From: Brian McCarroll [mailto:brian.mccarroll@live.com] 

Sent: Monday, June 23, 2014 6:44 PM 

To: Privacy Regulations (SAMHSA) 

Cc: mark.parrino@aatod.org 

Subject: Privacy regulations 

6/23/14 

U.S. Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

RE: Confidentiality of Alcohol & Drug Abuse Patient Records Regulations, 

42 C.F.R. Part 2. 79 Fed. Reg. 26929; Docket No. 2014-10913. 

To Whom It May Concern: 

While BioMed Behavioral Healthcare, Inc. supports updating the mechanics of the federal 

alcohol and drug confidentiality regulations to facilitate more effective integration of care and 

needed communication in the electronic age, 42 C.F.R. Part 2’s core privacy protections 

MUST be maintained. 

We are convinced that any changes to the current confidentiality regulations outlined in 42 CFR 

PART 2 would be detrimental to our patient population. The stigma still inolved with patients 

suffering from the disease of addiction is still rampant in our society. Allowing this information 

to be disclosed can only open up our patients to further prejudice and estrangement by future 

employers and isolation in society. Our patients are receiving medically assisted treatment of 

their opioid addiction using both methadone and suboxone. As it stands today the majority of 

employers will neither hire any person while receiving these medications for the treatment of 

their addiction nor will they consider employing anyone with a history of opioid addiction no 

matter how many years of recovery that they have had. Furthermore, in their ignorance, they 

won't even consider hiring anyone with such a past history. They are labeled as "drug addicts" 

and are often referred to as the "bottom feeders of society". This is not right, but it is still a 

reality that our patients are confronted with on a daily basis. 

With regard to the modifications to 42 C.F.R. Part 2 proposed in SAMHSA’s May 12, 2014 

Notice of Public Listening Session (79 Fed. Reg. 26929), we support the following principles: 

• Addiction treatment should be integrated with mental and physical health care, 

and communication among health care providers should be encouragedsupport 

maximizing inclusion of substance use disorder (SUD) records in electronic 

health record (EHR) systems and health information exchanges (HIEs) while 

maintaining 42 C.F.R. Part 2’s core privacy protections. 

• 42 C.F.R. Part 2’s heightened privacy protections are as critical today as they 

were when they were enacted more than 40 years ago, and a move toward 

HIPAA’s looser privacy standards would not sufficiently protect people seeking 
 

 

 

 

 

 

 

and receiving substance use disorder treatment. If patient records can be easily 

accessed in order to criminally investigate or prosecute or patient, or deny them 

insurance or a job, or be used against them in a divorce or child custody 

proceeding, many patients will be afraid to enter treatment in the first place. 

• LAC continues to believe that patients in alcohol and drug programs should 

retain the power to decide when and to whom their records are disclosed, even for 

treatment and payment purposes, given the continued prevalence of 

discrimination in our society. This includes disclosures to the general health care 

system, HIEs, health homes, ACOs, and CCOs. The best way for patients to retain 

that power is by requiring patient consent for most disclosures, together with a 

strong prohibition on redisclosure. 

• It is both necessary and technologically possible to integrate addiction and other 

health care and effectively exchange addiction treatment data while maintaining 

the core protections of 42 C.F.R. Part 2. We urge the continued development of 

technical solutions for consent management. 

• Since HIPAA requires compliance with state and federal laws that mandate 

greater privacy protections, electronic health record systems (EHRs) must be 

designed so as to comply with the many state statutes that require heightened 

protections for information related to mental health, HIV/AIDS, reproductive 

health, domestic violence and other types of sensitive health information, as well 

as with 42 C.F.R. Part 2. It is important to keep in mind, therefore, that EHRs 

would be required to accommodate enhanced protections for the medical records 

of some illnesses in order to be HIPAA-compliant even if 42 C.F.R. Part 2 did not 

exist. 

We also support the comments submitted by the Legal Action Center. 

Thank you for your consideration. 

Brian A. McCarroll, DO, MS, ABAM 

CEO and President of BioMed Behavoral Healthcare, Inc. 
 

 

 

 

 

 

 

 

 

 

 

 

 
 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

	 

	 

 

 

 

 

	 

	 

Opioid Treatment Association of Rhode Island (OTARI) 

Addiction Recovery Institute • Center for Treatment and Recovery • CODAC 

Discovery House • Providence Metro • The Journey
 

June 23, 2014 

U.S. Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

RE: Confidentiality of Alcohol & Drug Abuse Patient Records Regulations, 42 C.F.R. 

Part 2. 79 Fed. Reg. 26929; Docket No. 2014-10913. 

To Whom It May Concern: 

The Opioid Treatment Association of Rhode Island (OTARI) represents every registered 

methadone provider in Rhode Island and treats over 4000 patients per day. 

