendors,	etc.?

Any change to the regulation that provides more clarity for patients and providers,

while promoting healthcare integration is positive, however we would encourage SAMHSA

to make more substantial revisions. Changes to the regulation should make the privacy

protections as consistent with HIPAA as is allowable by the authorizing statute with the

exception of access to records by law enforcement and the courts which should remain

more protective. Separate treatment of substance abuse treatment records compromises

patient safety, frustrates coordination of care, and drives higher costs and results in

inefficiencies. We support many of the recommendations proposed in a recently published

White Paper: PART 2: EVOLUTION A Vision for Integrated Care and Enhanced Rights by

Renee M. Popovits, Laura Ashpole & Kelly T. Whelan (April 2014). The authors offer

concrete recommendations on how to modernize Part 2 to facilitate effective participation

in HIEs, CCOs, ACOs and health homes. At the same time they also provide concrete

recommendations on strengthening the protections in the regulation on excluding

information protected by Part 2 from being introduced in evidence in any criminal or civil

proceedings.

We support amending the regulation to clearly carve out the provision of screening,

brief intervention, or other similar pre‐treatment substance abuse services. Such a change

will encourage screening, brief counseling, and referral to become integrated in regular

primary care by removing any concern on the part of primary care providers that

providing such care could make them subject to 42 CFR Part 2. In addition this change

would mean that such information would be included in the health information

transmitted to HIE, ACO, CCO environments.

It is unclear that modifying the regulation, to cover only federally assisted health care

providers that provide patients with specialty substance abuse treatment services, would

be of benefit. The current explanation of applicability of coverage in the regulation is too

open to interpretation resulting in a great deal of uncertainty for providers and patients

as to whether their practice or their substance abuse treatment information is covered by

the regulation or not. If SAMHSA was to take a type of information‐based approach

“specialty substance abuse treatment services” would need to be defined with as much

clarity as possible. Coverage based on facility‐type is easier to segregate in EHRs and

HIEs, but pure facility‐based coverage is problematic for integrated providers such as

FQHCs. Irrespective of whether coverage by the regulation is determined by services or by

facility pre‐treatment services, and SBIRT only services, should be excluded from the

regulation.

	 Would	this	change	address	stakeholder	concerns?

Clarifying the regulation’s reach will be helpful, however such changes won’t address

the overarching problem that the regulation presents to healthcare integration because

as currently written the regulation cannot, in any straightforward manner, be complied

with in an electronic health information sharing environment.
	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 		 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 			

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 		 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 		 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 		 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 		

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 		 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 			

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

 Would	this	change	raise	any	new	concerns?

This proposed change could raise new concerns if it is not carefully crafted and

thereby creates new ambiguity as to when the regulation applies. The changes to the

language should clearly define what is meant by “specialty substance abuse treatment

services” to prevent such confusion.

The change may be as difficult or more difficult to implement in an electronic

environment since segmenting data based on information type remains challenging.

B. Consent Requirements

Specifically, we	are	analyzing	the	current	requirements	and	considering	the	impact	of	

adapting	them	to:	

1. Allow	the	consent	to	include	a	more	general	description	of	the	individual,	organization,

or	health	care	entity	to	which	disclosure	is	to	be	made.

This proposed change would be extremely helpful in facilitating the inclusion of

covered substance abuse treatment information into HIEs, health homes, ACOs, and CCOs. The

current requirement for such organizations to provide patients with continuing evolving lists

of providers is unworkable. The regulation should permit patients to consent to disclosure to

any and all providers involved in their care since that is what most patients want and is best

for optimal healthcare. Patients of covered programs should not continue to be denied this

option.

2. Require	the	patient	be	provided	with	a	list	of	providers	or	organizations	that	may	access

their	information,	and be	notified	regularly	of	changes	to	the	list.

We object to this requirement because it is unworkable in the electronic health

information sharing environment. This requirement has proven to present a significant

barrier to the inclusion of substance abuse treatment information in HIEs, ACOs, and CCOs.

There is little justification for the requirement since, if allowed, most patients choose to share

their health information with anyone involved in their care. Patient confidentiality can still

be carefully protected by requiring providers to certify, prior to accessing a patient’s records,

that they have a bona fide treatment relationship with the patient and by requiring good

quality control and auditing functions for HIEs, ACOs, and CCOs.

If the regulation continues to require that every provider and organization be named

then SAMHSA should permit organizations to provide such lists on their websites and allow

for the lists to be updated on a monthly basis.

3. Require	the	consent	to	name	the	individual	or	health	care	entity	permitted	to	make	the

disclosure.
	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

 Would	these	changes	maintain	the	privacy	protections	for	patients?

Patient choice and privacy could still be protected and better

coordination and integration achieved by permitting a “ more general

description of the individual, organization, or health care entity to which

disclosure is to be made.”

 Would	these	changes	address	the	concerns	of	HIEs,	health	homes, ACOs,	and	CCOs?

Allowing a more general description of the individual, organization or

health care entity, to which disclosure can be made would help to address

concerns of HIEs, health homes, ACOs, and CCOs.

 Would	these	changes	raise	any	new	concerns?

The changes suggested by items 2‐5 would create additional barriers for

HIEs, health homes, ACOs, and CCOs.		Such modifications would further sideline

the inclusion of information from covered programs into electronic

environments and frustrate the goals of the Affordable Care Act (ACA).

We object to this proposal since it would further narrow what is permitted by the

regulation as well as further complicate inclusion of patient records into electronic record

environments.

4. Require	that	if	the	health	care	entity	permitted	to	make	the	disclosure	is	made	up	of

multiple	independent	units	or	organizations	that	the	unit,	organization,	or	provider

releasing	substance	abuse	related	information	be	specifically	named.

We object to this proposal for the same reasons cited above and because of the

increased difficulty health care entities would face in segmenting the patient information.

5. Require	that	the	consent	form	explicitly	describe	the	substance	abuse	treatment

information	that	may	be	disclosed.

We object to this proposal because it both further narrows what would

constitute valid consent, and does not describe what would constitute a sufficiently

explicit description of information.

C. Redisclosure

SAMHSA	is	considering revising	the	redisclosure	provision	to	clarify	that	the	prohibition	on	

redisclosure	only	applies	to	information	that	would	identify	an individual	as	a	substance	

abuser,	and	allows	other	health‐related	information	shared	by	the	Part	2	program to	be	

redisclosed,	if	legally	permissible.	This	would	allow	HIT	systems	to	more	easily	identify	

information that	is	subject	to	the	prohibition	on	redisclosure	enabling	them	to	utilize	other	

technological	approaches	to	manage	redisclosure.	If	data	are	associated	with	information	

about	where	the	data	were	collected	(data	provenance)	which	reveals	that	the	data	were	
	 Would	this	type	of	change	facilitate	technical	solutions	for	complying	with	42	CFR

Part	2 in	an	EHR	or	HIE	environment?

It seems unlikely that this proposed change would facilitate EHR/HIE solutions		

since complex data segmentation abilities would still be needed.		

The regulation should be amended to permit redisclosure of covered records

between provider members of HIEs, ACOs, CCOs who have a bona‐fide treatment

relationship with the patient.		Patients should be allowed to consent to such

redisclosures without necessitating additional consent; this recommendation is

discussed in the white paper cited above. Allowing redisclosure in this context would

facilitate inclusion of substance abuse treatment records into electronic environments

as well as enhance treatment and care coordination.

			

	 Would	these	changes	maintain	the	privacy	protections	for	patients?

Yes.

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 		 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

		 	 	 	 	 	 	 	 	 	

collected	by	a	practice	that	exclusively	treats	addiction,	the	data	would	still	be	protected	

under	the	proposed	change.

d. Medical Emergency

SAMHSA	has	heard	concerns	regarding	the	medical	emergency	exception of 42	CFR	Part	2

(§ 2.51).	The	current	regulations	state	that	information	may	be disclosed	without consent

“for	the	purpose	of	treating	a	condition	which	poses	an	immediate	threat	to	the	health	of

any	individual	and	which	requires	immediate	medical	intervention.”	The	statute, however,

states	that	records	may	be	disclosed	to	medical	personnel	to	the	extent	necessary	to	meet	a

bona	fide	medical	emergency.	SAMHSA	is	considering	adapting	the	medical	emergency

exception	to	make	it	more	in‐line	with	the	statutory	language	and	to	give	providers	more

discretion	as	to	when	a	bona	fide	emergency	exists.	For	example,	amending	this	standard	to

allow	providers	to	use	the	medical emergency	provision	to	prevent	emergencies or	to

share	information	with	a	detoxification	center	when	a	patient	is	unable	to	provide

informed	consent	due	to	their	level	of	intoxication.

	 What	factors	should	providers	take	into	consideration	in	determining	whether	a

medical	emergency	exists?

We agree that it would be helpful to amend the regulation to allow providers to

use the emergency provision to prevent emergencies, or to share information with a

detoxification center when informed consent is not possible. Providers should be

required to have a good faith belief that, in their professional opinion, a bona fide

emergency exists.

In addition, we would recommend amending the regulation to add a duty to

warn provision. Providers should be permitted to disclose information to law
	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 		 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	

	 Are	there	other	concerns	regarding	42	CFR	Part	2	and	PDMPs?	Please	describe

relevant	use	cases	and	provide	recommendations	on	how	to	address	the	concerns.

SAMHSA’s September 2011 letter to OTPs provides that OTPS may access

PDMPs as a resource to assist in treating their patients.		The letter cites a case study

where an OTP physician found that 23% of the facility’s patients were being prescribed

enforcement officials, family members, or others who may reasonably be able to

prevent or lessen a serious and imminent threat to the health or safety of a person or

the public as is permitted by HIPAA.

E. Qualified Service Organization (QSO)

SAMHSA	is	analyzing	the	regulations	to	identify	options	for	allowing	Part	2	data	to	flow	to	

health	care	entities	for	the	purpose	of	care	coordination	and	population	management	while	

maintaining	patient	protections.	One	potential	solution	includes	expanding	the	definition	of	

a	qualified	service	organization	(QSO;	§	2.11)	to	explicitly	include	care	coordination	

services	and	to	allow	a	QSO	Agreement	(QSOA)	to	be	executed	between	an entity	that	

stores	Part	2	information,	such	as	a	payer	or	an	ACO	that	is	not	itself	a	Part	2	program,	and	

a	service	provider.

	 Are	there	other	use	cases	we	should	be	taking	into	consideration?

This change should also permit the range of functions and activities that are

permitted of business associates under HIPAA.

	 Are	there	specific	patient	concerns	about	the	impact	of	this	change	on	their	privacy?

The regulation could model the responsibilities of QSOs on the responsibilities

placed on business associates in HIPAA. QSOs should only be able to use and maintain

the information for the reason(s) specified in the QSOA and should have the same

obligations and face the same penalties as a covered program.

G. Addressing Potential Issues With Electronic Prescribing and Prescription Drug

Monitoring Programs (PDMPs)

If	a	patient	does	not	consent	to	sharing	their	data	via	e‐prescribing,	their	only	option	for	

filling	their	prescription	is	to	bring a	paper	prescription	to the	pharmacy.	In	this	instance,	

since	the	information	is	given	by	the	patient,	it	is	not	protected	by	42	CFR	Part	2.	They,	

therefore,	cannot	prevent	the	information	from	reaching	the	PDMP	which	in	some	states	is

accessible	by	law	enforcement	and	has	the	potential	to	lead	to	investigation/arrest	and	

other	forms of	discrimination.

	 How	do	pharmacy	information	system	vendors	anticipate	addressing	this	issue?	Are

there	specific	technology	barriers	SAMHSA	should	take	into	consideration?

Unknown.
			

 

		 	 	 	 	 

	 	 	 	 	 	

	 	 		

	 	

	 	

	 	 	 	 			

	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 

	 	 	 	 	 	 	 	 	 	

 

 

 

 

significant quantities of opiates, benzodiazepines, and other controlled substances by

physicians outside their practice. Yet, because of the regulation’s prohibition on

redisclosure SAMHSA advises such programs to not disclose controlled substances used

to treat opioid addiction to PDMPs. This prohibition reduces the reliability of the

PDMP and significantly compromises patient safety given that other treatment

providers may prescribe the patient opioids while being unaware of the opioid

addiction treatment the patient receives at the OTP or OBOT.

At the very least patients should be able to sign a consent to have their

prescription information included in the PDMP which acknowledges that the

information could be redisclosed in accordance with the law and regulations

governing the PDMP.

	 Are	there	patient	concerns	about	the	impact	of	e‐prescribing	and	PDMPs	on	their

privacy?

It is likely that some patients would be concerned that information from the

PDMP could be accessed by law enforcement.

Conclusion

The	Vermont	Departments	of	Health	and	Health	Access	fully	support	SAMHSA’s	

efforts	to	clarify	and	reduce	the	burdens	associated	with	the	specific	consent	requirements

of	the	regulation	while	continuing	to	protect	patient	privacy.	 The	most	critical	areas	in	

need	of	change	are	consent	and	redisclosure.		Patients	should	be	able	to	consent	to	share	

their	substance	abuse	treatment	information	to	any	provider	or	organization	involved	in	

their	treatment,	and	substance	abuse	treatment	information	should	be	allowed	to	be	

redisclosed	between	members	of	HIEs,	ACOs,	and	CCOs	that	have	a treatment	relationship	

with	the	patient.		These	modifications	will	foster	the	integration	of	substance	abuse	

treatment	into	the	treatment	models	necessary	to	effectuate	healthcare	reform.			

Sincerely,

Barbara	Cimaglio,	Deputy	Commissioner	

Alcohol	and	Drug	Abuse Programs	
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Pamela Hyde 

Administrator 

Substance Abuse and Mental Health Services Administration 

U.S. Department of Health and Human Services 

1 Choke Cherry Road 

Rockville, MD 20857 

RE: Netsmart Comments to 42 CRF Part 2 Listening Session 

Dear Administrator Hyde: 

The SAMHSA Public Listening Session on the Confidentiality of Alcohol and Drug Abuse Patient Records 

held on June 11, 2014 provided a good forum for discussion of important issues related to 42 CFR Part 2 

consent requirements. 

I appreciate the opportunity to provide comments on this topic from the perspective of the largest 

provider of technology to behavioral health organizations. Netsmart serves more than 20,000 private 

behavioral health practices, 40 state-operated hospital systems, and approximately one third of all 

community mental health centers in the country, many of which offer substance use treatment services. 

We are also engaged in the creation of care coordination systems and the associated health information 

exchanges (HIEs) needed to connect behavioral health to physical health for some of the nation’s largest 

health homes. 

The confidentiality of substance use treatment records is important, but much has changed in the last 42 

years – in fact, much has changed in the past four years. In this digital era, the act in its current form is 

threatening patient safety by forcing healthcare providers to work in proverbial silos. 

Health homes, Accountable Care Organizations (ACOs) and HIEs will not succeed until behavioral health 

organizations are able to share data with their physical health care partners in care coordination 

programs. However, due to S!MHS!’s interpretation of the privacy laws, behavioral health and substance 

use providers are all but eliminated from participating fully these entities. 

HIE Example 

For example, if an adult with Alzheimer’s disease and diabetes consents to sharing his or her records on 

an HIE, they can receive the superior care that can be delivered by coordinating care and reducing the risk 

of medication interactions associated with their multiple medications. A second person, one with diabetes 

and a substance use issue who has part of his or her treatment provided by a substance use treatment 

provider, cannot consent to share their records on an HIE without enormous administrative burden on 

themselves and their provider. In fact, in most cases, this is impossible to do because of the current 

technologies in use in HIEs. As was indicated in the Listening Session, most HIEs currently refuse to accept 

substance use EHRs. 

1 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

In essence, providers cannot effectively participate in HIEs because when a patient wishes to consent to 

the release of his or her records to an HIE, he or she must specifically identify every member of that HIE. 

The HIE members/providers change over time, and maintaining the list as well as updated consents for 

redisclosure is challenging, which diminishes the ability coordinate care. Current regulations restrict 

providers from being able to send their substance abuse data up to the HIE, but only query down the 

longitudinal record comprised of physical health providers. This model does not serve the larger 

continuum because emergency departments and other physical health providers do not have access to 

the critical patient data represented during their substance abuse or behavioral health treatment. 

This unintended consequence is a result of S!MHS!’s interpretation of “informed consent.” On the 

surface, this appears to be discriminatory to a consumer with substance use issues and against the intent 

of Mental Health Parity and Affordable Care Act legislation. 

We strongly urge HHS and SAMHSA to issue sub-regulatory guidance that allows a patient to identify 

“current and future providers in the HIE involved in my care” as an appropriate title under the “To Whom” 

requirement of a Part 2 consent. 

ACO Impact 

Similarly, the Accountable Care Workgroup of the Office of the National Coordinator for Health 

Information Technology (ONC) noted the same problem in the context of Medicare ACOs (also applicable 

to Medicaid ACOs) – the inability to share addiction and mental health EHRs because of HHS privacy 

interpretations. In fact, the CMS Center for Medicare and Medicaid Innovation (CMMI) acknowledges 

that in sharing Medicare claims data with Pioneer ACOs nationwide, it must redact all addiction medical 

records due to Part 2 consent requirements. 

Consent Requirements 

Netsmart strongly urges a new 42 CFR Part 2 regulation to allow consent forms to include more general 

descriptions of the individual, organization or health care entity to which disclosure is to be made. This 

important change would ease the multiple consent requirements discussed above, thereby facilitating the 

interchange of substance abuse treatment information across HIEs, Medicare ACOs, Medicaid Health 

Homes and state-based Coordinated Care Organizations (CCOs). In conjunction with this proposal, it is 

important to note that substance use EHRs would be covered under existing HIPAA privacy standards, 

which protect the confidentiality of sensitive medical information associated with stigmatized medical 

conditions including HIV/AIDS and Sexually Transmitted Disease (STDs). 

Qualified Service Organizations 

We also urge SAMHSA to issue a Part 2 regulation that expands the definition of qualified service 

organization (QSO) to explicitly include care coordination services, and to allow a QSO Agreement (QSOA) 

to be executed between an entity that stores Part 2 information (such as a payer or an ACO that is not 

itself a Part 2 program), and a service provider. 

The ability to share information with appropriate but updated privacy safeguards is key to treatment and 

recovery for patients with substance use issues. It will also improve the quality and breadth of substance 

2 
 

 

 

 

 

use treatment, mitigate the negative impact of co-occurring conditions and significantly enhance patient 

safety. 

In addition, the timely, efficient sharing of authorized medical information via the fastest and most 

complete methods possible reduces risk of medication errors and increases the ability of emergency room 

clinicians to provide appropriate treatment in that setting. 

The overwhelming feedback at the June 11 Listening Session was in favor of updating the rules. Overall, 

we suggest a larger scale change: Exempt care coordination and population health management from 

Part 2 requirements to align with similar exemptions in HIPAA. 

Sincerely, 

Kevin Scalia 

Executive Vice President 

Netsmart 

3 
,Er. Texas Health 

,07 Resources 

June 25, 2014 

The Substance Abuse and Mental Health Service Administration 

1 Choke Cherry Road 

Rockville, MD 20857 

Room 5-1011 

Email: PrivacyRegulations@SAMHSA.hhs.gov

RE: Substance Abuse and Mental Health Services Administration, HHS 

FR Doc No: 2014-10913 

[ Applicability of 42 CFR Part 2 ! 

j SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. Covered I 

I information could be defined based on what substance abuse treatment services are provided instead of i 

I being defined by the type of facility providing the services. 

I FR Citation: 79 FR 26930 

I Questions: 

I • How would redefining the applicability of 42 CFR Part 2 impact patients, health care provider 

I organizations, HI Es, CCOs, HIT vendors, etc.? 

I • Would this change address stakeholder concerns? 

I • Would this change raise any new concerns? 

Public Comment Field: 

I Recommendation: Application of the definition of "Covered Information" should not be based on the 

I type of "services" but must be limited to information created or obtained by designated substance 

abuse treatment facilities or designated substance abuse treatment units within the larger facility. 

Rationale: Unless application of the rule and definition of "Covered Information" is limited to 

designated substance abuse treatment facilities or specifically designated substance abuse treatment 

units within a larger facility, or there is a substance abuse diagnosis code listed, there is no way to 

identify information that could identify a patient as a substance abuser without manually reading all the 

records. 

Even if a substance abuse diagnostic code is listed in connection with a general medical or surgical 

' patient, and is identified by the EHR, the EHR is not able to parse that information from the nonsubstance abuse information and therefore, would require the entire PHI to be treated as substance 

abuse treatment records. 

I If a patient comes to the hospital or physician's office for general medical treatment or pre-surgical 

I treatment, and the physician's history and physical address the patient's substance abuse treatment, 

I there is no way for an EHR or HIE to identify that note in the history to be a substance abuse record. 

'------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------· 

612 E. Lamar Blvd., Suite 1400, Arlington, Texas 76011 I 682.236.6872 I TexasHealth.org 
_ _ 

f Recommendation: A Program should not be considered to include an emergency department of a l ' '

I hospital if the entire facility or the emergency department itself does not hold itself out as providing I 

I substance abuse treatment. Substance abuse screenings done in the emergency department and I 

I referral for substance abuse treatment by the emergency department should not be considered /

Covered Information. I 

i Rationale: I Electronic health records are not built to identify and parse this information from other protected health I 

I information and in order to isolate information that could identify the patient as a substance abuser, the I 

I record must be reviewed manually which is not feasible. 

I Recommendation: Whether or not SAMHSA chooses to apply a definition of "Covered Information" to 

I types of "services", SAMHSA must provide a list of what it considers to be substance abuse treatment 

I medications to assist pharmacies and providers to identify redisclosure issues. 

I Rationale: Other providers and pharmacies have no way of knowing, with certainty, whether a provider 

I falls within the definition of a Program in order to avoid redisclosure violations. If the type of "Services" 1 

I determines the application of the definition of "Covered Information" and a substance abuse treatment I 

I medication finds its way into a medication reconciliation list upon hospital discharge, a family I

I practitioner or surgeon would then have unwittingly created Covered Information.

i Consent Requirements 

I While technical solutions for managing consent collection are possible, SAMHSA is examining the 

I consent requirements in § 2.31 to explore options for facilitating the flow of information within the 

I health care context while ensuring the patient is fully informed and the necessary protections are in 

I place. Specifically, we are analyzing the current requirements and considering the impact of adapting 

I them to: 

i 1. Allow the consent to include a more general description of the individual, organization, or health care 

entity to which disclosure is to be made. 

2. Require the patient be provided with a list of providers or organizations that may access their

information, and be notified regularly of changes to the list.

3. Require the consent to name the individual or health care entity permitted to make the disclosure.

4. Require that if the health care entity permitted to make the disclosure is made up of multiple ,

I independent units or organizations that the unit, organization, or provider releasing substance abuse

related information be specifically named. 