The information obtained, developed, and maintained for every patient has been, and continues 

to be, protected by 42 C.F.R. Part 2 and its core privacy protections. 

A significant number of those served by OTARI members receive methadone to treat and sustain 

their recovery. There remains little doubt, that stigma and discrimination continues to be a part 

of this population’s day-day life. This is evident in housing, employment, criminal justice, social 

services, and health care. In spite of continuous efforts by providers to educate other members 

of the “care community”, our patients are often denied housing, employment, and custody of 

their children if they remain in treatment. Likewise, physicians and other healthcare providers 

refuse to either initiate or continue treatment. 

It is our concern that any “weakening” of the core privacy protections will expose our patients to 

new levels of discrimination. 

While OTARI supports updating the mechanics of the federal alcohol and drug confidentiality 

regulations to facilitate more effective integration of care and needed communication in the 

electronic age, we believe that 42 C.F.R. Part 2’s core privacy protections MUST be 

maintained. 

With regard to the modifications to 42 C.F.R. Part 2 proposed in SAMHSA’s May 12, 2014 Notice 

of Public Listening Session (79 Fed. Reg. 26929), OTARI supports the following principles: 

•	 Addiction treatment should be integrated with mental and physical health care, and 

communication among health care providers should be encouraged. We support 

maximizing inclusion of substance use disorder (SUD) records in electronic health record 

(EHR) systems and health information exchanges (HIEs) while maintaining 42 C.F.R. Part 

2’s core privacy protections. 

•	 42 C.F.R. Part 2’s heightened privacy protections are as critical today as they were when 

they were enacted more than 40 years ago, and a move toward HIPAA’s looser privacy 

standards would not sufficiently protect people seeking and receiving substance use 

disorder treatment. If patient records can be easily accessed in order to criminally 

investigate or prosecute or patient, or deny them insurance or a job, or be used against 

them in a divorce or child custody proceeding, many patients will be afraid to enter 

treatment in the first place. 

c/o CODAC – 1052 Park Ave., Cranston, RI 02910 • 401-275-5039 • 401-942-3590 (F) • mrizzi.otari@gmail.com 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 


 
 

	 

	 

	 


 

Opioid Treatment Association of Rhode Island (OTARI) 

Addiction Recovery Institute • Center for Treatment and Recovery • CODAC 

Discovery House • Providence Metro • The Journey
 

•	 We continue to believe that patients in alcohol and drug programs should retain the power 

to decide when and to whom their records are disclosed, even for treatment and payment 

purposes, given the continued prevalence of discrimination in our society. This includes 

disclosures to the general health care system, HIEs, health homes, ACOs, and CCOs. The 

best way for patients to retain that power is by requiring patient consent for most 

disclosures, together with a strong prohibition on redisclosure. 

•	 It is both necessary and technologically possible to integrate addiction and other health 

care and effectively exchange addiction treatment data while maintaining the core 

protections of 42 C.F.R. Part 2. We urge the continued development of technical solutions 

for consent management. 

•	 Since HIPAA requires compliance with state and federal laws that mandate greater privacy 

protections, electronic health record systems (EHRs) must be designed so as to comply with 

the many state statutes that require heightened protections for information related to 

mental health, HIV/AIDS, reproductive health, domestic violence and other types of 

sensitive health information, as well as with 42 C.F.R. Part 2. It is important to keep in 

mind, therefore, that EHRs would be required to accommodate enhanced protections for the 

medical records of some illnesses in order to be HIPAA-compliant even if 42 C.F.R. Part 2 

did not exist. 

OTARI also support the comments submitted by The American Association for the Treatment of 

Opioid Abuse (AATOD) the Legal Action Center. 

Thank you for your consideration. 

Respectfully, 

Michael Rizzi 	 

Chair, OTARI (CODAC) 

Wendy Looker 

Center for Treatment and Recovery 

Richard Froncillo 

Discovery House 

Richard Hill 
 

The Journey 

Greg McWilliams 

Addiction Recovery Institute 

c/o CODAC – 1052 Park Ave., Cranston, RI 02910 • 401-275-5039 • 401-942-3590 (F) • mrizzi.otari@gmail.com 
 

 

 

 

 

www.shieldsforfamilies.org 

SUBMITTED VIA EMAIL 

June 24, 2014 

U.S. Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

RE: Confidentiality of Alcohol & Drug Abuse Patient Records Regulations, 42 C.F.R. Part 

2. 79 Fed. Reg. 26929; Docket No. 2014-10913. 

To Whom It May Concern: 

SHIELDS for Families (SHIELDS) is a comprehensive, community based, non-profit 

organization serving families residing in South Los Angeles. SHIELDS has been a subcontractor 

with the California State Department of Public Health, Office of Substance Abuse Prevention and 

Control (SAPC) since 1990. We currently employ over 380 full time employees, with an annual 

budget of over $28 million to serve over 10000 families annually in 38 programs, including ten (10) 

substance abuse treatment programs. 

While SHIELDS supports updating the mechanics of the federal alcohol and drug 

confidentiality regulations to facilitate more effective integration of care and needed communication 

in the electronic age, 42 C.F.R. Part 2’s core privacy protections MUST be maintained. 

Over our 23-year history of serving the South Los Angeles community, SHIELDS has helped 

many alcohol and drug addiction patients who have become addicted to one or more substances 

break their addictions and return to normal, productive lives. The protections provided by 42 C.F.R. 

Part 2 help ensure that our patients’ privacy and dignity is preserved at all times, even when faced 

with law enforcement and judicial intervention. These protections are especially crucial because 

many of our patients must continue to work, provide for their families, and further their education 

while attending our treatment programs, and a loss of that privacy may result in shame, stigma, and 

the loss of employment or other hard-earned benefits. A loss or breach of that privacy may even 

cause patients to relapse. 
With regard to the modifications to 42 C.F.R. Part 2 proposed in SAMHSA’s May 12, 2014 

Notice of Public Listening Session (79 Fed. Reg. 26929), SHIELDS supports the following 

principles: 

2 

	 Addiction treatment should be integrated with mental and physical health care, and 

communication among health care providers should be encouraged. We support 

maximizing inclusion of substance use disorder (SUD) records in electronic health record 

(EHR) systems and health information exchanges (HIEs) while maintaining 42 C.F.R. 

Part 2’s core privacy protections. 

	 42 C.F.R. Part 2’s heightened privacy protections are as critical today as they were when 

they were enacted more than 40 years ago, and a move toward HIPAA’s looser privacy 

standards would not sufficiently protect people seeking and receiving substance use 

disorder treatment. If patient records can be easily accessed in order to criminally 

investigate or prosecute or patient, or deny them insurance or a job, or be used against 

them in a divorce or child custody proceeding, many patients will be afraid to enter 

treatment in the first place. 

	 	 SHIELDS continues to believe that patients in alcohol and drug programs should retain 

the power to decide when and to whom their records are disclosed, even for treatment and 

payment purposes, given the continued prevalence of discrimination in our society. This 

includes disclosures to the general health care system, HIEs, health homes, ACOs, and 

CCOs. The best way for patients to retain that power is by requiring patient consent for 

most disclosures, together with a strong prohibition on redisclosure. 

 

	 It is both necessary and technologically possible to integrate addiction and other health 

care and effectively exchange addiction treatment data while maintaining the core 

protections of 42 C.F.R. Part 2. We urge the continued development of technical 

solutions for consent management. 

	 Since HIPAA requires compliance with state and federal laws that mandate greater 

privacy protections, electronic health record systems (EHRs) must be designed so as to 

comply with the many state statutes that require heightened protections for information 

related to mental health, HIV/AIDS, reproductive health, domestic violence and other 

types of sensitive health information, as well as with 42 C.F.R. Part 2. It is important to 

keep in mind, therefore, that EHRs would be required to accommodate enhanced 

protections for the medical records of some illnesses in order to be HIPAA-compliant 

even if 42 C.F.R. Part 2 did not exist. 
Finally, SHIELDS also supports the comments submitted by the Legal Action Center. 

Thank you for your consideration. 

Sincerely, 

Dr. Kathryn Icenhower 

Chief Executive Officer 

SHIELDS For Families 

3 
darlene carroll 

From: 

Sent: 

To: 

Subject: 

Dar, 

Michael Hanlon 

Wednesday, June 25, 2014 7:29 AM 

darlene carroll 

fax 

Here is the fax# and the email address the letter needs to be sent to: 

Fax: 1-240-276-2900. 

privacyregulations@samHSA.hhs.c,ov. 

1 

darlene carroll 

From: Michael Hanlon 

Sent: Wednesday, June 25, 2014 7:29 AM 

To darlene carroll 

Dar,
­

Here is the fax # and the email address the letter needs to be sent to:
­

Fax: 1-240-276-2900
­

privacyregulations@samhsa.hhs.gov
­
 

 

 

 

 

Administrative Offices 

360 East Avenue 

Rochester, New York 14604 

585-325-5100 

www.hutherdoyle.com 

June 25, 2014 

U.S. Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

RE: Confidentiality of Alcohol & Drug Abuse Patient Records Regulations, 42 C.F.R. Part 2. 

79 Fed. Reg. 26929; Docket No. 2014-10913. 

To Whom It May Concern: 

For the past twenty-five years, I have served as President & CEO of Huther Doyle. This is the largest 

community-based outpatient substance abuse treatment provider certified by the New York State Office 

of Alcoholism and Substance Abuse Services in this Region of New York and the only one with an 

embedded New York State Department of Health licensed ambulatory health clinic. I also serve as 

President of RecoveryNet, which is a collaborative of nine (9) community-based treatment providers 

across the Finger Lakes Region. That collaborative has been in existence for fourteen years and contains 

a full-continuum of substance abuse services. 