5. Require that the consent form explicitly describe the substance abuse treatment information that

may be disclosed. X

FR Citation: 79 FR 26931 X

Questions: '

• Would these changes maintain the privacy protections for patients?

i • Would these changes address the concerns of HI Es, health homes, ACOs, and CCOs? 

I • Would these changes raise any new concerns? 

I Public Comment Field: 

I Answer to #1. Recommendation: Allow the consent to provide a more general description of the J 

I health care provider or entity to which a disclosure may be made for treatment, payment or health / 

care operations (as defined by HIPAA). The consent would need to be valid for past, current, and 
future treatment unless the patient provides notice to the provider to revoke consent. 

Rationale: This would allow patients to choose to participate in an HIE so that all treating providers 

I can be knowledgeable of all treatment information of the patient. 

I

i Answer to #2. This would be difficult to operationalize as providers can change daily; e.g., hospitalists. 

5. An electronic health record cannot parse or segregate data even if the consent explicitly describes

I the substance abuse information that may be disclosed. Additionally, requiring an explicit description 

I of information to be disclosed on the consent form itself would cause Covered Information to be 

i 

L--------------------------------------

disclosed to entity personnel 

----------------------------------------------

who otherwise ----------------------------------------------------------------------------------------------------------would have no need to know. -

r-- - ----------------------------------------------------------------------------------------------------------------------------------------------------------- Re cii;ciosure

I SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on redisclosure

i only applies to information that would identify an individual as a substance abuser, and allows other 

I health-related information shared by the Part 2 program to be redisclosed, if legally permissible. This

I would allow HIT systems to more easily identify information that is subject to the prohibition on

I redisclosure enabling them to utilize other technological approaches to manage redisclosure. If data are 

I associated with information about where the data were collected (data provenance) which reveals that 

the data were collected by a practice that exclusively treats addiction, the data would still be protected 

under the proposed change. 

FR Citation: 79 FR 26931 

Questions: 

• Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 in an EHR or

i HIE environment? 

• Would these changes maintain the privacy protections for patients?

Public Comment Field: “

If "Covered Information" is defined by "services" and EHRs and HIEs cannot parse substance abuse 

information from non-substance abuse health information, all healthcare information would have to 

be blocked from release or carry redisclosure notice. Whereas, if "Covered Information" is defined by 

I facility or unit, at least only those designated facilities' or units' disclosure would have to be blocked 

I or carry redisclosure.

The substance abuse treatment cannot be identified by services; it needs to be by Program facility or 

designated Program unit. Even if one could identify by services, the PHI cannot be separated in the I 

electronic health record. So in order to protect the substance abuse information that may exist, all I

recipients of PHI from a HIE would have to receive the redisclosure notice on every patient's I 

information - even if the patient didn't have substance abuse treatment. Within a physician group I 

practice that includes physicians who hold themselves out as providing substance abuse treatment, J 

I the electronic medical record is not able to segregate the substance abuse treatment records. I 

I Therefore, all of the physician group's medical records would have to be blocked from the HIE I [ : h :e s i he group are treating the patient SAMHSA is trying to protect or any :.:::  ::: : ;::;:: ;/ a n 

J__Medi ca Emergency I ___________________________________________________________________________________________________________________________________________________________ I
i SAMHSA is considering adapting the medical emergency exception to make it more in-line with the, 

I statutory language and to give providers more discretion as to when a bona fide emergency exists. For 

I example, amending this standard to allow providers to use the medical emergency provision to prevent 

I emergencies or to share information with a detoxification center when a patient is unable to provide 

J informed consent due to their level of intoxication.

i FR Citation: 79 FR 26931 

I Questions: 

I • What factors should providers take into consideration in determining whether a medical emergency 

I exists? 

I • Are there specific use cases SAMHSA should take into consideration? Show citation box 

I • 

I Are there patient concerns about the impact of this change on their privacy? 

Public Comment Field: Recommendation: Allow emergency department providers to use I 

professional judgment to determine that an illness or injury is acute and poses an immediate risk to a ! 

person's life or long-term health so that the provider can review the substance abuse treatment / |

Covered Information to immediately treat the patient and potentially prevent further harm. --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------.J 

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------, r Addressing Potential Issues with Electronic Prescribing and Prescription Drug Monitoring Programs I

i (PDMPs) 

I Part 2 protections include a prohibition on the redisclosure of information received directly from a Part I 

I 2 program. A pharmacy that receives electronic prescription information directly from a Part 2 program I 

I must obtain patient consent to send that information to a PDMP, and patient consent is also required I 

for the PDMP to redisclose that information to those with access to the PDMP. 

Preamble FR Citation: 79 FR 26932 

Questions: 

• How do pharmacy information system vendors anticipate addressing this issue? Are there specific

technology barriers SAMHSA should take into consideration?

• Are there other concerns regarding 42 CFR Part 2 and PDMPs? Please describe relevant use cases and

provide recommendations on how to address the concerns.

• Are there patient concerns about the impact of e-prescribing and PDMPs on their privacy?

Public Comment Field: 

i Recommendation: SAMHSA must publish a list of drugs which would be considered to be prescribed I 

i by a Program which require consent for redisclosure. Example: A pharmacy receiving electronic ! I prescriptions from a family practice physician would not know if the physician holds himself out as a I 

I substance abuse treatment provider or not. It would not be possible to rely on the practice name I 

I either. For pharmacy uses, this would need to be addressed by drug rather than by facility. A I 

I pharmacy in Tennessee may not be familiar with a provider in California. 

j Comment number 2. The questions appear to address only electronic prescription information and do I 

I not address getting hand-written prescription to POMPS. I

I I 

1--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- I 

I Other Comments 

i Topic: 

I Public Comment Field: Providers feel a very real need to be able to notify state authorities when the I L-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------.J 
substance abuse patient poses a risk to the health or safety of another person or the public

------------------------------------------

in general

. 

-

1

i 

I For instance, while we realize that allowing reporting could have a chilling effect on patients seeking I 

! treatment, public safety is a major concern with patients who detox but are not in recovery and !
 j continue to drive while under the influence. This is especially concerning for drivers of public I 1

j_ 

t ran s p o rt at i o n .

---------------------------------------------------------------------------------------------------------------------------------------------------------------------1

RespectfuIly, 

June Gerson 

Director/Privacy Officer 
June 25, 2014 

Substance Abuse and Mental Health Services Administration 

United States Department of Health and Human Services 

Room 5-1011 

1 Choke Cherry Road 

Rockville, MD 20857 

Docket Number: 2014-10913 

Re: Comments on Possible Changes to 42 C.F.R. Part 2 

We, representatives from State Innovation Models Testing (SIM) states, are pleased to 

submit comments to SAMHSA on behalf of three SIM states. The State Innovation Models 

Initiative is providing support to states for the development and testing of state-based models for 

multi-payer payment and health care delivery system transformation with the aim of improving 

health system performance for residents of participating states. The SIM states offer a unique 

perspective on the challenges to better coordination of behavioral and physical health care posed 

by the Confidentiality of Alcohol and Drug Abuse Patient Records Regulations (hereinafter, “42 

C.F.R. Part 2” or the “Part 2 regulations”). 

The SIM states are testing new models of integrated care that are built on a foundation of 

information sharing to support coordination of patient care, the development of an electronic 

infrastructure for managing and exchanging patient data, and a new focus on performance 

measurement within the health care system. When the Part 2 regulations were written, these new 

models of care had not yet been developed. With their strict disclosure and redisclosure 

requirements, the Part 2 regulations make it difficult for health care providers seeking to better 

coordinate behavioral and physical health care to exchange substance abuse treatment 

information. It has been the experience of the SIM states that organizations across the country 

are excluding substance abuse treatment data from care coordination initiatives due to the 

difficulty and expense of implementing the functionality and the workflow changes necessary to 

comply with the Part 2 regulations as currently structured. 

The SIM states agree that there continues to be a need for confidentiality protections that 

encourage patients to seek substance abuse treatment without fear of compromising their 

privacy. Indeed, the goal of the SIM states is to facilitate information exchange while respecting 

the legitimate privacy concerns of patients. The SIM states hope to assist SAMHSA in clarifying 

the Part 2 requirements associated with information exchange in the new and innovative care 

coordination models they are testing. 

These comments address several of the specific issue areas on which SAMHSA requested 

feedback. 

1 
Issue: Applicability of 42 C.F.R. Part 2 

 

SAMHSA is considering options for defining what information is covered under 42 

C.F.R. Part 2. According to SAMHSA, covered information could be defined based on what 

substance abuse treatment services are provided instead of by the type of facility providing the 

services. 

The SIM states appreciate that the U.S. health care system is changing and more 

substance abuse treatment is occurring in general health care and integrated care settings, which 

are typically not covered under the current regulations. They also appreciate that this has posed 

difficulties for identifying which providers are covered by the Part 2 regulations since whether a 

provider or organization is covered by Part 2 can change depending on whether they advertise 

their substance abuse treatment services (i.e. “hold themselves out”), which can change over 

time. 

However, the SIM states do not support defining covered information based on what 

substance abuse treatment services are provided instead of the type of facility providing the 

services. According to SAMHSA, the regulations could be applied to any federally assisted 

health care provider that provides a patient with specialty substance abuse treatment services. In 

this scenario, providers would not be covered if they provided only substance abuse screening, 

brief intervention, or other similar pre-treatment substance abuse services. 

The SIM states believe that this proposed change would have a negative effect on the 

type of care coordination initiatives they are testing because it would necessitate that providers 

seeking to share information about patients who have received substance abuse treatment 

services be able to tag and separate records about such treatment from other records about the 

patient, and to treat the substance abuse treatment records differently (i.e., to subject them to Part 

2’s more stringent consent requirements). Most electronic health record systems (“EHR”) and 

electronic health information exchanges (“HIEs”) do not have the technical capability to perform 

this type of data segmentation. Even in cases where data segmentation is possible, building and 

maintaining an effective process is extremely costly. If SAMHSA adopts this proposal, the 

associated financial and reporting requirements would fall on a greater number of providers, 

many of whom have not had to previously bear this financial and operational burden. Thus, if the 

applicability of Part 2 is expanded as proposed, it would serve only to prevent more providers, 

indeed, vast numbers of providers of all types, from engaging in health information exchange, 

which is exactly the opposite of SAMHSA's goal. 

The SIM states request that SAMHSA consider how this proposed change would be 

operationalized in light of the current limitations on EHR and HIE data segmentation. For 

example, how will SAMHSA identify substance abuse treatment information (i.e., by use of 

billing codes)? 

Currently, 42 C.F.R. Part 2 applies to federally funded individuals or entities that “hold 

themselves out as providing, and provide, alcohol or drug abuse diagnosis, treatment or treatment 

referral” including units within a general medical facility that hold themselves out as providing 

2 
diagnosis, treatment or treatment referral. While not ideal, this model, which makes Part 2 

applicable to a certain type of provider rather than to a certain class of information, is more 

conducive to health information exchange because it allows HIEs to identify information that 

needs to be subject to greater privacy protections by identifying the providers from which it 

came, which is an easier proposition than identifying substance abuse treatment information in 

the records of any provider that happens to have provided such treatment. 

Issue: Consent Requirements 

 SAMHSA is examining the consent requirements in the Part 2 regulations to explore 

options for facilitating the flow of information within the health care context while ensuring the 

patient is fully informed and the necessary protections are in place. 

The SIM states support SAMHSA’s proposal to liberalize Part 2’s consent requirement to 

allow the consent to include a more general description of the individuals, organizations, or 

health care entities to which disclosure is to be made. This would enable the SIM states to 

implement a universal consent form/process that would support community-wide care 

coordination activities. Having to include the name or title of the individual or the name of the 

organization to which the disclosure is to be made is a challenge for care coordination initiatives 

like HIEs, health homes, accountable care organizations ("ACOs") and care coordination 

organizations (“CCOs”), which have large and constantly evolving numbers of participants and 

which do not have the resources to update consent forms whenever new providers join these 

organizations. If the proposal is not effectuated, the SIM states suggest that SAMHSA should 

provide greater flexibility by explicitly allowing organizations to maintain and update on a 

monthly basis on their websites a list of providers to whom disclosure may be made under a care 

coordination initiative. The SIM states also support broadening the consent requirement to allow 

consent to be made to “any provider involved in the patient’s care.” 

The SIM states do not support the requirement that the consent form explicitly describe 

the substance abuse treatment information that may be disclosed since the substance abuse 

information available through the care coordination initiatives that the SIM states are testing may 

change as time goes on. 

Finally, while liberalizing the consent requirement would reduce barriers to informationsharing, it will only go so far in states where state consent laws are not aligned with Health 

Insurance Portability and Accountability Act (HIPAA). 

Issue: Redisclosure 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition 

on redisclosure only applies to information that would identify an individual as a substance 

abuser, and allows other health-related information shared by the Part 2 program to be 

redisclosed, if legally permissible. 

SAMHSA suggests that this change would allow HIT systems to more easily identify 

information that is subject to the prohibition on redisclosure, enabling them to utilize other 

3 
technological approaches to manage redisclosure. If data associated with information about 

where the data were collected (data provenance) reveals that the data were collected by a practice 

that exclusively treats addiction, the data would still be protected under the proposed change. 

The SIM states support SAMHSA’s proposal to allow for health-related information that 

would not identify an individual as a substance abuser to be redisclosed. Given the high 

prevalence of comorbidity between substance abuse and mental health and/or physical health 

conditions, treatment records frequently contain other health information – such as treatment 

plans and medication lists – that would be of value to other providers. For example, the majority 

of Vermont’s community mental health centers are designated substance abuse facilities covered 

under Part 2. Fifty to seventy five percent of patients in these centers have comorbid mental 

health and substance abuse issues. Would SAMHSA’s proposal enable these community mental 

health centers to redisclose information that does not identify a patient as a substance abuse 

treatment recipient if the information was received from the Part 2 program? If so, the SIM 

States would support this change, but they would appreciate clarification from SAMHSA about 

exactly how this would be operationalized. 

Issue: Medical Emergency 

SAMHSA is considering adapting the medical emergency exception to make it more inline with the statutory language and to give providers more discretion as to when a bona fide 

emergency exists. For example, amending this standard to allow providers to use the medical 

emergency provision to prevent emergencies or to share information with a detoxification center 

when a patient is unable to provide informed consent due to their level of intoxication. 

The current regulations state that information may be disclosed without consent “for the 

purpose of treating a condition which poses an immediate threat to the health of any individual 

and which requires immediate medical intervention.” The statute, however, states that records 

may be disclosed to medical personnel to the extent necessary to meet a bona fide medical 

emergency. 

The SIM states support SAMHSA’s interest in adapting the medical emergency 

exception to make it more in-line with the statutory language and to give providers more 

discretion as to when a bona fide emergency exists. However, the SIM states note that this 

change, in the absence of the other changes above, will do little to increase the exchange of 

information between behavioral and physical health care providers. The goal of the care 

coordination initiatives in which the SIM states are participating is for providers to share 

information on an ongoing basis in order to prevent emergencies from happening. While 

SAMHSA’s proposal to broaden the definition of medical emergencies in which Part 2 records 

may be disclosed without patient consent would provide some needed relief in emergency 

situations, it will do nothing to help providers share information to prevent emergencies from 

happening in the first place. 

Another proposal for SAMHSA’s consideration that relates to emergency services is 

amendment of the current requirement under the Part 2 regulations that Part 2 programs be 

notified when their records are accessed without consent in an emergency. This is a cumbersome 

4 
requirement when considered in the context of electronic HIE, since notification of a Part 2 

program by an HIE initiative or participants in an HIE initiative necessitates implementation of a 

new and separate workflow than is otherwise required under the HIE initiative. It would be more 

efficient if the Part 2 requirement of notification could be considered satisfied if the Part 2 

program has the option of learning from the HIE or its participants who has accessed its records 

by requesting an audit trail of such access. 

Issue: Qualified Service Organization (QSO) 

SAMHSA is analyzing the regulations to identify options for allowing Part 2 data to flow 

to health care entities for the purpose of care coordination and population management while 

maintaining patient protections. One potential solution includes expanding the definition of a 

qualified service organization to explicitly include care coordination services and to allow a QSO 

Agreement (QSOA) to be executed between an entity that stores Part 2 information, such as a 

payer or an ACO that is not itself a Part 2 program, and a service provider. 

Under the current regulations, substance abuse information may not be shared without 

consent with health care entities such as ACOs and CCOs for the purposes of care coordination 

and population health management (e.g., to help them to identify patients with chronic conditions 

in need of more intensive outreach). 

The SIM states strongly support SAMHSA’s proposal to expand the definition of a 

qualified service organization to explicitly include care coordination services and to allow a 

QSOA to be executed between an entity that stores Part 2 information, such as a payer or an 

ACO that is not itself a Part 2 program, and a service provider, so long as that information is 

used for treatment or quality improvement or similar purposes. This change would better reflect 

the various entities responsible for patient treatment and coordinated care. 

However, the SIM states would argue that SAMHSA’s proposal does not go far enough 

and would not permit networked care coordination initiatives and organizations to further share 

information they receive from a Part 2 program with other providers in their networks. For 

example, Oregon has developed Care Coordination Organizations, which are networks of all 

types of health care providers (physical health care, addictions and mental health care and 

sometimes dental care providers) who have agreed to work together in their local communities to 

serve people who receive health care coverage under the Oregon Health Plan (Medicaid). 

CCOs have the flexibility to support new models of care that are patient-centered and teamfocused, and reduce health disparities. CCOs are also local and have one budget that grows at a 

fixed rate for mental, physical and ultimately dental care. They are accountable for the health 

outcomes of the population they serve and are governed by a partnership among health care 

providers, community members, and stakeholders in the health systems that have financial 

responsibility and risk. Today, there are 16 CCOs operating in communities around Oregon. 

While, under SAMHSA’s proposal to expand the definition of QSO, Oregon’s CCOs 

would be able to receive Part 2 data from their Part 2 program participants without consent, they 

would not be able to further disclose the Part 2 data to other participants within each CCO and 

between other CCOs without consent, meaning SAMHSA’s proposal, while helpful, does not go 

5 
far enough. Although CCOs are directed to work collaboratively to improve population health 

within specific regions, they are compromised in their ability to do so without the authority to 

effectively exchange data for individuals living in those communities. Therefore, the SIM states 

request that SAMHSA consider creating a new exception to the Part 2 consent requirements that 

permits providers that are participating in an organized integrated care network like a CCO or 

ACO to share information with one another and allow the Part 2 program to share information 

with other providers within the network. The rationale is that the providers participating in the 

ACO or CCO are acting as a unified collaborative provider organization, a circumstance that 

warrants a new consent exception to the Part 2 rules. 

Issue: Research 

SAMHSA is considering expanding the authority for releasing data to qualified 

researchers/research organizations to health care entities that receive and store Part 2 data, 

including third-party payers, health management organizations, HIEs, and CCOs. 

Under the current regulations, the Part 2 “program director” has to authorize the release 

of information for scientific research purposes. Under the current regulatory framework, absent 

consent, organizations that store patient health data, including data that are subject to Part 2, 

which may be used for research (e.g. health management organizations) do not have the authority 

to disclose Part 2 data for scientific research purposes to qualified researchers or research 

organizations. SAMHSA is proposing to address this issue by expanding the authority for 

releasing data to qualified researchers/research organizations to other health care entities that 

receive and store Part 2 data, including third-party payers, HIEs, and CCOs for the purposes of 

research, audit, or evaluation. 

Several states are in the process of developing All Payer Claims Databases (APCDs), 

which collect health care claims information and allow health care entities and researchers to 

access the data to gain a more comprehensive view of health care system performance. Select 

states are further along in development, such that their APCDs have the ability to integrate 

claims and clinical information. Given the constraints on disclosures of Part 2 records, substance 

abuse information is often not included in these new APCDs, thus limiting their utility in 

measuring health system quality and performing other health services research. 

Oregon’s APCD provides an algorithm to data submitters that enables them to filter out 

Part 2 records by use of billing code before they submit their data to the APCD’s warehouse. 

Because this algorithm uses various codes as the means to identify Part 2 records, the algorithm 

serves to keep out of the APCD any substance abuse treatment services provided by any type of 

provider – not just those providers that are subject to Part 2. This leaves a very large gap in the 

APCD’s data; Oregon is limited in its ability to perform research that relates to the coordination 

of behavioral and physical health care and research related to total health care expenditures 

because the data are incomplete. Limiting the ability to generate and disseminate evidence on 

the impacts of Oregon’s coordinated care model may constrain the model’s impact over time. 

6 
f

 SAMHSA’s proposal to authorize disclosure of Part 2 data for research purposes could 

alleviate this problem and ensure the contribution of Part 2 data by health plans to emerging 

APCDs. 

Issue: Addressing Potential Issues With Electronic Prescribing and Prescription Drug 

Monitoring Programs (PDMPs) 

Part 2 protections include a prohibition on the redisclosure of information received 

directly from a Part 2 program. A pharmacy that receives electronic prescription information 

directly from a Part 2 program must obtain patient consent to send that information to a PDMP, 

and patient consent is also required for the PDMP to redisclose that information to those with 

access to the PDMP. Several SIM states are in the process of implementing PDMPs through 

regulatory and operational action and they support SAMHSA’s proposal to broaden the 

information available through these programs. 

Conclusion 

Having been last updated in 1987, Part 2 is ripe for changes that will ensure that it no 

longer stands as a barrier to the exchange of substance abuse treatment information and mor e 

integrate d delivery of behavioraland primary health care. We appreciate SAMHSA’s dedication 

to this issue and the opportunity to submit comments as the Agency moves down this important 

path. 

Sincerely, 

Mary C. Mayhew 

Commissioner, Depaartment of Health and Human 

Servicces State of Maine 

Jeanene Smith MD, MMPH 

Chief Medical Officer, Oregon Health Authority 

Principal Investigato r, Oregon’s State Innovation Model Grant 

7 

Robin Lunge, JD 

Director of Health Care Reform, Agency of Administration State of Vermont 
THE COUNTY OF CHESTER 


COMMISSIONERS: DEPARTMENT OF HUMAN SERVICES 

Ryan Costello KIM BOWMAN, M.S. 

Kathi Cozzone Director 

Terence Farrell DONNA A. CARLSON, M.S. 

Deputy Director 

Managed Behavioral Healthcare 

DEBRA A. MACCARIELLA, M.Ed. 

Administrative Deputy Director 

June 25, 2014 

U.S. Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Rockville, MD 20857 

Re: 	 Confidentiality of Alcohol and Drug Abuse Patient Records, 42 CFR Part 2 

Docket No. 2014-10913 

Federal Register, Volume 79, No. 91, Pages 26929 - 26932 

To Whom It May Concern: 

I am writing to provide comment on the changes being considered by the SAMHSA to 42 CFR. Part 2, 

Confidentiality of Alcohol and Drug Abuse Patient Records. I currently am the Director of Human 

Services for the County of Chester, Pennsylvania. The human services include the Departments of Drug 

and Alcohol; Aging; Mental Health, Intellectual and Developmental Disabilities; Children Youth and 

Families; Youth Center Uuvenile detention and dependency shelter); Military and Veteran's Affairs; and 

our Health Choices behavioral health Medicaid managed care program. I have also served at the state 

and county in leadership positions in the single county and single state agencies. 

The changes being considered should not be enacted. The federal confidentiality rules play a key role in 

ensuring safe access to essential drug and alcohol treatment services. Unfortunately, the stigma 

associated with addiction continues and the need for the confidentiality protection is as, if not more, 

necessary today as when these rules were established. This is particularly true in an era of electronic 

data that can easily be widely disseminated - requiring us to be more cautious, not less. 

Our nation has example after example of advanced technology capabilities. To not utilize this capability 

to protect patient privacy is not acceptable. We know that alcohol and other drug problems result in 

tremendous financial and human costs. We need to ensure that we do not create any disincentives to 

seeking care - especially those that are entirely preventable such as protecting privacy. 

The changes proposed are designed to minimize the need for the healthcare system to design patient 

centered records. This should not be the case. We need to maintain the strong confidentiality 

protections currently in place in 42 CFR. Following are responses to the specific questions posed: 

a. 	 Applicability: Screening and brief intervention should continue to be covered under the law and 

this provision should not be weakened. The term "other similar pre-treatment substance abuse 

services" is nebulous at best and - what are these services? 

601 Westtown Road, Suite 330, - P. 0 . Box 2747 - West Chester, PA 19380-0990 Phone 610- 344-6640 or l-800-692- 1100 FAX 6 10-344-5736 
U.S. Substance Abuse and Mental Health Services Administration 

June 25, 2014 

Page 2 

b.	vConsent requirements: Individuals should retain the power to specifically decide who may 

receive information about their diagnosis and care. The proposed adaptations discussed in the 

Background are too general and would result in little real protection. This is even more 

concerning given the discussion of the lack of "sophisticated consent management capabilities" of 

the organizations and member providers. Consents should continue to require identification of 

the specific name, title or organization to whom the information can be released. It should also 

continue to specify what information can be released and for what purpose. Modifications under 

consideration: 1. General consents; 2. Simply requiring the provision of a list of who may access 

their information to the individual or; 3. Changing to only requiring consent for who may release 

information, are all completely insufficient protections. Therefore, modifications 1, 2, and 4 

should be rejected. The inclusion of 3 as a potential modification is confusing as the current 

regulations require that the consent identifies who is permitted to make the disclosure. If this is 

intended to be the sole requirement, then it should be rejected. The entity permitted to release 

information should be maintained as one required component of a consent in addition to 

specifically identifying to whom the information may be released. The changes proposed would 

compromise and not maintain privacy protections. 

c.	v Redisclosure: Limitations on redisclosure is a key element of the drug and alcohol privacy 

protections and must be maintained. The revision being considered is unclear. How would this 

information be differentiated? This seems to add complexity. 

d.	vMedical Emergency: It is unclear why change is being proposed. 

e.	vQualified Service Organizations: The proposed revision discussed would remove an important 

patient confidentiality protection and should be rejected. Under current rules, patients can decide 

not only who receives their information, but also what information they can receive. This change 

would eliminate an individual's right to decide not only who gets their information, but also the 

extent of information that can be provided. This would essentially provide insurers/managed 

care organizations carte blanche access to a person's information without the person knowing or 

consenting not just to the release, but also the extent of the release. A payer or an Accountable 

Care Organization is just that - they are not providing a service to a provider and the individual 

should have a right to determine not only if they can receive information, but also how much 

information they receive. 

f.	v Research: If these changes were enacted, who would be responsible for ensuring the protection 

of the data? There is typically some oversight of programs' compliance with confidentiality 

regulations, e.g. through state licensing. Who would be responsible for oversight if the authority 

for release is expanded? Without a clear oversight mechanism, this should not be contemplated. 

The need for the protections afforded by 42 CFR has not diminished and, in fact, with the potential reach 

of electronic data sets, they are even more important today. We have the technological capability to do it 

right and we should not, nor do we need to, sacrifice these important privacy rights and protections. 

Weakening these protections would result in fewer people accessing care which we know will only drive 

up our health care, societal and human costs. 

Sincerely, 

Kim P. Bowman
v

601 Westtown Road, Suite 330, - P. 0. 13ox 2747- West Chester, Pl\ 19380-0990 Phone 610- 344-6640 or J-800-692-1100 FAX 610-344-5736 
UNIVERSITYoJMARYLAND 

Clinical Law Program 

FRANCIS KING Carey 500 West Baltimore Street 

SCHOOL OF LAW Baltimore. MD 21201-1786 

410 706 3295 I 410 706 5856 FAX 

June 25, 2014 

Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, Maryland 20857 

RE: 79 Fed. Reg. 26929 (May 12, 2014) FR Doc. 2014-10913 

Substance Abuse and Mental Health Services Administration 

To Whom It May Concern: 

Thank you for the opportunity to provide comments on potential revisions to the federal 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2 (Part 2 

regulations). The Drug Policy and Public Health Strategies Clinic, University of Maryland 

Carey School of Law, (Clinic) is very interested in ensuring that consumers with substance use 

disorders retain their right to determine who receives information that identifies them as a 

substance use patient and that redisclosure of that information is limited to authorized individuals 

and entities. The Clinic has had extensive experience in implementing the Part 2 regulations as 

health delivery systems have evolved. Specifically, the Clinic has assisted treatment providers in 

Maryland apply and enforce the Part 2 regulations on behalf of their patients and has worked to 

implement the Affordable Care Act (ACA) in Maryland with a specific focus on ensuring that 

individuals with substance use disorders gain the full benefit of expanded insurance coverage for 

prevention and treatment services. The Clinic has also actively participated in Maryland's efforts 

to implement its Health Information Exchange (HIE) by addressing the Part 2 standards in the 

State's regulatory framework for HIEs. Finally, the Clinic has represented individuals who face 

discrimination based on their histories of drug dependence and participation in treatment and is 

familiar with the overt and subtle ways in which health information can be obtained and used to 

discriminate against individuals. Despite advances in medical care and aspirations to coordinate 

patient care, stigma and inequitable treatment of persons with substance use disorders persist. 

The need to protect the health information of persons with substance use disorders is as critical 

today as it was in the mid-1970s. Thus, the Clinic urges SAMHSA to not dilute the bedrock Part 

2 standards as it seeks to ensure that these individuals have access to effective and coordinated 

care and to respond to stakeholders that seek a singular health privacy standard aligned with 

HIP AA standards. 

CLINICAL LAW PROGRAM ATTORNEYS: 

Jane F. Barrett Jerome E. Deise Peter Holland William Piermattei Deborah J. Weimer 

Barbara Bezdek Erin E. Doran Renee Hutchins Brian Saccenti Roger Wolf 

Brenda Bratton Blom Deborah Eisenberg Andrew W. Keir Michelle Salomon 

Patricia Campbell Emily M. Eisenrauch Susan Leviton Maureen Sweeney Michael Pinard. 

Pamela Chaney Sara Gold Leigh Maddox William Tilburg Clinic Director 

Marc Charmatz Toby Treem Guerin Michael A. Millemann Rita Vera A.J. Bellido de Luna. 

Douglas L. Colbert Kathleen 5. Hoke Leslie Turner Percival Ellen Weber Managing Director 

Matthew Peters 

1 

DENTISTRY • LAW • MEDICINE • NURSING • PHARMACY • SOCIAL WORK • GRADUATE STUDIES 
The Clinic shares SAMHSA's goal of ensuring that persons with substance use disorders gain 

the full benefit of integrated health care delivery systems and real-time coordination of care. 

Persons with substance use and mental health disorders have complex chronic health care needs 

that cross many provider settings and can impose significant costs on the health care delivery 

system. Coordinated care and access to up-to-date health care information is essential to reduce 

system-wide health costs and ensure that persons with substance use problems receive the best 

health services available. While the Clinic recognizes that some health care systems and HIEs 

have chosen to not invest in the development of IT systems that would allow for the inclusion of 

Part 2 information based on patient consent, we strongly endorse the implementation of 

technology solutions that would allow for the segmentation of health data and the segregation of 

protected health information so that consent-based disclosures of patient identifying information 

can be carried out. We would also support the adoption of monetary remedies to incentivize 

general medical facilities and other entities that receive Part 2 information to adhere to Part 2 

disclosure standards. Our experience has revealed that hospitals, for example, routinely use and 

redisclose Part 2 information without adherence to consent standards. Real penalties may 

encourage such entities to implement procedures to prevent unauthorized disclosures (which 

would not constitute a HIP AA violation) and to implement technology solutions that would 

allow patients to share their health information through consent. 

The Clinic provides the following responses to SAMHSA's questions. 

A. Applicability of Part 2: Type of Information v. Provider 

As primary care and other non-specialty care health providers are increasingly involved in the 

identification of problematic alcohol and drug use, it is important to provide clear regulatory 

guidance to identify both the providers that are subject to Part 2 and substance use activities 

(screening and brief interventions, diagnosis, treatment or referral to treatment) that trigger Part 2 

protections. The Clinic believes that the current Part 2 "program" definition is sufficiently clear 

to allow health practitioners in general medical practices to determine whether the provision of 

substance use services is his/her primary function and, accordingly, subject to Part 2. It would 

be difficult to envision a health care practitioner who provides screening and brief counseling 

services as one of his/her preventive health services would satisfy the definition of"program;" 

the provision of substance use services would not constitute his/her primary function. The 

current standard, importantly, gives the general medical practice or practitioner the latitude to 

make this determination and to adjust to any changes in practice that may occur over time. Thus, 

the current standard seems to adequately address the stated concerns and appropriately limits 

Part 2 standards to those situations in which a practitioner who specializes in substance use 

services provides such services. 

The Clinic is concerned that the proposal does not define "specialty substance abuse treatment 

services" and suggests that the definition of "program" would be revised without providing 

guidance on the proposed standard. While the proposal makes clear that screening and brief 

intervention info1mation would not fall within the definition of "specialty substance abuse 

treatment services," additional guidance is needed to evaluate the scope of information that 

would be covered. Indeed, an argument could be made that screening and brief intervention 

information would the type of inf01mation that consumers seek to protect as much as a diagnosis. 

2 
The proposal notes that Part 2 would still apply to "federally assisted', health care providers, but 

it does not indicate whether the current standards for programs or staff in general medical 

facilities would be amended. The Clinic would oppose the revision of the "program" definition 

to exclude from Part 2 coverage specialized units or designated staff within general medical 

practices. With the expansion of substance use services under the ACA, individuals will need to 

access care in settings beyond traditional treatment settings, such as federally qualified health 

centers and ACOs. Expanded access to services is, in fact, the goal of health care reform. The 

protection of this sensitive health information should not be based on setting in which the patient 

receives care. 

It is unclear how the proposed modification would simplify coverage determinations. Although 

the proposal does not define "specialty substance abuse treatment services," that designation is 

essentially coterminous with the current program definition for coverage of health care 

providers in general medical facilities; i.e. only those units or health care personnel that provide 

diagnosis, treatment or referral for treatment are subject to the regulations. Depending upon 

whether the "program" definition for general medical facilities is revised to delete this qualifier, 

the proposed standard could arguably cover more non-specialty practitioners, as the provision of 

"specialty services" would trigger coverage regardless of whether the delivery of those services 

constitutes the primary function of the practitioner or is provided by a designated unit. 

The proposed revision would not, in our view, address the concerns of stakeholders that do not 

want to invest in strategies that allow for the integration of substance used disorder information. 

Basing coverage on the type of information gathered does not facilitate the incorporation of 

information in HIEs or simplify the work of HIT vendors, as the program and HIE would still 

have to address the segmentation/separation of information that pertains to specialized treatment 

services (however defined). General medical facilities that create or receive information relating 

to specialty substance abuse treatment services would still need to separate this information to 

ensure consent is provided for disclosure either through traditional or HIE modes of information 

sharing. 

B. Consent Requirements

The Clinic recognizes the limitations and administrative challenges that are associated with a 

consent standard that requires specificity in the identification of the recipient(s) of Part 2 

information.1 At the same time, any modification of the consent standards must carefully 

consider the consequences of expanding consent to allow multi-partner entities to gain access to 

Part 2 information without the patient having an opportunity to authorize such disclosure. Many 

multi-partner entities will have no association with a particular patient and no need for his or her 

substance use treatment information, but would nonetheless gain access to Part 2 information if 

the consent requirement were to allow for more generalized identification of the recipient entity. 

Under such circumstances, unnecessary disclosure of Part 2 patient information would increase 

and the monitoring of redisclosure would be impossible. In our view, the importance of 

protecting patient confidentiality in this context overrides the administrative inconvenience to 

1 It is important to note the HIPAA contains this same level of specificity for disclosures subject to consent. 45 

C.F.R. § 164.508(c)(l)(ii).

3 
programs, health homes, ACOs and CCOs that must update consent forms and seek consent for 

disclosure to identified organizations as they enter the partnership. 

The five-part proposal raises several questions regarding the ability of patients to control the 

disclosure of their information. First, when presented with a list of providers or organizations 

that may access their info1mation, would the patient have the right to authorize disclosure to 

some but not all of the partners? Second, how frequently would the updated list of recipients be 

provided to the patient? Depending upon the frequency of updates, a patient's information will 

likely have been disclosed to an entity that the patient had no knowledge of and could have f signiicant objections to. The proposal suggests that the patient would not be given the authority 

to select the partners with whom information is shared either before or after the effect. While we 

recognize the importance of sharing information to facilitate coordinated care, we also trust that 

most patients will consent to the disclosure of information when practitioners communicate the 

need for and value associated with disclosure of information. The proposed process eliminates 

the need for that practitioner-patient conversation and could result in the patient simply denying 

consent for the release of any patient infmmation. Moreover, the subsequent revelation that 

patient information has been disclosed to an entity that the patient was not aware of and which 

has no need for the information could undermine trust in the provider and disrupt the therapeutic 

relationship. 

Finally, we are most concerned with the application of the proposed standard to HIEs. The 

number of health care providers and payors that would have access to patient identifying 

substance use information via an HIE would be significant, and any participating entity could 

access and use the information for population health management and consumer outreach 

purposes. The current standards provide patients with substance use disorders greater protection 

of their health information in these contexts and should not be weakened at this time. 

Technology can and should be developed that will allow for consent-based disclosures. 

C. Redisclosure

The Clinic supports the retention of the current Part 2 redisclosure provision, which seems to 

accomplish the goal of the proposal. From our reading of§ 2.32, the current standard already 

allows for the redisclosure of patient health information as long as the information does not 

disclose the individual's status as a substance use patient; i.e., patient information may be 

redisclosed pursuant to consent or "as otherwise permitted" by Part 2. The identification of a 

person's status as a substance use disorder patient arises most frequently through the 

identification of the source of the data- an identified substance use disorder treatment program. 

Indeed, the proposal recognizes this and would not alter the current standard that 

information/data cannot be redisclosed if the data provenance would reveal that the person is a 

substance use patient. 

We are also confused by the proposal which, on the one hand, is premised on the lack of data 

segmentation by HIEs, but which also suggests that an HIE could segment data sufficiently to 

separate information that identifies a patient as a substance use patient from all other health 

information. Such technology should be applied broadly. The Clinic supports all efforts to 

expedite the implementation of uniform standards and technology that would allow for the 

4 
segmentation of substance use disorder and other sensitive information and allow for consented 

disclosures of protected health information. 

D. Medical Emergency

The Clinic would have no objection to SAMHSA conforming the regulatory standard for 

medical emergencies to the statutory standard, which authorizes the disclosure of patient 

information to meet a bona fide medical emergency. 42 U.S.C. § 290dd-2. We recommend that 

treatment providers, individuals in treatment and health practitioners identify factors that should 

be considered in making this determination and identify medical situations that meet the 

definition of a "bona fide medical emergency." 

That said, we would not interpret the statutory provision to authorize unconsented disclosures of 

information to medical personnel to "prevent an emergency." We interpret the statute to require 

the existence of an actual "medical emergency." While medical personnel should be given 

discretion to determine what constitutes a medical emergency, they should not be given latitude 

to access treatment records simply because a patient fails or refuses to disclose participation in 

medication assisted treatment or the use of prescription medications and hinders the 

practitioner's ability to provide care or prescribe other medications. Prescription drug 

monitoring programs, which have been implemented in most states, will allow health providers 

to identify certain medications that have been prescribed to patients when providing health care 

services. To the extent a patient shares information about other drug use to a treatment provider, 

we are concerned that disclosure of such information without the patient's consent will 

undermine the therapeutic relationship and should be avoided unless a medical emergency exists. 

E. Qualified Service Organization

The Clinic agrees that care coordination is a function that is consistent with the types of services 

that are currently defined as services that may be provided to the treatment program via a 

qualified service organization/business associates agreement. We do not envision consumer 

privacy concerns if an ACO uses information in its possession to identify program patients with 

chronic conditions who are in need of additional health services or care coordination. 

Accordingly, we would support the revision of the definition of QSO, 42 C.F.R. § 2.11, to 

identify care coordination as among the services that may be available to the program's patients, 

provided all other requirements governing QSO/business associates remain in effect. See 42 

C.F.R. §2.12(c)(4).

We are also in support of the disclosure of patient information to facilitate population health 

management to the extent that service is limited to the assistance of patients being treated by the 

program. The term "population health management" can encompass many different services, 

including outreach to individuals who may not currently participate in treatment. We recommend 

that any revision to the regulations define that term so that it relates to the assistance of a 

program's patients for purposes of care coordination. 

We have greater reservations about allowing a payor to enter a QSOA for purposes of care 

coordination as this could allow the payor to access health information that is otherwise subject 

5 
to Part 2 disclosure requirements. Although the payor would be subject to Part 2 rules regarding 

disclosure of patient information, we have general concerns about whether payors would be 

inclined to overstep and use patient information in an unauthorized manner. In such 

circumstances, patients would have little recourse against the payor. 

F. Research 

The Clinic has not studied this issue sufficiently to offer comments. 

G. Electronic Prescribing and Prescription Drug Monitoring Programs 

Although the Clinic has not studied this issue sufficiently to address SAMHSA's request for 

guidance, we recommend that standards be developed to ensure that patient information is not 

disclosed or redisclosed to law enforcement personnel absent compliance with Part 2 

requirements for criminal investigations of a program's patients. Additionally, it is important to 

develop privacy rules related to e-prescribing that afford all patients comparable protection for 

the use and disclosure of their prescription drug information if used to treat a substance use 

disorder, regardless of whether a Part 2 program discloses the information to a pharmacy, a 

physician who is not a "program" under Part 2 submits the prescription, or the patient effectively 

discloses his/her participation in treatment by filling a prescription at the pharmacy. In all of 

these situations, a patient has no choice but to disclose his or her status as a substance use patient 

in order to get treatment and should not he subject to potential criminal investigations by virtue 

of compliance with care. 

Thank you for considering our comments and please contact me at the email identified below if 

you have any questions. We look forward to reviewing any formal proposal to revise Part 2. 

Sincerely, 

Ellen M. Weber 

Professor of Law and Supervising Attorney 

Drug Policy and Public Health Strategies 

Clinic eweber@law.umaryland.edu 

6 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Comments on SAMHSA Proposed Rule on 

Confidentiality of Alcohol and Drug Abuse Patient Records 

Submitted by: New York eHealth Collaborative in Collaboration with the NY State Qualified 

Entities (RHIOs) 

NY eHealth Collaborative Dave Whitlinger, Executive Director 

Southern Tier Health Link (STHL) Christina Galanis, Executive Director 

HEALTHIX Tom Check, Executive Director 

HEALTHeCONNECTIONS Rob Hack, Executive Director 

HEALTHeLINK Dan Porreca, Executive Director 

BRONX RHIO Charles Scaglione, Executive Director 

INTERBORO RHIO Al Marino, Executive Director 

e-Health Network of Long Island Denise Reilly, Executive Director 

Introduction 

The NY eHealth Collaborative is a public/private partnership founded in 2006 by healthcare leaders in 

partnership with the NY State Department of Health. NYeC receives funding from state and federal 

grants to serve as the focal point for health IT in NY State. NYeC works to develop policies and 

standards to assist healthcare providers in making the shift to electronic health records, and to coordinate 

the creation of a network to connect healthcare providers statewide. The goal of NYeC is that no patient, 

wherever they may need treatment within the State of New York, is ever without fast, secure, accurate, 

and accessible information. 

Currently there are 9 Qualified Entities (formerly known as RHIOs) in NY State. NY State has established 

a governance model that is built on a statewide collaborative process. Through that process the state 

has established privacy and security policy standards and technical requirements for all certified QEs and 

their Participants. 

General Statement 

In NYS sharing of SAMHSA covered data has been inhibited through the health information exchanges 

throughout the state based on current interpretations of the SAMSHA regulations This is to the detriment 

of a whole class of patients who use such services and who are also in need of improved care 

coordination. It also creates a 2-tier system. In many integrated delivery networks (IDN), where 

SAMHSA covered data is documented in the same repositories as other health care services, the Part 2 

data is available within the medical record and without additional limitations within the IDN. This is one 

tier. Then, for patients who receive their Part 2 services in a separate organization from other care 

received, the data is not shared. This is the second, and in practice, lesser, tier. HIEs offer the ability to 

share data across organizations so that a single organizational EMR is not the requirement for 

coordinated care. 

1.	 Applicability of the Part 2 Regulations: To whom and to what data should the Part 2 

Regulations apply?
 

Applicability based on a location is possible. Applying the regulation based on the nature of the services 

offered is not possible at this time and will always be difficult. If SAMHSA feels compelled to maintain this 

extra level of restriction, beyond that of all other sensitive health information, then we strongly 

recommend it be facility/location based. The best solution, however, would be to acknowledge that this 

data is critical to good patient care and that existing HIPAA and other statutory controls protect patients 

adequately. Stronger enforcement and more aggressive provider education requirements (including 

attestations at licensure renewal) would go a long way toward reminding the health care community of its 

responsibilities. 

1 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

2.	 Consent Requirements: Do the consent requirements under the Part 2 Regulations need to be 

changed to allow for substance abuse records to be exchanged through an HIE? 

A simplified process is essential and should not require and should not require the patient to go back to 

the disclosing entity for each disclosure. In NYS, consent to access is required, thereby ensuring that the 

provider has received the patient’s approval to use the HIE to access data. That consent is very clear 

about the types of data included when such an access is made so the patient has the knowledge and the 

right to deny access if he or she so chooses. The patient is also provided with a list of all data sources 

participating in the HIE and how to reference any up-to-date versions of the list. 

We recommend that SAMHSA re-write the consent policy to be more in line with HIPAA requirements and 

to minimize the differences with standard procedures in use for all other areas of health information 

sharing today. Consent to access vs consent to disclosure gives the patient a powerful tool to control 

who sees their information. 