While Huther Doyle and its partner agencies support updating the mechanics of the federal alcohol and 

drug confidentiality regulations to facilitate more effective integration of care and needed 

communication in the electronic age, 42 C.F.R. Part 2’s core privacy protections MUST be 

maintained. 

Several years ago, while meeting with RecoveryNet partner agency Executives in Rochester, Dr. Wesley 

Clark noted that there is still an issue of stigma associated with a diagnosis of substance dependence and 

that the stigma continues to serve as a barrier for many who are in need of treatment. We share a deep 

concern that removing or reducing the confidentiality protections provided by 42 C.F.R. Part 2 could 

further reduce the likelihood of many who would benefit from treatment actually choosing to engage. 

With regard to the modifications to 42 C.F.R. Part 2 proposed in SAMHSA’s May 12, 2014 Notice of 

Public Listening Session (79 Fed. Reg. 26929), Huther Doyle and its partner agencies support the 

following principles: 
 

 

•	 Addiction treatment should be integrated with mental and physical health care, and 

communication among health care providers should be encouraged. We support maximizing 

inclusion of substance use disorder (SUD) records in electronic health record (EHR) systems and 

health information exchanges (HIEs) while maintaining 42 C.F.R. Part 2’s core privacy 

protections. 

•	 42 C.F.R. Part 2’s heightened privacy protections are as critical today as they were when they 

were enacted more than 40 years ago, and a move toward HIPAA’s looser privacy standards 

would not sufficiently protect people seeking and receiving substance use disorder treatment. If 

patient records can be easily accessed in order to criminally investigate or prosecute or patient, or 

deny them insurance or a job, or be used against them in a divorce or child custody proceeding, 

many patients will be afraid to enter treatment in the first place. 

•	 We continue to believe that patients in alcohol and drug programs should retain the power to 

decide when and to whom their records are disclosed, even for treatment and payment purposes, 

given the continued prevalence of discrimination in our society. This includes disclosures to the 

general health care system, HIEs, health homes, ACOs, and CCOs. The best way for patients to 

retain that power is by requiring patient consent for most disclosures, together with a strong 

prohibition on redisclosure. 

•	 It is both necessary and technologically possible to integrate addiction and other health care and 

effectively exchange addiction treatment data while maintaining the core protections of 42 

C.F.R. Part 2. We urge the continued development of technical solutions for consent 

management. 

•	 Since HIPAA requires compliance with state and federal laws that mandate greater privacy 

protections, electronic health record systems (EHRs) must be designed so as to comply with the 

many state statutes that require heightened protections for information related to mental health, 

HIV/AIDS, reproductive health, domestic violence and other types of sensitive health 

information, as well as with 42 C.F.R. Part 2. It is important to keep in mind, therefore, that 

EHRs would be required to accommodate enhanced protections for the medical records of some 

illnesses in order to be HIPAA-compliant even if 42 C.F.R. Part 2 did not exist. 

We also support the comments submitted by the Legal Action Center. 

Thank you for your consideration. 

Robert R. Lebman 

President & CEO 
New Horizon Treatment Services. Inc. 

132 Perry Street 

Trenton, NJ 08618 

(609) 394-8988 

June 25, 2014 

U.S. Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

RE: Confidentiality of Alcohol & Drug Abuse Patient Records Regulations, 42 C.F.R. 

Part 2. 79 Fed. Reg. 26929; Docket No. 2014-10913. 

To Whom It May Concern: 

While New Horizon Treatment Services, Inc. supports updating the mechanics of the federal 

alcohol and drug confidentiality regulations to facilitate more effective integration of care and 

needed communication in the electronic age, 42 C.F.R. Part 2's core privacy protections 

MUST be maintained. 

The clients we serve MUST have their rights protected at all cost and 42 C.F.R. Part 2's core 

privacy protection has effectively done that since they were enacted more than 40 years ago. 

With regard to the modifications to 42 C.f.R. Part 2 proposed in SAMHSA's May 12, 2014 

Notice of Public Listening Session (79 Fed. Reg. 26929), New Horizon Treatment Services, Inc. 

supports the following principles: 

o Addiction treatment should be integrated with mental and physical health care, and 

communication an1ong health care providers should be encouraged. We support maximizing 

inclusion of substance use disorder (SUD) records in electronic health record (EHR) systems 

and health information exchanges (HIEs) while maintaining 42 C.F.R. Part 2's core privacy 

protections. 

o	 42 C.F.R. Part 2's heightened privacy protections are as critical today as they were when 

they were enacted more than 40 years ago, and a move toward HIPAA's looser privacy 

standards would not sufficiently protect people seeking and receiving substance use disorder 

treatment. If patient records can be easily accessed in order to criminally investigate or 

prosecute or patient, or deny them insurance or a job, or be used against 

A Three-Year accreditation was awarded to New Horizon Treatment Services for its Opioid Treatment Program (OTP). 
DAS Memorandum Page 2 October 5, 2010 

them in a divorce or child custody proceeding, many patients will be afraid to enter 

treatment in the first place. 