3.	 Redisclosure Prohibitions: How can the re-disclosure prohibitions be modified to allow
 

providers to be able to technically comply with them?
 

In NYS we believe we can meet the existing re-disclosure requirement by including the re-disclosure 

warning before any access of a patient record and/or in the “front matter” of any CCD. We suggest that 

a more effective approach would be regular education and training of providers and the requirement of an 

attestation at re-licensure that they understand the re-disclosure requirements. The greatest risk to 

inappropriate re-disclosure comes as more EMRs actively consume externally generated clinical 

information but do not tag it in such a way as to control re-disclosure. Limiting the restriction to only some 

data, i.e., identifying the individual as a substance abuser, sets the bar on data segmentation too high for 

the state of technology today. While such approaches will almost certainly work in the future, the need for 

data exchange today argues for very realistic implementation design. It is imperative that we increase 

efforts to improve EMR functionality and Health Information Management (HIM) policy so that future 

solutions can be developed. 

4.	 Medical Emergency Exception: Does the medical emergency exception to the consent
 

requirement need to be broadened or modified?
 

The current requirement that the Part 2 facility be notified of any break the glass event so that they can 

add this event to their log is an artifact of old, manual processes. Given the availability of audit trails at a 

health information exchange, and the ease with which the participating Part 2 provider can access those 

audit trails when required for any reason, including the request of a patient for a full accounting, this 

should suffice. Requiring the HIE to notify the Part 2 facility and for the Part 2 facility to integrate that 

information with the audit trails they keep is onerous and inefficient. NYS policies require that all 

emergency departments notify their patients of the use of break the glass access so patients are aware of 

such activity. 

We request that the requirement for notification to the Part 2 facility be dropped. 

5.	 Requirements related to Qualified Service Organizations: Do the categories of Qualified 

Services Organizations need to be broadened to allow for care coordination services to be 

performed by a QSO? 

Broadening the categories of QSOs to include those who provide services to the Part 2 organization 

and/or those who provide services to the patient who has received services from the Part 2 organization 

would allow care coordination programs who are serving the needs of the patient to be aware of care 

provided by the Part 2 organization. The challenge is that we cannot expect each care coordination 

organization to sign a separate QSOA with each provider of services. This is an area where the HIE can 

be helpful by including a QSOA as part of its over-riding participation agreement with each member of the 

2 
 

 

 

 

 

 

exchange. All organizations participating in the exchange can then have a level of trust that all other 

members have signed and do abide by the QSOA. 

6.	 Ability to conduct research using data that is subject to the Part 2 Regulations: Should the 

ability to use Part 2 data for research be expanded to include health care entities that receive and 

store Part 2 data? 

Research criteria that hold for all PHI should be applied to use of Part 2 data for research. If the data is 

de-identified and has IRB approval consent would not be required and the data can be used for health 

services research by the health care entities that receive and store Part 2 data. With use of any identified 

data (PHI or Part 2) the patient’s consent should be required unless waived by an IRB. 

We are available to discuss any of these comments at any point in the process. Please contact Cynthia 

Sutliff, Director of Policy at csutliff@nyehealth.org if you have any questions. 

3 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Board of Directors 

Deborah C. Peel, MD 

Founder & Chair 

Ben Barnes 

Jan Burrow 

Debra Diener, JD 

Andrew Dillon, PhD 

Kaliya Hamlin 

David W. Hilgers, JD 

Dennie Jagger 

Kimble Ross 

Staff 

Adrian Gropper, MD 

Chief Technology Officer 

Cory Laurel 

Research Director 

Atalie Nitibhon 

Policy Director 

Advisory Board 

Cliff Baker 

Troy Ball 

Andrew Blumberg, PhD 

Barry P. Chaiken, MD 

Lillie Coney 

Reed Gelzer, MD 

Ross Koppel, PhD 

Scott Monteith, MD 

Andy Oram 

Frank Pasquale, JD 

Marc Rotenberg, JD 

Mark Rothstein 

Shahid Shah 

Latanya Sweeney, PhD* 

Nicolas P. Terry, JD 

Patsy Thomasson 

*on leave 


 

Ensuring you control who sees your sensitive health information 

June 24, 2014 

RE: Comments on a Proposed Rule concerning the Confidentiality of Alcohol and Drug 

Abuse Patient Records Regulations, 42 CFR Part 2 by the Substance Abuse and 

Mental Health Services Administration 

 

ATTN: PrivacyRegulations@SAMHSA.hhs.gov. 

Dear Sir or Madam: 

Patient Privacy Rights Foundation (PPR), a 501c3 non-profit organization is pleased to 

submit comments on the proposed changes to 42 CFR Part 2. 

 

PPR is the world's leading consumer health privacy advocacy organization, with over 

12,000 members in all 50 states. Our mission is to restore personal control over the 

most sensitive information, data about our minds and bodies, in electronic systems. 

With that mission in mind, PPR also founded and leads the bipartisan Coalition for 

Patient Privacy, representing 10.3 million US citizens who want to control the use of 

personal health data in electronic systems. In 2007-2008, PPR developed a Privacy 

Trust Framework, 75+ auditable criteria that measure how effectively technology 

systems protect data privacy. The Framework can be used for research about privacy 

and to certify HIT systems. In 2011, PPR created the first annual International Summit 

on the Future of Health Privacy , co-hosted by Georgetown Law Center. 

I have been a practicing boarded adult psychiatrist for 40 years, was the Chair of the 

Department of Psychiatry at Brackenridge Hospital in Austin, Texas for 11 years, am a 

former President of the Texas Society of Psychiatric Physicians, and am the Founder 

and Chair of Patient Privacy Rights. 

 

The elimination of our human and civil rights to health information privacy, i.e., the 

elimination of our rights to give consent and control the use of sensitive personal health 

information by the Amendments to the HIPAA Privacy Rule in 2002 led me to found 

PPR in 2004. 

 

During the ten years of our work at PPR, the strong federal privacy protections in 42 

CFR Part 2, and in the federal regs known as “7332” that grant members of the military 

the right to segment certain sensitive data and prevent it from being shared outside the 

military health system, have been critical bulwarks and powerful federal precedents for 

health privacy rights. 

 

In the face of ever-increasing pressure from industry and the federal government to 

eliminate privacy rights and create a health data surveillance system, the preservation 

of privacy protections in 42 CFR Part 2 stand as a shining example of the data privacy 

protections patients need to trust healthcare institutions and physicians. In fact, privacy 

is essential for quality treatment and for patients’ willingness to participate in electronic 

records systems. 

P.O.$Box$248$•$Austin$TX$•$78767$$$$$$Phone$512.732.0033$•$Fax$512.732.0036$$$$$$Email:$privacy@patientprivacyrights.org

www.patientprivacyrights.org
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 


 

P.O.$Box$248$•$Austin$TX$•$78767$$$$$$Phone$512.732.0033$•$Fax$512.732.0036$$$$$$Email:$privacy@patientprivacyrights.org

www.patientprivacyrights.org


 

Despite strong privacy-protective laws in all 50 states for genetic information, mental health and 

substance abuse information, and information about STDs; despite Constitutional protections for 

health information privacy; despite strong privacy protections in tort law, common law, and medical 

ethics; and despite patients’ universal expectations to control the use of personal health information, 

the US has ended up with health technology systems designed to serve the massive hidden US health 

data broker industry. 

The “world’s largest information, technology, and service company” states “We have one of the largest 

and most comprehensive collections of healthcare information in the world, spanning sales, 

prescription and promotional data, medical claims, electronic medical records and social media. Our 

scaled and growing data set, containing over 10 petabytes of unique data, includes over 85% of the 

world’s prescriptions by sales revenue and approximately 400 million comprehensive, longitudinal, 

anonymous patient records.” The company buys “proprietary data sourced from over 100,000 data 

suppliers covering over 780,000 data feeds globally.” The company sells health data to “5,000 clients,” 

including the US Government. See: 

http://www.sec.gov/Archives/edgar/data/1595262/000119312514000659/d628679ds1.htm 

Clearly existing strong US laws like 42 CFR Part 2 must not be weakened, but strengthened and 

extended to cover all health data. 

Many commenters on June 11th claimed that HIPAA protects privacy. If that is so, how could the vast 

US health data broker industry even exist? Clearly data privacy protections in US law and medical 

ethics were not built into current health technology systems. 

Alan Westin’s research showed that 35-40% of the United States public has been health privacy 

intense for at least 20 years, see: http://patientprivacyrights.org/wp-content/uploads/2013/08/WestinsSlides-from-2011-Summit.pdf . 

The consequence having of no health privacy in the US is that 37.5 million people a year take action 

and hide health information, which in turn causes bad health outcomes and bad, incomplete data for 

research. And many millions more people – 5 to 6 million a year – delay or avoid treatment entirely, 

including for mental illness, cancer, and sexually transmitted diseases. The leaky, leaky US health IT 

system causes 40-50 million people every year to risk their health and lives. 

The US electronic healthcare system was built for data mining and data theft, not to serve patients’ 

urgent needs. 

We need to retain all our strong laws, and fight to restore the privacy patients require. SANHSA should 

stand firm and continue its long history of protecting patients with substance abuse and mental health 

diseases. 

Sincerely, 

Deborah C. Peel, MD 

Founder and Chair, Patient Privacy Rights 

 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 

The$Substance$Abuse$and$Mental$Health$Services$Administration$Public$Listening$Session$

Comments$

Confidentiality$of$Alcohol$and$Drug$Abuse$Patient$Records$Regulations,$42$CFR$Part$2

A"Proposed"Rule"by"the"Substance"Abuse"and"Mental"Health"Services"Administration,"U.S."

Department"of"Health"and"Human"Services

Document$Citation:

79 FR 26929

Document$Number:

2014G10913

Applicability$of$42$CFR$Part$2

SAMHSA"is"considering"options"for"defining"what"information"is"covered"under"42"CFR"Part"2."

Covered"information"could"be"defined"based"on"what"substance"abuse"treatment"services"are"

provided"instead"of"being"defined"by"the"type"of"facility"providing"the"services.

FR$Citation:$79"FR"26930

Questions:

• How"would"redefining"the"applicability"of"42"CFR"Part"2"impact"patients,"health"care"provider"

organizations,"HIEs, CCOs,"HIT"vendors,"etc.?

• Would"this"change"address"stakeholder"concerns?

• Would"this"change"raise"any"new"concerns?

Public$Comment$Field:

1) How"would"redefining"the"applicability"of"42"CFR"Part"2"impact"patients,"health"care"

provider"organizations,"HIEs,"CCOs,"HIT"vendors,"etc.?""

ANSWER: All"health"care"provider"organizations,"HIEs,"CCOs,"HIT"vendors,"and"integrated"care"
 

organizations"will"handle"sensitive"substance"abuse"data,"regardless"of"whether"they"advertise"
 

substances"abuse"services"or"not."That"information"needs"to"be"protected"the"same"way"
 

everywhere.""The$privacy$protections$for$sensitive$substance$abuse$treatment$
 

records/information$should$be$expanded$to$follow$the$data$everywhere$it$is$used$or$
 

disclosed,$in$every$kind$of$health$facility,$and$the$protections$should$apply$to$all$substance$
 

abuse$treatment$services,$not$just$certain$specified$services.$ 
 


 

Patient$Privacy$Rights$(PPR)$strongly$supports$defining$“covered$information” as$any$and$all$
 

information$about$substance$abuse,$wherever$it$is$held$or$used.$The very$broad requirements$
 

in$42$CFR$Part$2$protect$all$information$about$substance$abuse.$ 42"CFR"Part"2"does"not"allow"
 

any"exceptions"to"protecting"substance"abuse"data/information"based"on"the"services"provided,"
 

or"on"type"of"provider"or"institution."" 
 


 

All$substance$abuse$data$must$be$protected,$whether$the$data$is$collected$for$screening,$for$
 

brief$intervention,$or$for$any$other$preRtreatment$or$other$services.""It"is"impossible"to"draw"a"
 

line"based"on"where"services"for"substance"abuse"treatment"are"performed"or"what"the"services"
 

are,"because"people"with"substance"abuse"disorders"are"treated"in"every"type"of"medical"and/or"
 

healthcare"facility."Therefore,"the$information$about$substance$abuse$must$have$privacy$
 

protections$(privacy$metaRtagging$and$data$segmentation$functionality)$everywhere$it$is$used$
 

or$held.$ 
 

This$means$every$EHR$must$also$have$the$capacity$to$handle$and$protect$substance$abuse$

information$as$required$by$42$CFR$Part$2,$because$every$health$facility$that$treats$patients$will$

have$patients$with$substance$abuse$disorders."The"ability"to"metaGtag"data"for"privacy"enables"

sensitive"substance"abuse"data"to"be"segmented"from"other"medical"data."This"functionality"is"

1

 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 

also"essential"to"ensure"that"patient"consent"before"reGdisclosure"is"enforced.""For"EHRs"to"
 

function"effectively,"they"must"all"have"the"capacity"to"handle"and"segment"sensitive"data,"as"
 

required"by"HITECH,"and"as"required"long"before"HITECH"by"strong"state"and"federal"laws 
 

including"42"CFR"Part"2,"and"medical"ethics—since"people"with"substance"abuse"disorders"are"
 

treated"in"every"kind"of"healthcare"setting." 
 


 

EHRs$fail$if$data$cannot$be$segmented.""It’s$astonishing$that$most$EHR$vendors$ignored$US$law$
 

and$medical$ethics$when$designing$their$products."Not"only"do"EHRs"need"to"be"able"to"
 

segment"sensitive"data,"this"same"functionality"is also"required"for"handling"erroneous"data."" 
 

Technology$to$segment$patient$data$is$essential$both$for$patient$safety$and$for$privacy."It’s"
 

obvious"that"EHRs"must"have"the"functionality"to"segment"data;"otherwise"an"EHR"would"
 

endlessly"disclose"erroneous"data,"which"could"harm"patients." 
 


 

The$HIT$industry$continues$to$pretend$that$no$EHRs$or$technology$comply$with$the$
 

requirements$of$42$CFR$Part$2,$or$that$it$would$be$too$expensive$or$difficult$to$comply.""But"
 

industry"has"also"long"ignored"the"robust"open"source"behavioral"health"EHR"built"by"the"NDIIC,"
 

which"has"very"detailed"consent"and"segmentation"technologies"that"enable"patients"to"choose"
 

which"parts"of"their"PHI"to"disclose"to"whom"and"for"how"long"(and"the"EHR"fulfills"all"the"other"
 

requirements"of"42"CFR"Part"2)."Over"4"million"electronic"health"records"have"been"exchanged"in"
 

22"jurisdictions"and"8G9"states."HHS"held"a"Consumer"Choices"Technology"Hearing"in"June"2010,"
 

and"the"NDIIC"technology"was"one"of"the"7"privacyGenabling"technologies"that"were"
 

demonstrated." 
 


 

However,$EHR$and$HIT$vendors$continue$to$lobby$to$oppose$longstanding$patient$privacy$
 

rights$and$oppose$building$the$capacity$for$data$segmentation$and$metaRtagging$data$into$
 

their$products."The"lack"of"these"crucial"functions"forces"physicians"and"health"professionals"to 
 

create"dangerous"“workGarounds”"outside"the"EHR"to"be"able"to"deal"with"sensitive"or"erroneous"
 

data,"introducing"more"complexity,"creating"more"opportunities"for"errors,"jeopardizing"patient"
 

safety,"and"even"creating"a"need"to"go"back"and"keep"some"records"on"paper.""
 


 

Privacy$protections$must$follow$the$data$so$that$patients$can$give$consent$to$selected$health$
 

professionals$to$see$and$use$selected$parts$of$their$health$data,$and$prevent$access$by$those$
 

who$do$not$need$to$see$or$use$certain$data. Every"person"on"the"patient’s"care"team"does"not"
 

require or"want"the"same"level"of"access"to"all"aspects"of"the"patient’s"health.""If"everyone"on"
 

the"team"has"access"to"the"entire"patient"record,"then"everyone"on"the"team"is"also"liable"for"the"
 

entire"record"and"the"patient’s"treatment,"regardless"of"whether"they"have"knowledge"and"
 

expertise"about"each"diagnosis"and"treatment." 
 


 

The$patient’s$ability$to$choose$which$health$professionals$can$see$and$use$substance$abuse$
 

data$is$essential$for$integrated$care$settings$and$ACOs$because$some$team$members$will$have$
 

negative$reactions$to$people$with$substance$abuse$disorders." 
 


 

In$addition, most$of$the$team that$is$treating$the$patient’s$other$diseases$has$no$need$to$know$
 

every$detail$of$the$patient’s$substance$abuse$treatment. Patients"simply"do"not"trust"every"
 

health"professional"to"the"same"degree.""Today""1/8"patients"hide"or"omit"information"to"keep"
 

certain"information"private,"when"they"know"they"can’t"control"access"to"their"records."If"
 

integrated"care"settings"do"not"permit"patients"to"control"access"to"their"substance"abuse"data,"
 

the"result"will"be"the"same."And"when"patients"hide"or"omit"data,"they"put"their"lives"and"health"
 

at"risk.""The"lack"of"patient"control"over"access"to"PHI"causes"37.5"million"people"every"year"to"
 

2

 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 

hide"information."Trust"and"personal"control"over"access"to"PHI"is"particularly"critical"for"
 

effective"treatment"of"substance"abuse"integrated"settings. 
 


 

Decisions$about$who$should$have$access$to$substance$abuse$data$should$be$made$by$the$
 

patient$in$consultation$with$the$admitting$physician$and/or$with$the$health$professional 
 

responsible$for$the substance$abuse$treatment,"which"is"the"same"way"treatment"teams"
 

worked"using"paper"records"systems."Access"to"sensitive"information"is"shared"with"consent"
 

when"necessary"and"appropriate,"only"with"selected"individuals"on"the"treatment"team. 
 


 

2) Would"this"change"address"stakeholder"concerns?""
 


 

ANSWER:""No,$but$stakeholders$don’t$have$rights$to$obtain$information$about$substance$abuse$
 

without$patient$consent.""
 


 

Patient$Privacy$Rights$strongly$supports$the$rights$of$patients$to$control$the$use$and$disclosure$
 

of$substance$abuse$information.$42$CFR$part$2$privacy$protections$should$not$be$weakened$for$
 

the$convenience$of$stakeholders,$HIEs,$or$integrated$care$teams;$or$be$weakened$because$
 

most$EHR$vendors$have$long$ignored$US$laws$that$require$health$record$holders$to$protect$
 

substance$abuse$data$in$very$specific$ways.$It’s$time$for$the$EHR$vendors$to step$up$and$build$
 

products$that$comply$with$the$law$and$patients’$rights. 
 


 

3) Would"this"change"raise"any"new"concerns?""
 


 

ANSWER:""Yes,$if$SAMHSA$weakens$the$42$CFR$Part2$privacy$protections$as$proposed$by$
 

narrowing$the$broad$directive$to$protect$sensitive$information$about$substance$abuse$
 

information$(wherever$it$is$held)$so$that$the$protections$only$apply$to$certain$facilities or$to$
 

certain$services,$then$even$more$people$with$substance$abuse$disorders$will$delay$or$avoid$
 

treatment$and/or$hide$information,$causing$bad$data$and$bad$health$outcomes."" 
 


 

Currently$40R50$million$people$every$year$hide$information$or$delay$or$avoid$treatment$for$

cancer,$mental$illness$or$STDs$because$they$know$that$their$sensitive$health$data$is$not$

private.""Surely"SAMHSA"should"not"weaken"the"42"CFR"Part"2"regulations,"knowing"that"the"

consequence"will"be"to increase"the"number"of"people"with"substance"abuse"disorders"who"act"

to"protect"their"privacy"by"hiding"information,"or"delaying"or"avoiding"substance"abuse"

treatment.""See:"http://patientprivacyrights.org/wpGcontent/uploads/2010/08/TheGCaseGforG

InformedGConsent.pdf""for"statistics.

EHRs$should$not$drive$even$more$people$to$act$in$ways$that$put$their$health$and$lives$at$risk."

When"EHRs"are"built"to"ensure"patients’"privacy"rights,"then"patients"will"be"willing"to"disclose"

the"right"sensitive"information"to"the"right"persons"on"their"integrated"care"team"at"the"right"

time.


 

Consent$Requirements

While"technical"solutions"for"managing"consent"collection"are"possible,"SAMHSA"is"examining"

the"consent"requirements"in"§"2.31"to"explore"options"for"facilitating"the"flow"of"information"

within"the"health"care"context"while"ensuring"the"patient"is"fully"informed"and"the"necessary"

protections"are"in"place."Specifically,"we"are"analyzing"the"current"requirements"and"considering"

the"impact"of"adapting"them"to:

1."Allow"the"consent"to"include"a"more"general"description"of"the"individual,"organization,"or"

3

 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 

health"care"entity"to"which"disclosure"is"to"be"made.""NO

2."Require"the"patient"be"provided"with"a"list"of"providers"or"organizations"that"may"access"their"

information,"and"be"notified"regularly"of"changes"to"the"list.""NO

3."Require"the"consent"to"name"the"individual"or"health"care"entity"permitted"to"make"the"

disclosure.""YES

4."Require"that"if"the"health"care"entity"permitted"to"make"the"disclosure"is"made"up"of"multiple"

independent"units"or"organizations"that"the"unit,"organization,"or"provider"releasing"substance"

abuse"related"information"be"specifically"named.""NO

5."Require"that"the"consent"form"explicitly"describe"the"substance"abuse"treatment"information"

that"may"be"disclosed."""YES

FR$Citation:$79"FR"26931

Questions:

• Would"these"changes"maintain"the"privacy"protections"for"patients?

• Would"these"changes"address"the"concerns"of"HIEs,"health"homes,"ACOs,"and"CCOs?

• Would"these"changes"raise"any"new"concerns?

Public$Comment$Field: 
 

1) Would"these"changes"maintain"the"privacy"protections"for"patients? ""NO 
 


 

ANSWERS:""No$to$1,$2,$and$4.$$Yes$to$3$and$5.$ 
 


 

It$is$critical$for$patients$to$know$exactly$who$is$in$charge$of$their$treatment,$who$is$part$of$
 

their$treatment$team,$and$who$discloses$their$PHI. The"name"of"a"data"discloser"should"be"
 

easily"available." 
 


 

Part$of$the$problem$is$that$health$data$holders$prefer$to$use$written,$paper$consents:""
 

According"to"SAMHSA,"“These"organizations"have"a"large"and"growing"number"of"member"
 

providers"and"they"generally"do"not"have"sophisticated"consent"management"capabilities."
 

Currently,"a"Part"2"compliant"consent"cannot"include"future"unGnamed"providers"which"require 
 

the"collection"of"updated"consent"forms"whenever"new"providers"join"these"organizations.” 
 