•	° New Horizon Treatment Services, Inc. continues to believe that patients in alcohol and 

drug programs should retain the power to decide when and to whom their records are 

disclosed, even for treatment and payment purposes, given the continued prevalence of 

discrimination in our society. This includes disclosures to the general health care 

system, HIEs, health homes, ACOs, and CCOs. The best way for patients to retain 

that power is by requiring patient consent for most disclosures, together with a strong 

prohibition on redisclosure. 

•	° It is both necessary and technologically possible to integrate addiction and other health 

care and effectively exchange addiction treatment data while maintaining the core 

protections of 42 C.F.R. Part 2. [I/We] urge the continued development of technical 

solutions for consent management. 

•	° Since HIP AA requires compliance with state and federal laws that mandate greater 

privacy protections, electronic health record systems (EHRs) must be designed so as to 

comply with the many state statutes that require heightened protections for 

information related to mental health, HlV IAIDS, reproductive health, domestic 

violence and other types of sensitive health information, as well as with 42 C.F.R. Part 

2. It is important to keep jn mind, therefore, that EHRs would be required to 

accommodate enhanced protections for the medical records of some illnesses in order 

to be HIPAA-compliant even if 42 C.F.R. Part 2 did not exist. 

We also support the comments submitted by the Legal Action Center. 

Thank you for your consideration. 

Sincerely, 

Dr. Luis R. Nieves, MBA, Psy.D., ABPP
°

Executive Director 

A Three-Year accreditation was awarded to New Horizon Treatment Services for its Opioid Treatment Program (OTP). 
 

 

 

 

 

 

 	 

 

 

	 

	 

	 

	 

	 

	 

	 

June 25, 2014 

U.S. Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

RE:	 Confidentiality of Alcohol & Drug Abuse Patient Records Regulations, 42 C. F.R. 

Part 2. 79 Fed. Reg. 26929; Docket No. 2014-10913. 

To Whom It May Concern: 

While we, the undersigned groups and individuals, support updating the mechanics of the federal 

alcohol and drug confidentiality regulations to facilitate more effective integration of care and 

needed communication in the electronic age, 42 C.F.R. Part 2’s core privacy protections 

MUST be maintained. 

With regard to the modifications to 42 C.F.R. Part 2 proposed in SAMHSA’s May 12, 2014 

Notice of Public Listening Session (79 Fed. Reg. 26929), the undersigned organizations support 

the following principles: 

•	 Addiction treatment should be integrated with other health care, and communication 

among health care providers should be encouraged. We support maximizing inclusion of 

substance use disorder (SUD) records in electronic health record (EHR) systems and 

health information exchanges (HIEs) while maintaining 42 C.F.R. Part 2’s core privacy 

protections. 

•	 42 C.F.R. Part 2’s heightened privacy protections are as critical today as they were when 

they were enacted more than 40 years ago, and a move toward HIPAA’s looser privacy 

standards would not sufficiently protect people seeking and receiving substance use 

disorder treatment. If patient records can be easily accessed in order to criminally 

investigate or prosecute or patient, or deny them insurance or a job, or be used against 

them in a divorce or child custody proceeding, many patients will be afraid to enter 

treatment in the first place. 

•	 We continue to believe that patients in alcohol and drug programs should retain the 

power to decide when and to whom their records are disclosed, even for treatment and 

payment purposes, given the continued prevalence of discrimination in our society. This 

includes disclosures to the general health care system, HIEs, health homes, ACOs, and 
 

 

 

 

	 

	 

	 

 

 

 

	 

	 

	 

CCOs. The best way for patients to retain that power is by requiring patient consent for 

most disclosures, together with a strong prohibition on redisclosure. 

•	 It is both necessary and technologically possible to integrate addiction and other health 

care and effectively exchange addiction treatment data while maintaining the core 

protections of 42 C.F.R. Part 2. We urge the continued development of technical 

solutions for consent management. 

•	 Since HIPAA requires compliance with state and federal laws that mandate greater 

privacy protections, electronic health record systems (EHRs) must be designed so as to 

comply with the many state statutes that require heightened protections for information 

related to mental health, HIV/AIDS, reproductive health, domestic violence and other 

types of sensitive health information, as well as with 42 C.F.R. Part 2. It is important to 

keep in mind, therefore, that EHRs would be required to accommodate enhanced 

protections for the medical records of some illnesses in order to be HIPAA-compliant 

even if 42 C.F.R. Part 2 did not exist. 

Thank you for your consideration. 

Sincerely, 

Organizations:	 Individuals: 

ADAP Advocacy Association (aaa+) Ron Swanda, Washington, DC 

AIDS Action Baltimore Keith C. Waltrip (Allejo, CA) 

AIDS Legal Council of Chicago 

AIDS United 

Community Access National Network (CANN) 

The HIV Dental Alliance 

Lifelong (Seattle, WA) 

Project Inform 
The Lennard Clinic, Inc. 

Board of Trustees 

Kanileah Phleps 

President 

James Landgraf, Esq. 

Secretary 

Frager Foster 

Treasurer 

Dr. Miles Austin 

Trustee 

John Knox 

Trustee 

Richard Williams 

Trustee 

William Merritt 

Trustee 

EXECUTIVE 

Tanya Laughinghouse 

MA, LCADC, CCS 

CEO 

IMMEDIATE PAST CE O 

Lewis Ware, MSW 

1987 - 2012 

FOUNDER 

Errol L. Lennard, D.P.A 

1936 - 2002 

Accredited OTP 

SUBMITTED VIA EMAIL 

June 25, 2014 

The Lennard Clinic, Inc. 

461 Frelinghuysen Avenue 

Newark, New Jersey 07114 

U.S. Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

RE: Confidentiality of Alcohol & Drug Abuse Patient Records 

Regulations, 42 C.F.R. Part 2. 79 Fed. Reg. 26929; Docket No. 2014-

10913. 

To Whom It May Concern: 

As The Lennard Clinic celebrates three decades of providing outpatient substance 

abuse treatment in the greater Newark and Elizabeth, New Jersey areas, we have 

emphasized the importance of respecting the rights of the persons we serve. Our 

steadfast position in upholding the regulations of 42CFR Part 2 has allowed us to 

both educate and establish a rapport with local law enforcement, child protective 

services and various referral agencies. 

While The Lennard Clinic supports updating the mechanics of the federal alcohol 

and drug confidentiality regulations to facilitate more effective integration of care 

and needed communication in the electronic age, 42 C.F.R. Part 2's core 

privacy protections MUST be maintained. 

Many of our clients come from the same neighborhoods as our staff or attended 

some of the same high schools and elementary schools. One of our clients shared 

TLC-Il 

461 Frelinghuysen Avenue 

Newark, NJ 07114 

Tel (973) 596-2850 Fax (973) 596-8180 

TLC-ill 

850 Woodruff Lane 

Elizabeth, NJ 0720\ 

Tel (908) 352-0850 Fax (908J 352-1036 

E-mail: Info@TLClinics.org
�
her story among the other clients on how her confidentiality was protected by a 

family member who was employed at the treatment facility. It was a year before 

the client told her family she was in treatment. It was then that the client truly 

appreciated how her connection with our facility was never disclosed to her 

family before she decided to tell them. A sure way for a treatment facility to lose 

client trust is to have a reputation of breaching client confidentiality. 

With regard to the modifications to 42 C.F.R. Part 2 proposed in SAMHSA's May 

12, 2014 Notice of Public Listening Session (79 Fed. Reg. 26929), The Lennard 

Clinic supports the following principles: 

•	g Addiction treatment should be integrated with mental and physical health 

care, and communication among health care providers should be 

encouraged. We support maximizing inclusion of substance use disorder 

(SUD) records in electronic health record (EHR) systems and health 

information exchanges (HIEs) while maintaining 42 C.F.R. Part 2's core 

privacy protections. 

•	g 42 C.F.R. Part 2's heightened privacy protections are as critical today as 

they were when they were enacted more than 40 years ago, and a move 

toward HIP AA's looser privacy standards would not sufficiently protect 

people seeking and receiving substance use disorder treatment. If patient 

records can be easily accessed in order to criminally investigate or 

prosecute or patient, or deny them insurance or a job, or be used against 

them in a divorce or child custody proceeding, many patients will be 

afraid to enter treatment in the first place. 

•	g LAC continues to believe that patients in alcohol and drug programs 

should retain the power to decide when and to whom their records are 

disclosed, even for treatment and payment purposes, given the continued 

prevalence of discrimination in our society. This includes disclosures to 

the general health care system, HIEs, health homes, ACOs, and CCOs. 

The best way for patients to retain that power is by requiring patient 

consent for most disclosures, together with a strong prohibition on 

redisclosure. 

•	g It is both necessary and technologically possible to integrate addiction and 

other health care and effectively exchange addiction treatment data while 

maintaining the core protections of 42 C.F.R. Part 2. We urge the 

continued development of technical solutions for consent management. 