SAMHSA$could$mandate$the$use$of$robust$independent$electronic$consent$tools. Patients"need"
 

one"place"to"set"their"own"rules"for"the"use"of"their"PHI,"so"anyone"who"wants"the"data"could"
 

automatically/electronically"check"with"our"consent"management"system"and"either"is"granted"
 

access"or"ping"us"for"any"exceptions"to"our"data"use"rules.""It"is"essential"to"create"technology"to"
 

improve"patients’"experiences"with"healthcare"systems."
 


 

If"the"name"of"the"person"who"will"be"responsible"for"the"patient’s"treatment"at"a"new"facility"or"
 

organization"is"not"yet"available,"the"name"of"the"entity"may"be"temporarily"used"instead"to"
 

receive"the"disclosed"records."Once"the"patient"arrives"at"the"entity,"the"name"of"the"specific"
 

person"responsible"for"treatment"should"be"given"to"the"patient"and"designated"in"the"EHR"as"
 

the"admitting"physician"or"health"professional."" 
 


 

All$technology$systems$authenticate$all$users,$so$there$is$no$need$to$provide$lists$of$possible$

users$or$organizations$that$may$or$may$not$access$patient$data$when$audit$trails$of$every$

access$are$logged$and$easy$to$provide$automatically$in$realRtime$using$patient$portals."This"is"a"

right"that"HITECH"granted"to"patients"and"is"known"as"an"“Accounting"for"Disclosures”"(A4D),

that"industry"has"blocked"since"2009."SAMHSA$could$mandate$that$all$entities$that$hold$or$use$

substance$abuse$data$make$all$disclosures$open,$transparent,$and$accountable$to$patients$by$

offering$patients$electronic$consent$tools$and$giving$patients$access$to$realRtime$lists$of$A4Ds$

as$HITECH$required,$enabling$substance$abuse$data$to$be$protected$and$disclosures$to$be$

4

 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 

automated.

It$is$also$critical$for$patients$to$know$exactly$who$has$accessed$their$information$and$
 

specifically$which$information$was$accessed.$ All"staff"must"be"authenticated"by"EHR"systems"in"
 

order"to"use"the"system"and"an"accounting"of"all"users"and"which"PHI"they"accessed"can"be"
 

provided"to"patients"easily"and"automatically." 
 


 

Being$“fully$informed”$of$lists$of$possible$data$users$means$not$being$accurately$informed$and$
 

violates$the$privacy$protections$42$CFR$Part$2.$First,"patients"have"the"right"to"control"the"use"
 

and"disclosure"of"PHI"about"substance"abuse;"and"current"technology"systems"are"required"to"
 

authenticate"users,"log"all"access,"and"audit"logs"show"exactly"which"data"was"used"or"disclosed"
 

by"whom. "Second,"technology"makes"it"easy"to"automate"electronic"realGtime"patient"access"to"
 

an"Accounting"for"Disclosures,"ie"to"the"list"of"users"and"what"data"they"used. 
 


 

2) Would"these"changes"address"the"concerns"of"HIEs,"health"homes,"ACOs,"and"CCOs?"" 
 


 

ANSWER:""No,$but$42$CFR$part$2$privacy$protections$should$not$be$weakened$for$the$
 

convenience$of$stakeholders,$HIEs,$health$homes,$ACOs,$CCOs,$or$integrated$care$teams;$or$be$
 

weakened$because$most$EHR$vendors$have$long$ignored$US$laws$that$require$health$record$
 

holders$to$protect$substance$abuse$data$in$very$specific$ways.$It’s$time$for$the$EHR$vendors$to$
 

build$products$that$comply$with$the$law$and$patients’$rights. 
 

3) Would"these"changes"raise"any"new"concerns?""
 


 

ANSWER:""Yes."SAMHSA"accepts"at"face"value"industry"assertions"that"obtaining"paper"consent"is"
 

laborious"and"that"they"“generally"do"not"have"sophisticated"consent"management"capabilities”.""
 

Industry"is"simply"asking"SAMHSA"and"the"public"to"accommodate"using"poorlyGdesigned"EHR"
 

and"HIT"systems"that"deprive"patients"of"their"rights"to"protect"PHI,"rather"than"build"or"use"
 

existing"open"source"technologies"for"consent,"patient"portals,"BB+,"Direct"Secure"email"so"we"
 

can"email"our"physicians,"A4D,"or"data"segmentation."""Technology"should"serve"patients’"needs,"
 

not"industry’s"needs."
 


 

Redisclosure

SAMHSA"is"considering"revising"the"redisclosure"provision"to"clarify"that"the"prohibition"on"

redisclosure"only"applies"to"information"that"would"identify"an"individual"as"a"substance"abuser,"

and"allows"other"healthGrelated"information"shared"by"the"Part"2"program"to"be"redisclosed,"if"

legally"permissible."This"would"allow"HIT"systems"to"more"easily"identify"information"that"is"

subject"to"the"prohibition"on"redisclosure"enabling"them"to"utilize"other"technological"

approaches"to"manage"redisclosure."If"data"are"associated"with"information"about"where"the"

data"were"collected"(data"provenance)"which"reveals"that"the"data"were"collected"by"a"practice"

that"exclusively"treats"addiction,"the"data"would"still"be"protected"under"the"proposed"change.

FR$Citation:$79"FR"26931

Questions:

• Would"this"type"of"change"facilitate"technical"solutions"for"complying"with"42"CFR"Part"2"in"an"

EHR"or"HIE"environment?

• Would"these"changes"maintain"the"privacy"protections"for"patients?


 

Public$Comment$Field:

I"found"this"section hard"to"understand.""

5

 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 

1)"Would"this"type"of"change"facilitate"technical"solutions"for"complying"with"42"CFR"Part"2"in"an"
 

EHR"or"HIE"environment?" 
 


 

ANSWER:""If"SAMHSA’s"intent"is"to"enable"PHIGGG such"as"certain"specific"lab"results,"other"tests,"
 

treatments,"or"information"from"a"physical"exam"or"history"that"isn’t"related"to"a"patient’s"
 

substance"abuse"disorderGGGto"be"redisclosed"without"patient"consent,"if"the"data"provenance"
 

was"not"from"a"substance"abuse"treatment"facility,"PPR"supports"that"intent."If"SAMHSA‘s"intent"
 

is"also"to"separate substance"abuseGrelated"PHI"from"nonGsubstance"abuseGrelated"PHI,"PPR"
 

agrees"that"could"be"done"by"metaGtagging"the"substance"abuseGrelated data"and"data"
 

provenance"for"privacy." 
 


 

SAMHSA"seems"to"expect"that"metaGtagging"both"data"and"documents"for"privacy"will"make"
 

compliance"with"42"CFR"Part"2"and"reGdisclosure"of"some"PHI"simpler"and"clearer"for"industry"
 

and"patients to"understand"when"using"EHRs"and"HIEs."If"that"is"the"intent,"it"builds"on"both"the"
 

PCAST"Report"of"December"2010"and"also"on"the"recently"proposed"certification"standard"for"
 

metaGtagging"PHI"in"behavioral"health"EHRs"for"privacy"to"comply"with"Stage"3"Meaningful"Use"
 

voluntary"criteria,"slated"to"go"into"effect"in"2017. If"we"correctly"understand"SAMHSA’s"intents 
 

about"reGdisclosure"of"data,"then"PPR"agrees"with"the"proposals"for"technical"solutions,"which"
 

also"require"the"ability"to"segment"data."" 
 


 

2)$Would"these"changes"maintain"the"privacy"protections"for"patients? 
 


 

ANSWER:""IF"we"correctly"understood"what"SAMHSA"proposed,"then"PPR agrees"these"methods"
 

are"one"way"to"maintain"data"privacy"protections"for"patients. 
 


 

Medical$Emergency

SAMHSA"is"considering"adapting"the"medical"emergency"exception"to"make"it"more"inGline"with"

the"statutory"language"and"to"give"providers"more"discretion"as"to"when"a"bona"fide"emergency"

exists."For"example,"amending"this"standard"to"allow"providers"to"use"the"medical"emergency"

provision"to"prevent"emergencies"or"to"share"information"with"a"detoxification"center"when"a"

patient"is"unable"to"provide"informed"consent"due"to"their"level"of"intoxication.

FR$Citation:$79"FR"26931

Questions:

• What"factors"should"providers"take"into"consideration"in"determining"whether"a"medical"

emergency"exists?

• Are"there"specific"use"cases"SAMHSA"should"take"into"consideration?"Show"citation"box"

 • Are"there"patient"concerns"about"the"impact"of"this"change"on"their"privacy?

Public$Comment$Field:


 

Patient"Privacy"Rights"agrees"that"the"critical"piece"is"to"rely"on"the"expertise"of"the"health"
 

professional who"handles"the"emergency."That"person"should"be"given"wide"latitude"to"decide"
 

what"poses"an"“immediate"threat”"to"self"or"others"and"what"requires"“immediate"
 

intervention”."The"idea"that"emergencies"can"be"prevented"may"be"another"way"of"saying"the"
 

same"thing,"but"that"is"not"clear."“Immediacy"of"threat"and"immediate"need"for"intervention”"
 

seems"a"much"clearer"way"to"characterize"the"decision." 
 


 

The"situation"about"what"constitutes"an"immediate"threat"to"life"and"the"immediate"need"for"
 

6
$Organization$(QSO)


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 

intervention"with"someone"who"is"intoxicated"also"should"depend"on"the"discretion"and"
 

judgment"of"the"health"professional."Intoxication"can"be"lifeGthreatening"or"may"not"be,"and"a"
 

physician"can"figure"that"out"with"lab"tests"and"physical"exam.""Not"being"able"to"give"consent"
 

does"not"necessarily"mean"that"intoxication"is"an"immediate"threat"to"life"or"requires"immediate"
 

intervention. 
 


 

Use"cases"that"are"cut"and"dried"are"easy,"such"as"coma."But"most"decisions"must"be"made"
 

based"on"the"status"of"a"particular"individual." 
 


 

PPR"recommends"not"mandating"a"list"of"situations"that"constitute"immediate"threats"and"must"
 

be"acted"upon;"i.e.,"do"not"create"a"‘duty"to"act’. 
 


 

Qualified$Service

SAMHSA"is"analyzing"the"regulations"to"identify"options"for"allowing"Part"2"data"to"flow"to"health"
 

care"entities"for"the"purpose"of"care"coordination"and"population"management"while"
 

maintaining"patient"protections."One"potential"solution"includes"expanding"the"definition"of"a"
 

qualified"service"organization"(QSO;"§"2.11)"to"explicitly"include"care"coordination"services"and"
 

to"allow"a"QSO"Agreement"(QSOA)"to"be"executed"between"an"entity"that"stores"Part"2"
 

information,"such"as"a"payer"or"an"ACO"that"is"not"itself"a"Part"2"program,"and"a"service"provider. 
 

FR$Citation:$79"FR"26931 
 

Questions: 
 

• Are"there"other"use"cases"we"should"be"taking"into"consideration?"

• Are"there"specific"patient"concerns"about"the"impact"of"this"change"on"their"privacy?

Public$Comment$Field:

1) Are"there"other"use"cases"we"should"be"taking"into"consideration?" 
 


 

PPR"already"explained"in"detail"why"allowing"the"use"of"Part2"data"for"care"coordination,"
 

whether"it"is"designated"a"QSO"or"not,"is"a"very"bad"idea."Because"Part"2"data"is"extremely"
 

sensitive,"violating"patients’"rights"to"selectively"share"that"information"will"drive"patients"with"
 

substance"abuse"disorders"away"from"treatment"in"ACOs,"integrated"care"settings,"and"every"
 

other"setting"where"data"is"shared"for"population"health"management"without"consent."See"our"
 

extensive"comments"in"the"section"on"Applicability"of"42"CFR"Part"2." 
 


 

Although"the"first"HIPAA"Privacy"allows"broad"disclosure"of"PHI"without"consent"for"population"
 

health,"research,"public"health,"and"law"enforcement"uses,"these"broad"disclosures"were"never"
 

debated"by"the"public"at"large."The"public"regards"all"use"of"PHI"to"answer"questions"about"
 

health"as"“research,”"which"they"believe"should"only"take"place"if"they"consent."The"US"public"
 

strongly"opposes"the"use"of"PHI"for"‘research’"of"any"kind"without"consent."See"Alan"Westin’s"
 

study"for"the"IOM"about"public"attitudes"about"research"use"of"personal"health"information"
 

without"consent"at:"http://patientprivacyrights.org/wpG
 

content/uploads/2010/01/WestinIOMSrvyRept.pdf""
 


 

Some"key"statistics"from"Westin’s"study"for"the"IOM:""Only"1%"of"people"would"agree"to"
 

unfettered"research"use"of"their"health"data"without"consent."Even"with"IRB"approval"and"the"
 

use"of"deGidentified"health"data,"still"only"19%"of"people"would"agree"to"use"of"their"health"data"
 

without"consent. 
 


 

2)"Are"there"specific"patient"concerns"about"the"impact"of"this"change"on"their"privacy? 
 

7
 

 

	 

Please$see$our$detailed$comments$in$the$section$on$Applicability$of$42$CFR$Part$2.""

97%"of"patients"believe"their"health"data"belongs"to"them"and"they"should"control"its"use."AHRQ"

convened"20"focus"groups"across"the"US"in"2009"and"found"that"the"majority"of"people"agreed"

that"there"is"no"need"for"oneGsizeGfitsGall"policies"to"control"the"use"and"disclosure"of"PHI;"they"

expected"to"be"able"to"make"individual"decisions. A"majority"believes"their"medical"data"is"“no"

one"else’s"business”"and"should"not"be"shared"without"their"permission.""This"belief"was"

expressed"not"necessarily"because"they"want"to"prevent"some"specific"use"of"data"but"as"a"

matter"of"principle."Participants"overwhelmingly"wanted"to"be"able"to"communicate"directly"

with"their"providers"with"respect"to"how"their"PHI"(protected"health"information)"is"handled,"

including"with"whom"it"may"be"shared"and"for"what"purposes."See study at:

http://healthit.ahrq.gov/sites/default/files/docs/citation/09-0081-EF.pdf 

Research

SAMHSA"is"considering"expanding"the"authority"for"releasing"data"to"qualified"

researchers/research"organizations"to"health"care"entities"that"receive"and"store"Part"2"data,"

including"thirdGparty"payers,"health"management"organizations,"HIEs,"and"care"coordination"

organizations."

FR$Citation:$79"FR"26932

Questions:

• Are"there"factors"that"should"be"considered"related"to"how"current"health"care"entities"are"

organized,"how"they"function"or"how"legal"duties"and"responsibilities"attach"to"entities"that"

make"up"an"umbrella"organization?

• Would"this"change"address"concerns"related"to"research?"

• Are"there"specific"privacy"concerns"associated"with"expanding"the"authority"or"releasing"data"

to"qualified"researchers/research"organizations"in"this"way?"

• Are"there"additional"use"cases"that"should"be"considered"in"the"research"context?

Public$Comment$Field:

1) Are"there"factors"that"should"be"considered"related"to"how"current"health"care"entities"are"

organized,"how"they"function"or"how"legal"duties"and"responsibilities"attach"to"entities"that"

make"up"an"umbrella"organization?

2) Would"this"change"address"concerns"related"to"research?"

3) Are"there"specific"privacy"concerns"associated"with"expanding"the"authority"or"releasing"

data"to"qualified"researchers/research"organizations"in"this"way?"

4) Are"there"additional"use"cases"that"should"be"considered"in"the"research"context?

ANSWERS:

This"proposal"violates"the"strong"rights"patient"have"to"control"the"use"of"sensitive"Part"2"data."

All"the"entities"that"SAMHSA"proposes"to"release"data"to"are"not"organizations"that"patients"

know"or"trust"with"sensitive"personal"data"about"substance"abuse"diagnoses"and"treatment."

Many"vulnerable"populations"have"long"memories"of"abuse"at"the"hands"of"researchers,"

including"African"Americans"(Tuskegee),"mentally"ill"people,"prisoners,"and"those"with"low"IQs.

No"matter"what"legal"duties"or"responsibilities"or"other"arrangements"are"made"so"healthcare"

entities"can"release"data"for"research"to"third"parties,"HIEs,"HMOs,"care"coordination"

organizations"or"umbrella"organizations,"US"patients"will"never"support"this"kind"of"hidden,"

8
$Issues$With$Electronic$Prescribing$and$Prescription$Drug$Monitoring$


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 

coerced,"deceptive"use"of"their"Part 2"data"without"consent."The"qualifications"of"the"research"

organizations"and"researchers"do"not"outweigh"the"public’s"needs"and"expectations"for"privacy,"

autonomy,"and"respect."The"only"way"the"majority"of"US"patients"are"willing"to"participate"in"

research"is"if"they"are"asked"openly"for"consent"about"a"particular"project"or"projects"and"are"

informed"about"the"results"of"the"research.""The"US"public"simply"does"not"trust"researchers"or"

organizations"that"steal,"take,"or"use"their"data"without"consent."


 


 

Addressing$Potential
 

Programs$(PDMPs) 
 

Part"2"protections"include"a"prohibition"on"the"redisclosure"of"information"received"directly"from"
 

a"Part"2"program."A pharmacy"that"receives"electronic"prescription"information"directly"from"a"
 

Part"2"program"must"obtain"patient"consent to"send"that"information"to"a"PDMP,"and"patient"
 

consent"is"also"required"for"the"PDMP"to"redisclose"that"information"to those"with"access"to"the"
 

PDMP.
 

Preamble$FR$Citation:$79"FR"26932 
 

Questions:

• How"do"pharmacy"information"system"vendors"anticipate"addressing"this"issue?"Are"there"

specific"technology"barriers"SAMHSA"should"take"into"consideration?

• Are"there"other"concerns"regarding"42"CFR"Part"2"and"PDMPs?"Please"describe"relevant"use"

cases"and"provide"recommendations"on"how"to"address"the"concerns.

• Are"there"patient"concerns"about"the"impact"of"eGprescribing"and"PDMPs"on"their"privacy?

Public$Comment$Field: 
 


 

KEY"ANSWER: Yes,$patients$are$very$concerned$about$the$lack$of$privacy$of$eRprescribing$and$
 

of$prescriptions$in$PDMPs. Many"patients"simply"refuse"to"take"effective,"needed"medications"
 

knowing"that"it"is"impossible"to"keep"any"prescription"private"in"the"US,"even"if"you"pay"cash."
 

Every"prescription"in"the"nation"has"been"sold"every"night"for"over"25"years."IMS"Health"Holdings"
 

is"the"largest"health"data"prescription"broker"in"the"world. 
 


 

I$am$not$aware$of$barriers$in$42$CFR$Part$2$that$prevent$prescriptions$from$being$tracked$in$

state$PDMPs.


 

GENERAL"ANSWERS:""
 


 

I"don’t"think"that"SAMHSA"has"all"the"correct"facts"about"how"PDMPs"obtain"prescriptions."I"am"
 

not"aware"of"any"states"where"pharmacies"have"to"get"consent"from"patients"to"send"controlled"
 

substance"prescriptions"to"the"state’s"PDMP."Patients"apparently"have"no"choice"about"their"
 

controlled"substances"prescriptions"being"tracked"via"state"PDMPs." 
 


 

I"am"most"familiar"with"how"the"Oregon"PDMP"works."The"state"of"Oregon"requires"all"
 

controlled"substance"prescriptions"to"be"directly"entered"into"the"state’s"PDMP;"patient"consent"
 

is"not"required"for"pharmacies"to"add"controlled"substance"prescriptions"to"the"data"base."Do"
 

state"or"federal"laws"preempt"42"CFR"Part"2"redisclosure"prohibitions?""Clearly"42"CFR"Part"2"
 

alone"does"not"prevent"state"law"enforcement"access"to"state"PDMPs"either."
 


 

I"was"a"legal"expert"for"the"ACLU"in"a"battle"over"law"enforcement"access"to"the"Oregon"PDMP."
 

https://www.aclu.org/technologyGandGliberty/oregonGprescriptionGdrugGmonitoringGprogramGvG
 

drugGenforcementGadministration""
 

9
 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 


 

Oregon"passed"a"state"law"requiring"stronger"data"privacy"protections"than"federal"law"requires"
 

for"access"to"the"data."The"case"is"called"OREGON"PRESCRIPTION"DRUG"MONITORING"
 

PROGRAM,"an"agency"of"the"STATE"OF"OREGON, Plaintiff,"v."UNITED"STATES"DRUG"
 

ENFORCEMENT"ADMINISTRATION,"an"agency"of"the"UNITED"STATES"DEPARTMENT"OF"JUSTICE,"
 

Defendant,"in"US"District"Court,"District"of"Oregon,"Portland"Division,"Case"No.:"3:12GcvG02023G
 

HA. 
 


 

Many"state"Prescription"Drug"Monitoring"Programs"(PDMPs),"not"including"Oregon’s"PDMP,"
 

currently"allow"access"to"access"identifiable"patient"prescriptions"for"controlled"substances"by"
 

law"enforcement,"the"Drug"Enforcement"Agency"(DEA),"and"other"government"agencies."This"
 

case"showed"the"DEA’s"intent"to"have"full"access"to"all"prescriptions"for"controlled"substances"in"
 

all"state"PDMPs,"despite"Americans’"broad"rights"to"health"information"privacy1,2"and"despite"
 

specific"privacy"rights"that"law"enforcement"requests"for"information"in"Oregon"PDMP"must"be"
 

pursuant"to"a"valid"court"order.

3 
 


 

Physicians’"ethical"and"professional"duty"of"confidentiality"exists"precisely"to"protect"the"kind"of"
 

sensitive"medical"information"at"issue"in"this"case."Easy"law"enforcement"access"to"confidential"
 

and"sensitive"prescription"records"has"adverse"effects"for"both"patients"and"doctors,"and"violates"
 

the"privacy"that"most"patients"and"practitioners"expect"for"protected"health"information."State"
 

PDMPs,"including"the"Oregon"PDMP"potentially"could"contain"sensitive"information"on"a"large"
 

percentage"of"residents,"risking"the"exposure"of"their"sensitive"prescription"records"via"data"
 

breach,"theft,"misuse,"fraudulent"use,"and"harms"such"as"extortion"or"reputation"harm.""Data"
 

bases"that"contain"sensitive"personal"health"information"are"extremely"attractive"targets"
 

because"health"information"is"the"most"valuable"personal"information"in"the"Digital"Age."Social"
 

Security"numbers"and"other"types"of"personal"information"sell"online"for"far"less.4 
 


 

Moreover,"the"website"of"the"Oregon"Prescription"Drug"Monitoring"Program"makes"strong"
 

representations"about"the"privacy"and"security"of"prescription"records"and"explicitly"assures"
 

patients"that"law"enforcement"can"only"access"those"records"with"a"court"order"based"on"
 

probable"cause." 
 


 

A"district"court"judge"ruled"in"February"2014"that"Oregon"patients"have"a"reasonable"
 

expectation"of"privacy"in"their"prescription"records"and"that"law"enforcement"must"obtain"a"
 

warrant"in"order"to"search"such"information."Most"states"do"not"require"warrants"for"access"to"
 

their"PDMPs"like"Oregon"does. 
 


 

Since"controlled"substance"prescriptions"are"now"tracked"in"almost"every"state"in"the"US,"the"
 

treatment"of"addiction,"chronic"pain,"ADHD,"and"the"use"of"steroids"for"hormone"replacement"
 

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

1

""The'right'to'be'let'alone'is'the'most'comprehensive'of'rights'and'the'right'most'valued'by'civilized'men.""
 

To"protect"that"right,"every"unjustifiable"intrusion"by"the"government"upon"the"privacy"of"the"individual,"
 

whatever"the"means"employed,"must"be"deemed"a"violation"of"the"[Constitution].”'''Olmstead'v.'United'
 

States,'277'U.S.'438,'478,'48''S.Ct.'564,'572'(1928)'(Brandeis'dissenting) 
 2

"“In"fact,"the'constitutionally'protected'right'to'privacy'of'highly'personal'information'is'so'well'
 

established'that'no'reasonable'person'could'be unaware'of'it.”"""Sterling"v."Borough"of"Minersville,"232"
 

F.3d"190,"198"(3rd"Cir."2000). 
 3

"Oregon"[prescription"Drug"Monitoring"Program,"see:"
 

http://www.orpdmp.com/orpdmpfiles/PDF_Files/PDMP_FactSheet_2012_v1.1.pdf

4

"ABC"TV"story

10
rolled$substance$prescriptions$are$now$tracked$in$almost$every$state,$

therapies"have"been"“criminalized,”"i."e.,"instead"of"that"information"being"dealt"with"by"treating"

health"professionals,"law"enforcement"has"access"to"all"data"in"most"states.

11
MARISSA K. FLANNERY E-MAIL: marissa@sonosky.net 

LAW OFFICES 

SONOSKY, CHAMBERS, SACHSE 

MILLER & MUNSON, LLP HARRY R. SACHSE JUNEAU OFFICE 

REID PEYTON CHAMBERS 900 WEST FIFTH A VENUE, SUITE 700 302 GoLD STREET, SUITE20] 

WILLIAM R. PERRY ANCHORAGE, ALASKA 99501 JUNEAU, ALASKA 9980l

LLOYD BENTON MILLER*** (907) 586-5880·FAX{907) 586-5883 (907) 258-6377 

DONALD]. SIMON FAX (907) 272-8332 DOUGLASB.L.ENDRESON 

MYRAM. MUNSON• WEBSITE: www.SONOSKY.COM 

ANNED. NOTO SAN DIEGO , CA OFFICE 

JAMES E. GLAZE"** LLOYD B. MILLER E·MAIL: lloyd(@.sonosky.net 7 50 B Street. Suite 2520 

DA YID C. MIELKE San Diego, CA 92101 

GARY F. BROWNELL (619) 546-5585·FAX(6)9) 546-5584 

C OLIN C. HAMPSON 

RlCHARD D. MONKMANu 

MARISSA K FLANNERY* June 25, 2014 

MATTHEWS. JAFFE WASHINGTON, D.C. OFFICE 

WILLIAM STEPHENS 1425 K STREET, SUITE 600, N.W. 

SAMUEL E. ENNIS" VIA E-MAIL WASHINGTON, D.C. 20005 

LIA C. CARPENEn** (202) 682-0240·FAX (202) 682-0249 PrivacyRegulations@SAMHSA.hhs.gov FRANK S. HOLLEMAN 

CHRISTOPHERJ. IRONROAD 

MATTHEW L. MURDOCK 

REBECCA A. SHERMAN"" ALBUQUERQUE, NM OFFICE 

MAILE TA VEPHOU ALERN 500 MARQUETTE AYE, N.W. 

KENDRI M. M. CESAR* StnTE 660 

PENG WU ALBUQUERQUE, NM 87102 

(505)247-0147-FAX (SOS) 843-6912 

OF COUNSEL *ALASKA BAR 

ROGER W. DUBROCK• **ALASKA AND WASHINGTON BAR 

KAYE. MAASSEN GoUWENS • *** ALASKA AND D.C. BAR 

JOAN M. WILSON* "ALASKA AND CALIFORNIA BAR 

AR THUR LAZARUS, JR. ""ALASKA AND ILLINOIS BAR 

MARVIN J. SONOSKY (1909-1997) 

Kate Tipping, Public Health Advisor 

Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

Re: Comments on the Confidentiality of Alcohol and Drug Abuse Patient 

Records Regulations, 42 CFR Part 2. FR Doc. 2014-10913. 

Dear Ms. Tipping, 

I write on behalf of the Tanana Chiefs Conference (TCC) to comment on the 

Substance Abuse and Mental Health Services Administration's (SAMHSA) Notice of 

Public Listening Session concerning the Confidentiality of Alcohol and Drug Abuse 

Patient Records Regulations, 42 C.F.R. Part 2 (the Notice).1 Thank you for the 

opportunity to respond to the Notice. 

79 Fed. Reg. 26,929 (May 12, 2014). 

Doc.# 149281 

1 
Kate Tipping, Public Health Advisor June 25, 2014 

Substance Abuse and Mental Health Services Administration Page 2 of 5 

TCC provides health care services to Alaska Natives and other eligible 

individuals pursuant to a compact and funding agreement with the United States Indian 

Health Service. We provide care to approximately 12,000 patients in the TCC region and 

operate a large clinic in Fairbanks (Chief Andrew Isaac Health Center), a crisis respite 

house for the chronically mentally ill, an alcohol/substance abuse recovery camp, a 

patient hostel, and 23 smaller village clinics. 

Chief Andrew Isaac Health Center is a primary care facility providing health care 

services on an out-patient basis to eligible beneficiaries of the Indian Health Service. 

Clinic staff includes physicians, physician assistants, family nurse practitioners, nurses, 

and pharmacists committed to comprehensive quality health care, including both acute 

and chronic services, health education, and wellness promotion. TCC provides limited 

outpatient counseling services to address child, adolescent, and family community mental 

health problems; information and referral to other outpatient and inpatient programs; and 

outpatient psychiatric services to beneficiaries in the TCC area. In addition, TCC 

provides mental health and substance abuse counseling for rural communities throughout 

the TCC region through a network of professional providers. 

TCC provides prevention activities to address substance abuse and associated 

problems through prevention/education, outreach, continuing development of local 

aftercare support services, and community capacity. TCC provides services and support 

to the Recovery Camp program for residential treatment to individuals and families for 

substance abuse treatment. TCC also provides outpatient substance abuse services to the 

Upper Tanana Region. 

I. Discussion.

TCC supports the proposed changes discussed on the June 11, 2014, listening 

session and identified in the Notice, particularly those that will make it easier for 

providers to share patient information for legitimate medical purposes within a patient's 

medical support network. At the time the Part 2 regulations were promulgated, substance 

abuse treatment was often provided within a single health practice or facility: a treating 

emergency room physician, a detox or rehabilitation center, a psychiatric or other mental 

health office, etc. But as SAMSHA correctly notes, "new models of integrated care ... 

are built on a foundation of information sharing to support coordination of patient care, 

the development of an electronic infrastructure for managing and exchanging patient 

data, the development of prescription drug monitoring rograms and a new focus on r performance measurement within the health care system." 

Like many other providers nationwide, TCC falls within these latter categories, 

having moved towards a holistic, patient-centered treatment approach that coordinates 

treatment of acute conditions with enhanced preventive and wellness services, behavioral 

health care, and overall lifestyle changes designed to promote good health. This is 

Id at 26,929. 

Doc.# 149281 

2 
Kate Tipping, Public Health Advisor June 25, 2014 

Substance Abuse and Mental Health Services Administration Page 3 of 5 

particularly important in the case of patients with substance abuse issues, whose drug or 

alcohol problems can lead to medical emergencies (drunk driving accidents or 

overdoses), treatment for long-term health problems (hepatitis or cirrhosis), and a need 

for behavioral health care ( cessation services or rehabilitation). Although TCC fully 

appreciates the necessity of protecting patient privacy and health information, the Part 2 

requirements as currently drafted make it difficult for provider types to share necessary 

medical information within these expanded networks and provider associations. TCC 

therefore supports the following proposals in the Notice that address these concerns. 

1. Relaxing Consent Requirements. 

Part 2 currently requires providers to draft patient disclosure consent forms with a 

very high level of specificity, despite the fact that the consents may well change 

depending upon the patient's specific condition. However, patients with significant 

substance abuse issues often have complex medical needs that make it difficult to 

pinpoint the specific providers or facilities they will need to visit for a given condition. 

They are also comparatively more likely to present in need of emergency (or other) 

services in conditions where they cannot provide an informed consent due to intoxication 

or unconsciousness. TCC therefore agrees with SAMHSA's proposal to authorize 

providers to proactively present patients with lists of the staff and organizations that 

might eventually need to access the patient's Part 2-covered information and to regularly 

notify TCC of changes to the list.3 This will ensure that patients remain aware of where 

their information might be sent and have an opportunity to object or ask questions 

accordingly while also giving providers the flexibility to disseminate medically-relevant 

information as necessary to best provide care in various circumstances. 

2. Clarifying Redisclosure Rules. 

As SAMHSA correctly identifies, many provider electronic health record (EHR) 

systems do not support data segmentation. Providers are often required to choose 

between keeping alcohol- and drug-abuse patient records separate from the rest of the 

patient's medical record or apply Part 2 rotections to the entirety of any patient records p containing information subject to Part 2. This is not only administratively burdensome, 

but it can lead to delays in the disclosure of relevant, non-substance abuse related medical 

information, such as medication allergies or current drug treatments. TCC therefore 

supports SAMHSA's proposed clarification that the prohibition on redisclosure only 

applies to information that would identify an individual as a substance abuser, while still 

allowing other health-related information shared by the Part 2 program to be redisclosed, 

if legally permissible. 5

3 Id. at 26,931. 

4 Id. 

s Id. 

Doc.# 149281 
Kate Tipping, Public Health Advisor June 25, 2014 

Substance Abuse and Mental Health Services Administration Page 4 of 5 

3. Expanding the Definition of a Qualified Service Organization 

SAMHSA is analyzing the regulations to identify options for allowing Part 2 data 

to flow to health care entities for the purpose of care coordination and population 

management while maintaining patient protections. One potential solution SAMHSA has

identified includes expanding the definition of a qualified service organization to 

explicitly include care coordination services and to allow a QSO Agreement to be 

executed between an entity that stores Part 2 information and a service provider. TCC 

strongly supports this proposed change. It would be extremely beneficial to TCC's 

patient population if substance abuse providers and other providers could more easily 

coordinate patient services. Many of TCC patients believe this should be occurring, and 

many times TCC must explain to its patients the barriers in the law that require consent 

even for care coordination. 

4. Medical Emergencies. 

The current Part 2 medical emergency exception at 42 C.F.R. § 2.51 states that 

covered information may be disclosed without patient consent "for the purpose of treating 

a condition which poses an immediate threat to the health of any individual and which 

requires immediate medical intervention." As SAMHSA notes, though, the actual statute 

says that records may be disclosed to medical personnel to the extent necessary to meet a 

bona fide medical emergency.6 SAMHSA therefore proposes to redraft the exception to 

make it closer to the statutory language and to give providers more discretion as to when 

a bona fide emergency exists (such as instances where the provider seeks to prevent a 

medical emergency or to share information with a detoxification center when a patient is 

unable to provide informed consent due to their level of intoxication). SAMHSA 

additionally seeks comment concerning the definition of "medical emergency."7 

TCC strongly supports additional flexibility in this area. The current regulatory 

standards focus entirely on imminent medical status, essentially limiting information 

disclosure to immediate emergencies such as a patient in cardiac arrest. But as SAMHSA 

identifies in the Notice, there are other instances where such disclosure may be necessary 

to proactively prevent emergencies or, as is often the case with substance abusers, the 

patient cannot provide coherent consent. TCC would go so far as to support a general 

treatment exception similar to the HIP AA treatment exception. However, short of that 

we suggest that SAMHSA promulgate emergency disclosure language along the lines of 

the following: 

Medical Emergency. A provider may disclose information covered by 

Part 2 when, in the opinion of the attending or treating provider, disclosure 

7 Id. 

Doc.# 149281 
Kate Tipping, Public Health Advisor June 25, 2014 

Substance Abuse and Mental Health Services Administration Page 5 of 5 

is medically necessary to prevent a potential bona fide medical emergency 

or treat an existing medical emergency. In such situations, patient consent 

shall not be necessary if the provider determines that obtaining consent 

would endanger the health of the patient or that the patient is intoxicated 

or otherwise incapable of providing informed consent. For the purposes of 

this provision, a "medical emergency" is defined as an event that would 

require emergency room treatment or which could otherwise result in 

death, disability, or other permanent injury to the patient. 

We believe that this will maintain patient privacy while offering providers the flexibility 

to share necessary information with one another in emergency circumstances. 

II. Conclusion.

The Part 2 regulations are essential to ameliorate the stigma associated with 

substance abuse and ensure that the fear of prosecution does not deter people from 

entering treatment. We therefore commend SAMHSA's recognition of the fact that 

innovations in health care delivery require a reevaluation of certain aspects of Part 2 that 

might be outdated or which, in practice, do not address these goals. Adopting the 

suggestions discussed above will help adapt the Part 2 regulations to meet new modes of 

patient care. 

We appreciate the opportunity to comment on the Notice and looks forward to a 

continued open dialogue with SAMHSA on issues related to Part 2. 

Sincerely, 

SONOSKY, CHAMBERS, SACHSE, 

MILLER & MUNSON, LLP 

By: Marissa K. Flannery
Æ

Doc.# 149281 
 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Pamela Hyde 

Administrator 

U.S. Department of Health and Human Services 

Substance Abuse and Mental Health Services Administration 

42 CFR Part 2 

Docket Number 2014-10913 

Dear Ms. Pamela Hyde, 

I am submitting comments on behalf of the members of Medicaid Health Plans of America (MHPA). 

MHPA is the leading national trade association solely representing Medicaid managed care plans, 

ranging from multi-state, for-profit plans to small, non-profit plans. MHP!’s 117 health plan members 

serve the nation’s poorest, most vulnerable population across 33 states and D.C. MHPA plans proudly 

manage the care of over 18 million Medicaid enrollees, through the use of innovative programs that 

keep individuals and families healthy, manage chronic diseases, and avoid expensive hospitals stays. 

We appreciate the opportunity to respond to the Substance Abuse and Mental Health Services 

Administration (SAMHSA) request for public comment through the Federal Register notice on whether 

the Agency should make changes to the current rules at 42 CFR Part 2 regarding Confidentiality of 

Alcohol and Drug Abuse Patient Records. Section 42 CFR Part 2 currently applies to federally-funded 

programs or entities that “hold themselves out as providing, and provide, alcohol or drug abuse 

diagnosis, treatment or treatment referral.” S!MHS! is considering options for defining what 

information is covered under this rule. These regulations were last updated in 1987, and SAMHSA 

acknowledges that the rules do not account for significant changes in the U.S. health care system. MHPA 

recommends 42 CFR Part 2 be defined in a way that mirrors HIP!!’s existing regulations and laws as it 

relates to substance abuse treatment to establish consistency and help reduce any barriers or confusion 

when plans and providers are trying to effectively coordinate care. Some points that should be 

considered: 

 The current 42 CFR Part 2 rules do allow communication between providers but they mandate

that written consent must include the name of the individual or the organization to whom

information can be disclosed, along with a lot of additional information, making it challenging to

obtain this consent and creating barriers to member centric, integrated approaches to care,

which are part of our current health care framework.

 The 42 CFR Part 2 increases administrative burdens on the substance abuse treatment providers

since the privacy requirements are not consistent with other existing health information privacy

rules and there are anti-discriminatory rules that address this issue.

 The population that falls under the current regulations often has comorbidities of medical

diagnoses with mental health and substance abuse and would benefit the most from
 

 

 

 

 

 

 

 

coordination of care that is available to all other populations. However, the current consent 

requirements in 42 CFR Part 2 make these goals very challenging and at times impossible. 

o	 For example, when members need emergency substance abuse treatment, it can be 

difficult to obtain consent, but these same members could be medically harmed if the 

provider caring for an acute emergency does not have access to the information that 

the patient has received treatment for substance abuse. 

o	 Members with severe and persistent mental illness are known to die 25 years younger 

than their peers without SPMI, and 42 CFR Part 2 rules make it likely that someone who 

is hospitalized for behavioral illness could be treated without the provider’s knowledge 

of the member’s physical health problems or medications. 

Given these considerations, MHPA provides the following recommendations on how 42 CFR Part can be 

aligned with HIPAA. 

Recommendations: 

	 HIPAA allows disclosures among providers for the treatment of a patient, and 42 CFR Part 2 

should be updated to align with HIPAA and allow similar disclosures for the treatment of 

substance abuse. 

	 42 CFR Part 2 should also be revised to include a consent exception for payment as HIPAA does. 

Under current rules, payment may be delayed or denied because the provider or the insurer 

cannot get the necessary signed consent from the member. Health plans have strict policies 

regarding HIPAA compliance and security of protected health information (PHI). The information 

needed to process a claim, whether medical or behavioral is available only to those in the plan 

with a need to know and only to ensure proper adjudication and payment of claims. Members 

could lose access to providers if the plans cannot pay the providers correctly and in a timely 

manner. 

	 42 CFR Part 2 should be changed to mirror the HIPAA provisions that allow disclosures for 

healthcare operations under limited circumstances. This would particularly allow for better 

coordination of care between separate entities, such as when a state awards a physical health 

MCO contract to one entity and a behavioral health MCO contract to another. This also allows 

sharing of information related to quality of care, population health, and at times evidence of 

fraud and abuse. 

	 The emergency exception that currently states that that information may be disclosed without 

consent, “for the purpose of treating a condition which poses an immediate threat to the health 

of any individual and which requires immediate medical intervention” should be broadened. 

Emergencies could be prevented, for example, if a hospital provider treating a patient with a 

severe injury had access to information that the patient also had been receiving substance 

abuse treatment. 

If it is not possible to have 42 CFR Part 2 regulations mirror existing HIPAA regulations, MHPA 

recommends that in its current form, the rules should allow only program and substance abuse 

treatment providers who are licensed, credentialed and accredited for a substance abuse specialty to be 

recognized as a covered entity. Individuals who are licensed, credentialed and accredited in providing 

these specialty services would not qualify a larger organization within which they participate as this 

would be discouraging for the integration of services at healthcare organizations providing 

comprehensive services. Additionally, MHPA would encourage the regulation to maintain its current 
standard that allows treatment providers who are known to the public as substance abuse specialty 

treatment providers to determine whether or not they are considered a covered entity. 

Again, we thank you for the opportunity to provide comments and hope that the Agency will consider 

the issues expressed in this letter given the challenges that plans and providers are currently facing 

within the arena of treating mental health and substance abuse disorders. 

Sincerely, 

Jeff Myers 

President and CEO 
 

Greetings, 

Privacy issues are important to all Americans, but none more so than for methadone 

patients because of the stigma involved. 

Many people who would otherwise get the help they so desperately need, will not 

receive it if they know their primary care physician will know about their methadone 

treatment. 

Common sense tell us that drug treatment is a very private matter, and if it does not 

remain a private matter, some people will not seek the treatment that might save their 

life, 

This is also a matter of our constitutional rights as citizens, please don't take away, or 

allow others to take our rights away. 
Tuesday 6/24/14

Dear Sirs & Madams, 

I am writing this in Reference to the proposal to connect methadone maintenance 

programs to the Health Information Technology or (HIT) System. The first thing I would like 

to say is, Don’t --- Please, Please don’t do this, --- Let me tell you why not! --------- There 

are simply too many people who do not understand the true reasons for addiction. These 

people also do not understand the need for confidentiality during treatment. I’ve met many, 

many people who think that drug addiction & alcoholism is a moral issue. Morals have 

nothing whatsoever to do with addiction. But many people don’t understand this! They think 

addicts are a bunch of low lifes who have no morals and who can not or will not live by the 

rules & expectations of society as a whole. 

I personally have never met a 10 year old child who said their highest ambition in life 

was to be a drug addict. Nobody wants to be a drug addict or an alcoholic! 

So that begs the questions, why are there so many of them? There are many reasons for 

this, none of which have anything to do with anybody’s morality. 

I do not want every Tom, Dick or Harry to know I’m a drug addict. My own personal 

physician doesn’t know! Most people who find out try to talk you into getting off the 

methadone. Most addicts that do this, go right back to their drug of choice. I do not want to 

do this. I’m doing fine on the methadone. 

Please leave it confidential! 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

uestions:

How would redefining the applicability of 42 CFR Part 2 impact patients, health care provider organizations, HIEs,

CCOs, HIT vendors, etc.?

Would this change address stakeholder concerns?

Would this change raise any new concerns?

 

 

 

 

 

 

 

The Substance Abuse and Mental Health Services Administration
 

Public Listening Session Comment Template
 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2 

This document is meant to provide the public with a simple and organized way to submit comments on the 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2, and respond to 

questions presented in meeting notice which is published in the Federal Register at 79 FR 26929. While use of 

this document is entirely voluntary, commenters may find it helpful to organize their comments. 

This document alone is not intended to provide a full and complete opportunity to comment on all of the 

provisions within the regulation. Please keep in mind that it only reflects those topics included in the meeting 

notice and a section for “other” comments. 

To be considered, all comments (including comments provided through this document) must be submitted 

according to the instructions in the meeting 

notice: https://www.federalregister.gov/articles/2014/05/12/2014-10913/confidentiality-of-alcohol-anddrug-abuse- patient-records. 

Applicability of 42 CFR Part 2 

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. Covered information could 

be defined based on what substance abuse treatment services are provided instead of being defined by the type of 

facility providing the services. 

FR Citation: 79 FR 26930 

Q 

•

•

•

Public Comment Field: 

• It will reduce the confusion about what information requires consent to be shared. 

• The protected information will be easier to identify. 

• It will however prevent over reach (removing anything vaguely associated with SA) and increase entities sense that they are 

compliant with the law. 

• It will however still require the SA date be treated differently for other diagnosis. 

• Until SA data is treated in accordance with HIPAA, I anticipate that entities will continue to remove the all SA data as 

consents are too costly and time consuming to manage in a population health environment that is utilizing big data sets. 

Page 1 of 6
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

hich reveals that the data were collected by a practice that exclusively treats addiction, the data would still be 

rotected under the proposed change.

Citation: 79 FR 26931

uestions:

 

 

Consent Requirements 

While technical solutions for managing consent collection are possible, SAMHSA is examining the consent requirements 

in § 2.31 to explore options for facilitating the flow of information within the health care context while ensuring the 

patient is fully informed and the necessary protections are in place. Specifically, we are analyzing the current 

requirements and considering the impact of adapting them to: 

1. Allow the consent to include a more general description of the individual, organization, or health care entity to which 

disclosure is to be made. 