2 
•	I Since HIP AA requires compliance with state and federal laws that 

mandate greater privacy protections, electronic health record systems 

(EHRs) must be designed so as to comply with the many state statutes that 

require heightened protections for information related to mental health, 

HIV/AIDS, reproductive health, domestic violence and other types of 

sensitive health information, as well as with 42 C.F .R. Part 2. It is 

important to keep in mind, therefore, that EHRs would be required to 

accommodate enhanced protections for the medical records of some 

illnesses in order to be HIPAA-compliant even if 42 C.F.R. Part 2 did not 

exist. 

Finally, The Lennard Clinic supports the comments submitted by the Legal 

Action Center. 

Thanking you in advance for your consideration 

Sincerely, 

Tanya Laughinghouse, MA, LCADC, CCS 

Chief Executive Officer 

3 
 

LEGAL ACTION CENTER TEMPLATE FOR SAMHSA COMMENTS
 

Submitted via Fax 

6/25/2014 

Crossroads Treatment Center of Danville 

1555 Meadowview Dr. Ste 5 

Danville, VA 24541 

U.S. Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

RE: Confidentiality of Alcohol & Drug Abuse Patient Records Regulations, 42 C.F.R. 

Part 2. 79 Fed. Reg. 26929; Docket No. 2014-10913. 

To Whom It May Concern: 

Crossroads Treatment Center of Danville is a medication-assisted treatment program for opioid 

dependent patients. We provide medication and substance abuse counseling services to the 

vulnerable population who are addicted to heroin or prescription medications. 

While Crossroads Treatment Center of Danville supports updating the mechanics of the federal 

alcohol and drug confidentiality regulations to facilitate more effective integration of care and 

needed communication in the electronic age, 42 C.F.R. Part 2’s core privacy protections 

MUST be maintained. 

Our patients are often faced with a stigma of not only being addicts in need of treatment, but also 

taking a narcotic medication as a form of treatment for narcotic addiction. The notion of 

“trading one drug for another” often means that our patients are judged by family and friends and 

are often not even allowed to attend meetings of narcotics anonymous. The protection of their 

privacy in treatment is vital to their well-being and their recovery from addictive substances. 

1 
 

 

 

Because our patients have to be dosed daily in our clinic, it is often easy for people to discover 

that our patients are in treatment here and this opens the door for curiosity and suspicion. Law 

enforcement often thinks they have the right to inquire about our patients and family members 

insist that we release information to them. Up to this point, 42 C.F.R. Part 2 has protected our 

patients’ right to private treatment for substance abuse and has made a big impact in their 

recovery and the number of people that choose to enter into treatment. In our opinion the core 

privacy protections of 42 C.F.R. Part 2 save lives. 

With regard to the modifications to 42 C.F.R. Part 2 proposed in SAMHSA’s May 12, 2014 

Notice of Public Listening Session (79 Fed. Reg. 26929), Crossroads Treatment Center of 

Danville supports the following principles: 

•	 Addiction treatment should be integrated with mental and physical health care, and 

communication among health care providers should be encouraged. We support 

maximizing inclusion of substance use disorder (SUD) records in electronic health record 

(EHR) systems and health information exchanges (HIEs) while maintaining 42 C.F.R. 

Part 2’s core privacy protections. 

•	 42 C.F.R. Part 2’s heightened privacy protections are as critical today as they were when 

they were enacted more than 40 years ago, and a move toward HIPAA’s looser privacy 

standards would not sufficiently protect people seeking and receiving substance use 

disorder treatment. If patient records can be easily accessed in order to criminally 

investigate or prosecute or patient, or deny them insurance or a job, or be used against 

them in a divorce or child custody proceeding, many patients will be afraid to enter 

treatment in the first place. 

•	 LAC continues to believe that patients in alcohol and drug programs should retain the 

power to decide when and to whom their records are disclosed, even for treatment and 

payment purposes, given the continued prevalence of discrimination in our society. This 

includes disclosures to the general health care system, HIEs, health homes, ACOs, and 

CCOs. The best way for patients to retain that power is by requiring patient consent for 

most disclosures, together with a strong prohibition on re-disclosure. 

•	 It is both necessary and technologically possible to integrate addiction and other health 

care and effectively exchange addiction treatment data while maintaining the core 

protections of 42 C.F.R. Part 2. We urge the continued development of technical 

solutions for consent management. 

•	 Since HIPAA requires compliance with state and federal laws that mandate greater 

privacy protections, electronic health record systems (EHRs) must be designed so as to 

2 
 

 

comply with the many state statutes that require heightened protections for information 

related to mental health, HIV/AIDS, reproductive health, domestic violence and other 

types of sensitive health information, as well as with 42 C.F.R. Part 2. It is important to 

keep in mind, therefore, that EHRs would be required to accommodate enhanced 

protections for the medical records of some illnesses in order to be HIPAA-compliant 

even if 42 C.F.R. Part 2 did not exist. 