2. Require the patient be provided with a list of providers or organizations that may access their information, and be 

notified regularly of changes to the list. 

3. Require the consent to name the individual or health care entity permitted to make the disclosure. 

4. Require that if the health care entity permitted to make the disclosure is made up of multiple independent units or 

organizations that the unit, organization, or provider releasing substance abuse related information be specifically 

named. 

5. Require that the consent form explicitly describe the substance abuse treatment information that may be disclosed. 

FR Citation: 79 FR 26931 

Questions: 

• Would these changes maintain the privacy protections for patients? 

• Would these changes address the concerns of HIEs, health homes, ACOs, and CCOs? 

• Would these changes raise any new concerns? 

Public Comment Field: 

• Separate and costly modifications will not happen to systems for a single medical condition to be managed through any 

consent. 

• SA needs to be exchanged in accordance with HIPPA 

• Laws need to be passed, enforced, strengthened so that all patients have privacy protections. Patients with cancer, HIV, 

anxiety.... do not want to be discriminated against for employment, insurance..... 

Redisclosure 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on redisclosure only applies to 

information that would identify an individual as a substance abuser, and allows other health-related information shared 

by the Part 2 program to be redisclosed, if legally permissible. This would allow HIT systems to more easily identify 

information that is subject to the prohibition on redisclosure enabling them to utilize other technological approaches to 

manage redisclosure. If data are associated with information about where the data were collected (data provenance) 

w 

p 

FR 

Q 

• Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 in an EHR or HIE 

environment? 

• Would these changes maintain the privacy protections for patients? 

Page 2 of 6
 

 

Public Comment Field: 

• Yet another layer of complexity requiring additional financial and workforce investments 

• It will not address that the data was isolated and never sent to the HIE. 

• It could reinforce that that any data pertaining to the identified SA data be isolated at the source 

Page 3 of 6
 

 

uestions:

What factors should providers take into consideration in determining whether a medical emergency exists?

Are there specific use cases SAMHSA should take into consideration? Show citation box

Are there patient concerns about the impact of this change on their privacy?

 

 

 

ervices and to allow a QSO Agreement (QSOA) to be executed between an entity that stores Part 2 information, such as

payer or an ACO that is not itself a Part 2 program, and a service provider.

Citation: 79 FR 26931

 

 

 

 

Medical Emergency 

SAMHSA is considering adapting the medical emergency exception to make it more in-line with the statutory language 

and to give providers more discretion as to when a bona fide emergency exists. For example, amending this standard to 

allow providers to use the medical emergency provision to prevent emergencies or to share information with a 

detoxification center when a patient is unable to provide informed consent due to their level of intoxication. 

FR Citation: 79 FR 26931 

Q 

•

•

•

Public Comment Field: 

• If the Health Care Administrative entity isolates the identified SA information before sending to a vender (say for a provider 

portal) or the HIE 

• The information is not available in the case of an emergency therefore: 

• Patient concern should be that I am unconscious from a car accident and because my diagnosis is SA my provider will be 

potentially providing me with a lower standard of care which in some case could be life threatening. 

• If information is truly used to provide high quality care it has been my experience that few patients object 

Qualified Service Organization (QSO) 

SAMHSA is analyzing the regulations to identify options for allowing Part 2 data to flow to health care entities for the 

purpose of care coordination and population management while maintaining patient protections. One potential solution 

includes expanding the definition of a qualified service organization (QSO; § 2.11) to explicitly include care coordination 

s 

a 

FR 

Questions: 

• Are there other use cases we should be taking into consideration? 

• Are there specific patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

• Treatment 

• Care coordination agencies may use software products for risk stratification, care alerts and other tools to identify high 

risk individuals that would benefit from an intervention. 

• Data warehouses (such as APCD) may be used for care coordination, quality improvement, provider benchmarks on 

quality, geo mapping for “hot spots” provider portals for improved treatment..... 

Research 

SAMHSA is considering expanding the authority for releasing data to qualified researchers/research organizations to 

health care entities that receive and store Part 2 data, including third-party payers, health management organizations, 

HIEs, and care coordination organizations. 

FR Citation: 79 FR 26932 

Page 4 of 6
 

 

 

 

 

 

 

 

 

Questions: 

• Are there factors that should be considered related to how current health care entities are organized, how they 

function or how legal duties and responsibilities attach to entities that make up an umbrella organization? 

• Would this change address concerns related to research? 

• Are there specific privacy concerns associated with expanding the authority or releasing data to qualified 

researchers/research organizations in this way? 

• Are there additional use cases that should be considered in the research context? 

Public Comment Field: 

• Any efforts to align 42CFR with HIPAA is to be applauded 

• Patients with SA desire the same level of treatment, care coordination, quality bench marking and research. 

• The current environment is highly discriminatory to patient’s with SA 

Page 5 of 6
art 2 protections include a prohibition on the redisclosure of information received directly from a Part 2 program. A

harmacy that receives electronic prescription information directly from a Part 2 program must obtain patient consent

send that information to a PDMP, and patient consent is also required for the PDMP to redisclose that information to

hose with access to the PDMP.

uestions:

How do pharmacy information system vendors anticipate addressing this issue? Are there specific technology

barriers SAMHSA should take into consideration?

Are there other concerns regarding 42 CFR Part 2 and PDMPs? Please describe relevant use cases and provide

recommendations on how to address the concerns.

Are there patient concerns about the impact of e-prescribing and PDMPs on their privacy?

Addressing Potential Issues With Electronic Prescribing and Prescription Drug Monitoring Programs (PDMPs) 

P 

p 

to 

t 

Preamble FR Citation: 79 FR 26932 

Q 

•

•

•

Public Comment Field: 

Other Comments 

Topic: 

Public Comment Field: 

Page 6 of 6
Dear SAMHSA, 

It has recently come to my attention that possible changes could be made to 

confidentiality regulations 42 CFR Part 2. This is very concerning to me as a MMT patient. 

Confidentiality is crucial for MMT patients nationwide, being that many stigmas surround 

methadone in and out of the medical field. 

I myself have first hand experience as to how unacceptable methadone is to society. In a 

phone call regarding my treatment facility an investigator for the OSBI Prescription 

Enforcement Division told me that “drug addicts go there to take drugs.” 

There is very much work to be done in making MMI socially acceptable before any 

changes should be made to current confidentiality regulations. I’m pretty much begging to 

keep my rights in a hope you can understand how detrimental it would be to all MMT 

patients if any changes are made to 42 CFR pt. 2. 

- Concerned Citizen -
Dear SAMHSA, 

I am a methadone patient and I understand that you are thinking about changing the 

confidentiality regulations for the treatment of methadone. This greatly concerns me with 

what could potentially happen if my status as a methadone patient were known. Medically as 

well as professionally this could have major effects on a lot. Trying to get a job, getting 

medical care, etc would become more difficult because of people not understanding 

methadone and deeming every user an “addict”. Please don’t change the regulations and 

continue to let the Human Beings that need methadone lead a normal life as possible. 

Sincerely, 

Concerned Patient
Jerry Brown 

Governor State Of California

OFFICE OF HEAL TH 

INFORMATION INTEGRITY 

(CalOHII) 

June 25, 2014 

Substance Abuse and Mental Health Services Administration 


1 Choke Cherry Road 


Rockville, MD 20857 


Room 5-1011 


Dear Sir or Madam: 

The California Health and Human Services (CHHS) Agency is pleased to have the 


opportunity to provide public comments to the Substance Abuse and Mental Health 


Services Administration (SAMHSA) on its public listening session notice published in 


the Federal Register on May 12, 2014. 


The California Office of Health Information Integrity has the statutory authority and 

responsibility to provide leadership, policy formulation, coordination, and direction for the 

implementation and ongoing oversight of the Health Insurance Portability and Accountability 

Act (HIPAA) compliance for state departments in California, as well as previously 

overseeing the State Health Information Exchange (HIE) Cooperative Agreement Grant 

under the American Recovery and Reinvestment Act (ARRA). Comments have been 

collected from state and county departments that are impacted by this public listening 

session. 

The County Issues Work Group (CIWG) and California Privacy and Security Compliance 

Officers (CaPSCO) represent California counties. CHHS, CIWG, and CaPSCO applaud 

SAMHSA's efforts to make thoughtful and incremental changes to the Confidentiality of 

Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2. The following 

comments are presented to SAMHSA: 

• 	 The changes will facilitate needed communication and coordination in patient/client 

care; 

• 	 Consent would provide standardization between entities in the exchange of 

information in the care of the patient/client; 

• 	 It will reduce the administrative and technical encumbrances when exchanging 

information that is currently redacted but is medically necessary; 

• 	 Recommend continued protection of identity for research, as one would have with 

any research involving human subjects; 

• 	 The Qualified Service Organization (QSO) will facilitate in needed exchange of 

patient/client relevant information to treat the client/patient as a whole; 

• 	 With regards to the Medical Emergency release, who makes the determination of a 

"Medical Emergency" and under what circumstances? 

1600 Ninth Street . Room 460 · Sacramento, CA 95814 · Telephone (916) 651 -2059 · Fax (916) 653-9588 

Internet Address: www.ohi.ca.gov 
Substance Abuse and mental Health Services Administration Page 2 

June 25, 2014 

We again thank you for allowing us to comment on these important issues. We are 

available to discuss any questions you or your staff have about our comments. We look 

forward to working with you on these important matters. 

Sincerely, 

Pamela Lane, MS, RHIA, CPHIMS 

Deputy Secretary, HIE 

CA Health and Human Services 

1600 Ninth Street · Room 460 · Sacramento, CA 95814 · Telephone (916) 651-3367 · Fax (916) 653-9588 

Internet Address: www.ohii.ca.gov 
 

 

-----Original Message-----

From: Richardson, Maria [mailto:maria.richardson@topaztx.org]
 

Sent: Wednesday, June 25, 2014 5:55 PM
 

To: Privacy Regulations (SAMHSA)
 

Subject: Public Comment: Submit Your Comments on Patient Confidentiality
 

The privacy provisions in 42 CFR Part 2 enacted over three decades ago -an era of little awareness or 

acceptance and motivated by thoughts that stigma and fear might dissuade persons with substance use
 

disorders from seeking treatment. Three decades later, society has matured, realizing that these 

individuals deal with a wretched disease that knows no boundaries. If we are to treat the wellbeing of 

these individuals in a holistic manner, then the privacy provisions should be updated and brought in line
 

with current healthcare initiatives; as well as making provisions to protect entities that sever this
 

population for the betterment of their overall health. As we continue to grow and improve healthcare,
 

technology (HIE) is key to saving lives in the treatment of this disease. Healthcare professions will need
 

to have the ability to share information across all necessary providers. The barriers of three decades
 

ago should not be the barriers that prevent the saving of life today. Provisions for sharing information
 

through HIEs should be made to be inclusive of programs or entities whose services target these 

populations.
 

Regards,
 

Maria Richardson
 

Director of TOPAZ Software Authority
 

713-970-7196 office
 

832-367-0471 cell
 

Important Notice:
 

The information in this email is confidential and may be legally privileged. If you are not named as the
 

intended recipient of this message, you are hereby notified that any disclosure, copy, distribution or
 

taking any action in reliance on this information contained herein is prohibited and may be unlawful.
 

You are requested to contact the sender urgently and dispose of this email. Attached.
 
 

 

 

 

 

 

 

 

 

 

Kaiser Foundation Health Plan 

Program Offices 

June 25, 2014 

The Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

Submitted via email to: PrivacyRegulations@SAMHSA.hhs.gov 

RE: Confidentiality of Alcohol and Drug Abuse Patient Records; 42 CFR Part 2 [Docket 2014­

10913] 

Dear Sir or Madam: 

Kaiser Permanente offers the following comments to the Substance Abuse and Mental health 

Services Agency (“SAMHSA”) on proposed updates to existing regulations in 42 CFR Part 2 

regarding Confidentiality of Alcohol and Drug Abuse Patient Records, published in the Federal 

Register on May 12, 2014.1 

The Kaiser Permanente Medical Care Program is the largest private integrated healthcare 

delivery system in the U.S., delivering health care to over 9 million members in eight states and 

the District of Columbia.2 Kaiser Permanente is committed to providing the highest quality 

health care; as part of this commitment, we have made a significant investment in developing our 

secure Electronic Health Record (“EHR”) system, KP HealthConnect®, to support the delivery of 

healthcare services to our members and to enhance communications among the medical 

professionals who serve them, consistent with the highest standards of medical privacy. 

Kaiser Permanente is actively engaged in numerous public health initiatives and also conducts 

and supports a broad agenda of health research through its various research entities.3 In our 

1 79 Fed.Reg. 26929 

2 Kaiser Permanente comprises Kaiser Foundation Health Plan, Inc., the nation’s largest not-for-profit health plan, 

and its health plan subsidiaries outside California and Hawaii; the not-for-profit Kaiser Foundation Hospitals, which 

operates 37 hospitals and over 600 other clinical facilities; and the Permanente Medical Groups, independent 

physician group practices that contract with Kaiser Foundation Health Plan to meet the health needs of Kaiser 

Permanente’s members. 

3 Research has long been a hallmark of Kaiser Permanente, which conducts research in all of its eight regions, both 

within research centers as well as in medical centers and other health care delivery venues. In addition to health 

services research, Kaiser Permanente also conducts many studies involving FDA-regulated drugs, devices, and 

biologics. 

One Kaiser Plaza, 27th Floor 

Oakland, CA 94612 
 

 

 

 

 

 

 

Kaiser Permanente Comments 

42 CFR Part 2 

research and public health efforts as well as in our delivery of health care, we provide protections 

to safeguard member/patient health information against unauthorized use and disclosure. 

General Comments 

Kaiser Permanente supports efforts by SAMHSA to ensure that its regulatory approach will help 

to foster coordinated care and improve patient safety, while also addressing patient privacy 

concerns. Within our integrated model of care delivery, we have developed robust and secure 

tools, including a comprehensive EHR system that enables communication among treating 

providers, including primary care and specialty providers. As stewards of our patients’ 

information, we support regulatory changes designed to ensure confidentiality, reduce confusion 

and promote consumers’ trust in the privacy and security of their health information, including 

substance abuse information. 

We offer the following feedback on specific proposed changes to 42 CFR Part 2 regulations 

(“Part 2”). 

The Federal Legal Framework for Protecting Identifiable Health Information 

Part 2 predates by more than two decades the comprehensive federal legal framework for 

protecting health information afforded by the Health Insurance Portability and Accountability 

Act (HIPAA) of 1996. The HIPAA Privacy Rule (2000), modified in 2002, was followed by the 

HIPAA Security Rule in 2003, which defined an extensive set of technical, physical and 

administrative safeguards designed to ensure that covered entities and their business associates 

keep protected health information (“PHI”) secure. 

HIPAA has evolved to keep pace with technological innovations, such as the adoption of EHRs 

and greater use of health information exchange (“HIE”) to allow access to patient information at 

the point of care. In 2009, the HITECH Act expanded HIPAA to cover many non-healthcare 

providers, like health information organizations (“HIO”), and the Breach Notification Rule 

imposed specific requirements on the content and timing of reporting suspected data breaches 

under HIPAA. Most recently, the HIPAA Omnibus Rule (2013) further strengthened HIPAA 

protections. 

The confidentiality of individuals treated for substance abuse issues are adequately protected by 

HIPAA and the Privacy Rule, as amended by HITECH and the HIPAA Omnibus Rule. Part 2 

has long created unnecessary confusion about how information regarding patients with substance 

abuse disorders can be shared, which has had the effect of suppressing communications among 

treating health care providers and preventing other communications that are vital to facilitate 

treatment, such as enabling coverage and payment for treatment. Most of Part 2’s current 

requirements act as administrative burdens that do not meaningfully afford patients greater rights 

than HIPAA for protecting the privacy of substance abuse information, but deprive substance 

abuse patients of the benefits of electronic HIE and other care coordination mechanisms. 

Part 2 also precludes providers in many cases from sharing medically critical information (such 

as lab test results or diagnosis that would alert a provider not to prescribe a particular drug or 

2 
 

 

 

 

 

 

 

 

 

 

 

Kaiser Permanente Comments 

42 CFR Part 2 

treatment to a patient), even where doing so is necessary to act in the best interests of their 

patients in combating their addiction or preserving their safety. We believe that the Part 2 

regulations could be repealed in order to address these barriers to care without diminishing 

substance abuse patients’ privacy rights. 

If Part 2 is kept, then its restrictions should be modified substantially to bring Part 2 into 

conformance with HIPAA’s minimum necessary standard. This would allow health care 

providers, HIEs, and other organizations to use and disclose substance abuse records using 

electronic exchange technology under appropriate privacy safeguards and consistent with other 

medical care. 

Specifically, SAMHSA should give careful consideration to harmonizing Part 2 with HIPAA by 

instituting exceptions similar to HIPAA’s treatment, payment, and health care operations 

(“TPO”) exceptions. This could involve expanding Sec. 2.12(c) on Exceptions to Applicability. 

Such alignment would lead to much greater clarity in privacy and security policies and practices 

as well as meet expectations of patients regarding the use and disclosure of PHI, including PHI 

associated with substance abuse treatment; under HIPAA patients can request restrictions to uses 

and disclosures of specified PHI. 

Recommendation 

We recommend aligning Part 2 with HIPAA, specifically by adopting exceptions for TPO 

disclosures. 

Applicability 

Services versus Programs as the Basis for Applying Part 2 

To address the difficulty in determining which types of providers and organizations are 

considered “programs,” under current Part 2 definitions, SAMHSA is considering revising Part 2 

to cover certain types of specialty substance abuse treatment services. 

While the current definition of a “program” is somewhat ambiguous, it would be disruptive to 

redefine the applicability of rules based on service type as opposed to provider type. Many 

organizations, including Kaiser Permanente, identify these programs based upon provider 

department (e.g., Behavioral Health/Addiction Medicine) and design data protections 

accordingly. The “firewalled” portion of a patient medical record, as well as authentication and 

access rules for individual providers, in many EHRs were designed and implemented to reflect a 

department-based definition of a “program.” 

A service-based classification may actually make it more difficult to distinguish Part 2 regulated 

information from other information. Each record of a service would need to be characterized as a 

service regulated under Part 2 or not. The ability to distinguish Part-2 covered information would 

depend on the health care industry developing, adopting and implementing a data classification 

system that would be comprehensive, reliable and maintainable – presenting administrative, 

technical and operational challenges, especially within existing EHR systems. 

3 
 

 

 

 

 

 

 

 

Kaiser Permanente Comments 

42 CFR Part 2 

Given the difficulty of implementing and maintaining a service classification taxonomy that is 

consistent across the industry, it is highly likely that such a change to the scope of Part 2 would 

have the unintended consequence of extending its application, introducing new barriers to access 

by and data sharing among treating providers. 

Recommendation 

Kaiser Permanente recommends that SAMHSA retain the program-based definition rather than 

move to a service-based definition to determine whether Part 2 applies. 

Definition Revisions to Clarify Applicability 

SAMHSA acknowledges the potential to apply these rules too broadly and therefore proposes to 

exempt some primary care services – and thus primary care providers – from Part 2 provisions. 

However, SAMHSA’s proposed exemption for screening, early intervention or other pretreatment services could be addressed more simply and clearly by revising definitions of 

“patient,” “patient-identifying information,” “record;” or Sec. 2.12 on Applicability; or by 

revising SAHMSA FAQs to clarify that records of pre-diagnosis services (e.g., screenings, 

counseling on the harms of substance abuse etc.) are not subject to Part 2 restrictions because 

such records do not definitively identify a patient as a substance abuser. 

SAMHSA could also consider redefining “program” to mean an entity (including health care 

professionals and staff identified by that entity as being part of the program) that provides inpatient or residential treatment services for drug or alcohol abuse to patients with a primary 

diagnosis of a substance abuse disorder. 

Another rule change that could improve clarity and increase regulatory certainty about the 

application of Part 2 would be a “de-identification” safe harbor that describes which data could 

be removed so a record no longer identifies an individual as a substance abuser. 

Recommendation 

We recommend more revising key definitions of Part 2 to clarify the rules’ applicability as 

opposed to an approach that broadens the scope of the rules. This approach will establish a 

consistent framework for providers and patients. We also recommend creating a deidentification standard, similar to HIPAA’s, that would act as a safe harbor in determining 

whether any data set/record contains information covered by Part 2. 

Consent Requirements 

SAMHSA seeks feedback on how to make the consent process more manageable. We advocate 

for a reasonable approach – consistent with our earlier recommendation for HIPAA alignment – 

that would help eliminate unnecessary barriers to appropriate data access and use. SAMHSA 

should permit Part 2-regulated entities/providers to seek a patient’s general authorization to 

disclose information for TPO (as defined by HIPAA) to recipients who need the information to 

perform these functions. 

4 
 

 

 

 

 

 

 

 

 

 

Kaiser Permanente Comments 

42 CFR Part 2 

Absent such a general authorization, at a minimum, Part 2 authorizations should specify only 

roles or functions of recipients, i.e., identifying authorized recipients generically, rather than 

identifying individual recipients by name. This approach would still honor patients’ intent to 

control the types of persons able to receive their information and the purposes of disclosures, but 

would reduce the need to obtain multiple consents from patients or to delay care in order to get a 

new consent. Such a change would eliminate one administrative impediment to inclusion of 

substance abuse information in HIEs – the impossibility of identifying in advance every 

individual or entity that will need the patient’s information for a designated purpose. 

We advise against SAMHSA’s suggestion to require programs to periodically notify patients of 

the actual identities of authorized recipients, simply because such after-the-fact accounting 

imposes a substantial burden without increasing patient privacy protections. This proposal to 

name entities and individuals is more restrictive than current rules and runs counter to 

SAMHSA’s intent to broaden access and foster integrated care. 

SAMHSA has also suggested that consent forms identify the discloser by specific unit or 

organization if the disclosing entity comprises multiple units/organizations and to explicitly 

describe information to be disclosed. These changes are inadvisable because increasing the 

complexity of consent documentation is likely to create substantial confusion among disclosing 

entities about how to interpret and comply, without enhancing patient privacy. More complicated 

forms also have greater potential to confuse patients. 

We also urge SAMHSA to consider revisions designed to allow Part 2 records to be exchanged 

using HIEs and other electronic networks. Because of the current onerous Part 2 restriction, the 

technology constraints on segregating records, and the inability to automate verification of the 

adequacy of consents, HIEs usually exclude records from Part 2 providers. Many health care 

providers also treat all substance abuse records as covered by Part 2 because of confusion about 

applicability, as well as the complexities of consent management. This substantially limits 

legitimate access to information about substance abuse treatment, to the detriment of patients, 

providers, and the healthcare system as a whole. 

Recommendation 

Kaiser Permanente recommends that SAMHSA adopt a general authorization that allows Part 2 

programs to disclose PHI for TPO, as permitted under HIPAA. We strongly discourage consent 

that requires more specific information, such as names of individual recipients, names and 

departments of disclosers, etc. In addition, we recommend that consent forms be considered 

sufficient if they identify recipients by function or role rather than by name. 

Redisclosure 

SAMHSA proposes to clarify that the redisclosure prohibition only applies to information that 

would identify an individual as a substance abuser. Such clarification is unnecessary; it does not 

afford greater flexibility or facilitate technical solutions for sharing among HIE users. 

The redisclosure prohibition and notice labeling requirements, combined with Part 2’s 

requirement for recipient-specific consents, are barriers to inclusion of substance abuse records 

5 
 

 

 

 

 

 

 

Kaiser Permanente Comments 

42 CFR Part 2 

in HIEs. Although technology solutions for data segmentation are being developed, they are 

currently experimental, costly and not yet fully operational. There are also inherent limitations to 

technologies’ ability to parse, select and segregate information within a patient record by content 

type. While structured data can be identified and isolated, free-text data, like provider notes, that 

identifies a patient as a substance abuser (either alone or in combination with other data fields in 

the record) may be difficult to find and redact from key clinical documents. 

Given these challenges, we believe the best way to facilitate integrated medical records and 

foster communication among HIE users and other persons who need substance abuse information 

for TPO purposes would be to limit application of the blanket redisclosure prohibition, to allow 

Part 2-covered information to be combined (and subsequently shared) with other individually 

identifiable health information for uses consistent with the purposes of Part 2. 

The redisclosure prohibition could be revised in one of two ways. First the redisclosure 

provision could apply only to disclosures to persons who do not fall into specified categories, 

such as persons who are not already required to comply with HIPAA. Such a change would 

permit redisclosure to covered entities, their business associates, and public health authorities or 

other types of recipients that have a legal obligation to use PHI for narrowly defined purposes 

and otherwise safeguard confidentiality by following strict privacy and security standards. Or, 

SAMHSA could prohibit specific uses, meaning that the obligation of the recipient (and the 

corresponding restriction notice to be appended) would be to not use the disclosed information 

for specified uses, such as for civil litigation or criminal investigation or prosecution. 

Recommendation 

Kaiser Permanente recommends revising the blanket redisclosure prohibition to apply narrowly 

only to recipients not already covered by HIPAA obligations, which would ensure that 

redisclosures for TPO purposes would not be hindered. We would also support replacing the 

rediclosure prohibition with a use prohibition applicable to recipients, so as to permit disclosure 

but forbid specified improper uses of the disclosed information. 

Medical Emergency 

SAMHSA proposes to align the medical emergency exception with the statutory definition – “to 

medical personnel to the extent necessary to meet a bona fide medical emergency” – and to give 

providers discretion to decide when a bona fide emergency exists, including amending Part 2 to 

allow providers to use this provision to disclose information to prevent emergencies or where a 

patient is unable to consent because of intoxication. 

Recommendation 

Kaiser Permanente supports the proposed regulatory revisions, and recommends that emergency 

prevention disclosures include information about medications to prevent overdose or possible 

harm from contraindicated drugs. We also recommend removing post-disclosure documentation 

requirements for disclosures in emergencies, which are not statutorily required and serve little 

purpose. 

6 
 

 

 

 

 

 

 

 

Kaiser Permanente Comments 

42 CFR Part 2 

QSOs 

SAMHSA is considering how to expand the definition of a Qualified Service Organization 

(“QSO”) to explicitly include care coordination services and to allow a QSO between an entity 

that stores Part 2 information (e.g., a payer or ACO) and a service provider. 

It is important that the QSO concept cover disclosures to entities that perform care coordination, 

population management and quality assessment/improvement activities. We believe such 

disclosures are already permitted under the current QSO provisions, when these entities are 

performing such activities as services for the program. Thus, revising the regulatory text is 

unnecessary to achieve this objective. 

However, we strongly recommend expanding the QSO concept to be more consistent with the 

business associate concept under HIPAA. One way would be to revise the definition of a QSO to 

allow disclosures under the QSO concept to entities that perform care coordination, population 

management or QA/QI activities for the program (which may not necessarily qualify as services 

to the program). Additionally, we suggest that, if SAMHSA declines to create a TPO exception 

consistent with HIPAA (as recommended above), the agency explicitly allow a payer to qualify 

as a QSO and a QSOA to cover disclosures to third party “payers.” Such disclosures are 

necessary for programs to be financially able to furnish substance abuse services, so payment 

disclosures are effectively disclosures for the benefit of the program. Many programs today 

simply refuse to provide treatment where a Part 2 conforming consent for payment disclosures is 

absent. 

SAMHSA should consider other changes to the QSO provisions to extend the availability of the 

QSO concept, with the goal of allowing substance abuse information to be used, like other health 

information, for public health improvements and patient safety. 

First, Part 2 could be revised to allow a QSO to provide services to perform activities for 

multiple programs or programs generally (e.g., quality improvement studies or administrative 

activities to benefit more than one program). Second, the QSO concept could allow a QSOA to 

be any organization that provides services to or for the program or the patient. That would also 

facilitate exchanges of information to payers (because a patient has an interest in the coverage 

and reimbursement of his/her services and care coordination entities). Additionally, SAMHSA 

could limit Part 2 restrictions on subsequent uses and disclosure by QSOs. Limited restrictions 

would still address the core concerns of Part 2 – information may not be used to prosecute or 

discriminate against individuals. 

Recommendation 

We recommend that a QSO be defined as an organization that “provides services to or for a 

program or performs activities on behalf of or for the benefit of the program, for multiple 

programs, or for program patients, such as . . . , payers and companies performing care 

coordination, population management or quality assessment activities ” Similar changes could 

be made to 2.12(c) “the restrictions on disclosure in these regulations do not apply to 

communications between a program and a qualified service organization of information needed 

by the organization to.... “ 

7 
 

 

 

 

 

 

Kaiser Permanente Comments 

42 CFR Part 2 

We also recommend that SAMHSA clarify (through FAQs or otherwise) that two programs may, 

under the auspices of a QSOA, disclose information to each other for treatment purposes. The 

rationale is that each program needs the services of the other to provide total treatment of the 

patient. For example, the referring program may provide outpatient treatment and the referral 

recipient program may provide inpatient treatment. We believe that prior SAMHSA FAQs 

support this conclusion and that current regulations allow such QSO arrangements, but think 

clarification would be beneficial for providers and other in the health care industry serving this 

population. 

Finally, SAMHSA should rescind its prior FAQ that forbade multi-party QSOAs allowing 

communication among all QSO parties. 

Research 

SAMHSA proposes to expand the authority to release data for research purposes when the 

recipients are qualified researchers. Currently, only program directors have that authority, which 

can limit Part 2 data that is available for research. 

Research into substance abuse treatment and outcomes has the potential to benefit patients, 

improve understanding of substance abuse and confounding or concomitant behavioral health 

problems, and ultimately reduce the stigma associated with these health conditions. At the same 

time, we acknowledge the privacy concerns of individuals who should be able to trust that their 

information will remain confidential, and the ability to maintain such information in confidence 

is central to promoting voluntary uptake and continuation of substance abuse services. 

Currently, Part 2 assigns the program director sole authority to weigh the benefits of the research 

against the risks of disclosure, including review of the research protocol, assessment of research 

data security, and determination about the qualifications of the researchers. However, current 

federal requirements for the protection of human research subjects establish a framework for the 

conduct of research that requires oversight by an institutional review board (“IRB”) to evaluate 

any risks to participant safety and privacy. 

IRB review and approval of research provides an equal or possibly greater level of oversight and 

trust for research involving Part 2 data, including continuing review and the authority to put 

certain processes in place to enhance data security. 

Recommendation 

Kaiser Permanente supports expanding the authority to release data for research purposes when 

an IRB has reviewed and approved the release of information. 

PDMPs 

SAMHSA’s request for comments raises questions about state prescription drug monitoring 

programs (“PDMPs”). Recently, SAMHSA has demonstrated support for PDMPs, including by 

sponsoring a project with ONC to expand provider access to PDMPs and data exchange with 

8 
 

 

 

 

 

 

 

Kaiser Permanente Comments 

42 CFR Part 2 

EHRs. We note also that SAMHSA has in the past stated in public presentations that once a 

prescription is issued and either sent by electronic means or given to a patient to be filled at a 

pharmacy, it is no longer protected by Part 2,4

 presumably because the patient is considered to 

have self-disclosed that information to the pharmacy (whether the actual information is 

transmitted by or on behalf of the patient). 

Prescription drugs are one tool for treating substance abuse disorders and underlying or collateral 

pathologies, such as depression or pain, although in most cases, information included on a 

prescription is not alone enough to clearly identify an individual as having a substance abuse 

disorder, since most drugs prescribed to substance abuse patients can be used to treat other 

conditions. 

Currently, in most states pharmacies and health care providers who dispense controlled 

substances are legally required to report to state PDMPs and subject to penalties for not 

reporting. SAMHSA should identify, address and resolve any conflicts between Part 2 

disclosure restrictions and state PDMP reporting laws, either through preemption rules at the 

federal level or in guidance from SAMHSA, identifying the circumstances under which PDMP 

reporting would not violate Part 2 restrictions. 

SAMHSA could accomplish the latter in one of two ways. First, through regulations or FAQs 

that explain that prescriptions submitted to a pharmacy by a patient or transmitted to a pharmacy 

by the program on behalf of the patient (via e-prescribing, fax or other telecommunication) are 

not disclosures by the program.5

 Second, SAMHSA could create a safe harbor for datasets that 

are deemed not to include information identifying a patient as a substance abuser (therefore 

records not subject to Part 2). 

CONCLUSION

Kaiser Permanente looks forward to working with SAMHSA to improve access, care integration 

and confidentiality of patient information. We appreciate your willingness to consider our 

comments. Please feel free to contact me (510-271-6835; email: anthony.barrueta@kp.org) or 

Lori Potter (510-271-6621; email: lori.potter@kp.org) with any questions or concerns. 

Sincerely, 

Anthony A. Barrueta 

SVP, Government Relations 

Kaiser Foundation Health Plan, Inc. 

4 See SAMHSA 2012 Presentation at the USPHS Scientific and Training Symposium, What You Need to Know 

about Prescription Drug Monitoring Programs 

5 As stated by SAMHSA in its 2012 presentation on PDMPs. 

9 
 

 

 

 

 

 

 

I don't think I have to say much, but providing my medical information 

to all doctors without my permission is bad policy and worst standard. 

I should have a choice on who of my doctors should know what. 

HAVEN'T YOU HEARD ABOUT HIPPA. Why do not you think HIPPA 

exist. It was not because medical providers were anonymous. 

They do not have the right to know what they shouldn't know. 

I have a HIPPA complain on a Psychologist Quack who wrote a 

report that has all of the characteristics of slander and intuition 

to harm 
Tues. 6/24/14

Substance Abuse and Mental Health Services

Administration (SAMHSA.) 

1 Choke Cherry Road, Rockville, MD 20785 Room 5-1011

To Whom It May Concern, 

On behalf of the project I’m involved with, (Recovery), along with all my peers – and 

everyone having to do with recovery etc., confidentiality is a must. The regulations (42 CFR 

Part 2), should be abided by in all respects. I don’t think anybody would want anything 

confidential about one’s self to be thrown out there for others to know about etc. So it’s best 

to follow rules and guidelines not only in (42 CFR Part 2), but in all areas. (Life, business, 

etc.) The bottom is confidentiality is a must. 

Thank you. 
June 24, 2014

To Whom It May Concern:

I am totally against my confidentially being bought into public knowledge. I feel that my 

medical information should remain confidential unless I give permission (written consent). 

As a person receiving Medical Assisted Treatment, I have personally experienced unfair 

treatment in the care of a Doctor, after telling him of my methadone treatment. 

Respectfully yours

Confidentiality is a must! 

(42 CFR Part 2) 
To Whom It May Concern:

As a patient at the Port Morris Outpatient program, I sincerely feel that no one absolutely 

no one should make anyone see any one medical chart unless the patient signs and gives 

them permission to look and I haven’t given no one any consent to tell my business. Please 

keep my charts confidentially. (42 CFR 2)

Keep it private. 

Sincerely 42 (CFR) Pt 2 
To Whom It May Concern, 

As a patient at the Port Morris outpatient program I sincerely feel that no one absolutely no 

one should make anyone see another patients medical chart unless the patient signs and gives 

whomever permission to look into their medical history. But confidentially is a must to any 

and all (42 CFR – Pt 2. So please keep all of our patient confidentiality regulations private. 

Sincerely 42 CFR Pt 2 
Dear Sir, Madam

I’m very concern about our confidentiality being open to more agencies and people who 

don’t have to know. Also as a patient for near 40 years I can say I’ve seen how patients are 

treated when that person, pro or etc. sees your on methadone for example I’ve had three 

bruised ribs and other seeing eye was a patient of a M.M.T.P. he said he can only suggest 

aspirin or Motrin this was one time one of many, threw my time as a patient not only doctors 

but other people. I have worked and had been for 20 years now but unless I’m sure about 

who ever I talk too that I don’t tell them I’m on methadone please keep a open mind if its 

passed to open this information it will cause, job, apt and looked down on as criminals. 

Please don’t take our dignity away. 

I also wanted to say why is it that no patients are involved in theses decisions or meeting, 

(like the one in mid june) I think you would see a better side of methadone treatment if you 

would talk to the patients who are or trying hard to be in recovery. Some of these patients –

clients are worried that their bosses, teachers clients will find out that they are on methadone 

they don’t want to take the chance of being fired and looked down on. I know because I was 

fired because my confidentiality was violated also no matter how and how much pain I was 

in through the yrs in E.Rs if they knew (Hosp Staff) I was a methadone patient they were not 

going to give me anything stronger then aspirin or motrin. It seem’s to me that people who 

are not educated in methadone treatment should talk to the high percentage of patients that 

work or go to school or trying hard to be in recovery. If you need 
June 17, 2014

To whom it may concern: 

I am writing to make it clearly certain that by no means am I allowing anyone to share 

my personal information regarding Morris Port Institution to release any medical information 

to my private doctors etc. Without my written consent. Thank you. Kindly

X patient of Morris Inst. 

Pss I have left out my name due to confidentiality.
6/24/2014

Confidentiality is a must, I have the to my private health and anything else doctors are 

suppose to get permission to give anyone medical information 
6/23/14

To whom it may concern:

As a patient @ the port morris outpatient program, I sincerely feel that no one absolutely no 

one should make anyone see another patient’s medical chart unless the patient signs and 

gives whom ever permission to look into their medical history! But confidentiality is a must 

to any and all (42 CFR –Pt2) so please keep all of our patient confidentiality regulations 

private only a written consent will allow for anyone to look into their private medical charts.

Respectfully, 

Confidentiality is a must! (CFR 42)
6-24-14

To whom it may concern:

Please be advised that I would like for not or nobody to look up my medical file

Thank you
6/23/14

To whom it may concern

As a patient of port morris outpatient program I sincerely feel that no one should make 

anyone see another patient medical records without permission so I feel that confidentiality is 

a must. 

Respectfully

Confidentiality is a must (CFR 42)
June 24, 2014

To whom it may concern:

I [REDACTED] am writing to clearly state that by no shape or form, would I allow any 

person to address any of my doctors, regarding any medical information nor my records due 

to patient confidentiality. 
I need confidentiality to stay the same at my methadone center. In regulation (42 CFR PART 

2). We ask that any information leaving the program, a patient must sign a release that 

requires the request to be exact.

Thank you for your time. 
To whom it may concern

As a patient at O.T.P. I believe that confidentiality is a must. For someone who want to 

read my medical record it is very important to get a written consent by the patient. My 

medical charts is for me and program (42 CFR-PT2) should stay in place. It protect the 

patient and the program. 

(CFR 42 – PT 2) confidentiality is a must. 
THE 

KENNEDY 

FORUM 

Uniting the Community of Mental Health 

June 25, 2014 

Pamela Hyde 

Administrator 

Substance Abuse and Mental Health Services Administration 

U.S. Department of Health and Human Services 

1 Choke Cherry Road 

Rockville, MD. 20857 

RE: Confidentiality of Alcohol and Drug Abuse Patient Records 

Dear Administrator Hyde: 

I am writing in response to the 42 CFR Part 2 Discussions Topics document posted in the 

Federal Register on May 12, 2014 [4162-20-P]. In turn, that document, which outlines 

alternative regulatory approaches to Part 2, was at the heart of a Listening Session held at 

SAMHSA on June 11, 2014. 

Background -- Substance Use/Mental Health Consumers Are Experiencing A Public Health 

Crisis: The Kennedy Forum was founded to carry on the work of President John F. Kennedy who 

signed the Community Mental Health Act in to law more than 50 years ago, weeks before his 

assassination. The legislation aimed to build mental health centers accessible to all Americans so 

that those with mental illnesses could be treated while working and living at home, rather than 

being kept in neglectful and often abusive state institutions, sometimes for years on end – 

thereby transforming the way people with mental illness are treated and cared for in the United 

States. 

While we have made tremendous progress over the past five decades in improving access to 

services for people with substance use and mental health disorders, it is not overstatement to 

claim that these patients/consumers are experiencing an ongoing public health crisis today. 

Specifically, according to a recent Synthesis Project report published jointly by the Kaiser 

Family Foundation and the Robert Wood Johnson Foundation, comorbidity between medical and 

behavioral health conditions “is the rule rather than the exception.” A nationally representative 

epidemiological survey revealed that more than 68% of adults with mental illnesses reported 

having at least one general medical condition. The same survey showed that nearly 30% of 

persons with substance abuse disorders have co-occurring chronic diseases including heart 

disease, diabetes, cirrhosis, emphysema and COPD. 

14 Central Avenue, PO Box 319, Island Heights, NJ 08732 

t: 732.573.0300 • f: 732.573.0062 • e: kara@nextchapterllc.net • w: www.thekennedyforum.com 
Re-disclosure: Again, this issue presents a conflict between the very poor overall health status of 

people with addiction disorders, the emerging capabilities of digital health records, and federal 

privacy rules little changed since the early 1970’s. As indicated earlier, the Kaiser Family 

Foundation reports that 30% of people with an active substance abuse disorder have comorbid 

chronic medical/surgical diseases often directly related to substance abuse including emphysema, 

COPD, cirrhosis, and heart disease. Therefore, I would urge SAMHSA to promulgate a new Part 

2 rule revising the re-disclosure provision to clarify that the prohibition on re-disclosure only 

applies to information that would identify an individual as a substance abuser, and allows other 

health-related information shared by the Part 2 program to be re-disclosed. Such a rule presents 

 

14 Central Avenue, PO Box 319, Island Heights, NJ 08732 

t: 732.573.0300 • f: 732.573.0062 • e: kara@nextchapterllc.net • w: www.thekennedyforum.com 

Because of poor care coordination and lack of access to primary care and specialty medical 

services, the ultimate outcome is radically shortened life expectancy. Combined research efforts 

by both SAMHSA and the HHS Assistant Secretary for Planning and Evaluation (ASPE), show 

that people served in the public mental health system (where the incidence rate for comorbid 

substance abuse disorders exceeds 70%) die, on average, in their early 50s, a life expectancy 

similar to that in extremely poor sub-Saharan African nations. 

This public health crisis must be an urgent federal priority addressed through aggressive care 

coordinated efforts, improved integration of behavioral health and medical/surgical services, and 

expanded access to primary care and specialty medical services. 

But none of these policy choices are available without a fundamental re-examination of 42 CFR 

Part 2. With that background, I will seek to briefly address some of the key issues highlighted in 

the Discussion Topics document. 

Consent Requirements: Recent federal initiatives intended to improve coordination care for 

patient populations with multiple chronic diseases – including HITECH Act-funded Health 

Information Exchanges (HIEs), Medicare Accountable Care Organizations (ACOs), Medicaid 

Health Homes and state-based Coordinated Care Organizations (CCOs) have limited 

applicability to the needs of people with behavioral health conditions, in part, because of Part 2’s 

stringent consent requirements. Each program experiences different confidentiality challenges. 

For example, HIEs don’t accept mental health and addiction Electronic Health Records (EHRs) 

because they lack sophisticated consent management capabilities. As a result, people with major 

mental illnesses and serious addiction disorders are denied the expanding use of HIE data to 

facilitate early intervention and population-based health. Similarly, the CMS Center for 

Medicare and Medicaid Innovation (CMMI) must redact all addiction medical records due to the 

Part 2 “To Whom” consent requirements when it shares Medicare claims data with Pioneer 

ACOs meaning reduced care coordination opportunities for persons with schizophrenia and 

bipolar disorder who also have a comorbid substance abuse condition. 

What’s the end result? Federal information management policies directly contribute to silobased care, fragmentation of the behavioral health system, and a continuation of poor clinical 

outcomes. At a minimum, SAMHSA should consider 42 CFR Part 2 policy changes allowing 

consent forms to include more general descriptions of the individual, organization, or health care 

entity to which disclosure is to be made. 
 

14 Central Avenue, PO Box 319, Island Heights, NJ 08732 

• f: 732.573.0062 • e: kara@nextchapterllc.net • w: www.thekennedyforum.com 

no obvious obstacle to SAMHSA’s data segmentation efforts, which, in any case, are four to six 

years away from broad implementation. 

Qualified Service Organization: Against the historical arc of American medicine, Health 

Information Technology is in its infancy, but the possibilities for improved health outcomes 

among vulnerable, low-income populations are significant. For instance, enhanced care 

coordination for patients/consumers with behavioral health conditions could avoid adverse 

medical events from drug-to-drug interactions, but that clinical outcome requires robust 

information exchange between behavioral health professionals, physicians, hospitals and medical 

specialists. Sharing behavioral health EHRs in HIEs could also produce substantial savings for 

the larger health care system. A recent Health Affairs article highlighted the role that HIEs can 

play both in identifying high users of emergency hospital department beds and facilitating 

communitywide quality measurement. 

These prospects should encourage SAMHSA to take a new approach to the Qualified Service 

Organization (QSO) question. I believe the agency should issue a Part 2 regulation that expands 

the definition of qualified service organization (QSO) to explicitly include care coordination 

services and to allow a QSO Agreement (QSOA) to be executed between an entity that stores 

Part 2 information, such as a payer or an ACO that is not itself a Part 2 program, and a service 

provider. 

For many years, I fought for mental health parity legislation in the U.S. Congress. Under the 

banner of the Kennedy Forum, I am now working to help people with mental illnesses and 

substance abuse disorders to benefit from parity in practice. I am convinced beyond a doubt that 

an essential building block in this effort is access to the new coordinated, digitally enabled health 

care system. I urge SAMHSA to do all in its power to ensure those with mental illnesses and 

substance use disorders have the same access to coordinated care as people with cancer, heart 

disease, or any other condition. 

Thank you for your attention to these important matters. 

Sincerely, 

Patrick Kennedy 

t: 732.573.0300