We also support the comments submitted by the Legal Action Center. 

Thank you for your consideration. 

Sincerely, 

Bonnie L. Wallace 

Program Director 

3 
COASTAL HORIZONS CENTER, INC. 
 

"l'r<nnott'.ng cho·ices for healthier lives ancl safer corn'lnuni:ties!1 

lVlargarct Weller-Stargell 

President and CEO 

\Villie StarMell Office Parh 

615 Shipyard Blvd. 

\Vilmington, NC 284.12 

Administration 

(910) 790-0187 

(910) 790-0189 Fnx 

Crisis Line 

Open House 

Rape Crisis Cent0r 

(910) 392-6936 

First Call for Help 

(910) 397-0497 

011tdoor Adventure 

(910) 392-7306 

(910) 392-0(12H Fax 

Outpatient Treatment 

Community Outreaeh 

Prevention 

(910) 343-0145 

(910) 341-5779 Fax 

TASC 

Day Sentencing Center 

I'ost Impac.t Prograrn 

(910) 762-5333 

(910) J,J.1-5783 Fax 

TASC Training Institute 

(910) 202-5500 

GARF - National Con1n1ission Accreditation for Rehabilitative Facilitation 
 

A Contract Service of Southeastern Center for .!VHL'DD & SAS 
 

A United \Vay Partner Agency 
 

Southeastern Network for Youth and Fa1nily Services/Member 
 

The A111erican Association on Suiciclology/JVJen1ber 

Website Address: www.eoa.stalhorizon.s.org Unil::iedway

June 25, 2014 

U.S. Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

RE: Confidentiality of Alcohol & Drug Abuse Patient Records Regulations, 42 

C.F.R. Part 2. 79 Fed.Reg.26929; Docket No. 2014-10913 

To Whom It May Concern: 

Coastal Horizons Center, Inc. has often been characterized as a vital community 

resource for the provision of Substance Abuse and Mental Health services. Such 

acknowledgements stem from knowing the integrity of the organization and the 

dedication ofthe staff. A cornerstone of these services is the adherence to and 

promotion of confidentiality regulations. The protection afforded by the current 

version of 42 C.F.R. Part 2 for the substance abuser is oftentimes the deciding factor 

to seek treatment for addiction. 

While Coastal Horizons Center supports updating the mechanics of the federal 

alcohol and drug confidentiality regulations to facilitate more effective integration of 

care and needed communication in the electronic age, 42 C.F.R. Part 2's core privacy 

protections must be maintained. 

With regard to the modifications to 42 C.F.R. Part 2 proposed in SAMHSA's May 12, 

2014 Notice of Public Listening Session (79 Fed.Reg.26929), Coastal Horizons 

Center, Inc. supports the following principles: 

• 	 Addiction treatment should be integrated with mental and physical health 

care, and communication among health care providers should be encouraged. 

We support maximizing inclusion of substance abuse disorder (SUD) records 

in electronic health record (EHR) systems and health information exchanges 

(HIEs) while maintaining 42 C.F.R. Part 2's core privacy protections. 

• 	 42 C.F.R. Part 2's heightened privacy protections are as critical today as they 

were when they were enacted. A move toward HIP AA's less restrictive 
privacy standards would not sufficiently protect people seeking and receiving 

substance use disorder treatment. If patient records can be easily accessed to 

criminally investigate or prosecute, or deny a patient insurance or a job, or be 

used in a divorce or child custody proceeding, patients might be reluctant to 

enter treatment. 

•		 Patients in alcohol and drug programs should retain the power to decide when 

and to whom their records are disclosed, even for treatment purposes. This 

includes disclosures to the general health care system and HIEs. The 

essential means for patients to retain this power is the requirement of written 

patient authorization for most disclosures in conjunction with a strong 

prohibition on redisclosure of protected health infonnation. 

• It is both necessary and technologically possible to integrate addiction with 

other health care and effectively exchange addiction treatment data while 

maintaining the core protections of 42 C.F.R. Part 2. We urge the continued 

development of technical solutions for consent management. 

		

•		 Since HIP AA requires compliance with state and federal laws that mandate 

greater privacy protections, electronic health record systems must be designed 

to comply with the many state statutes that require heightened protections for 

infonnation related to mental health, HN/AIDS, reproductive health, 

domestic violence and other types of sensitive health information, as well as 

42 C.F.R. Part 2. It is important to understand that EHRs would be required 

to accommodate enhanced protections for the medical records of some 

illnesses to be HIP AA compliant even if 42 C.F.R. Part 2 did not exist. 

Coastal Horizons Center, Inc. also supports the comments submitted by the Legal 

Action Center. 

Thank you for your consideration. 

Sincerely, 

Eric Luttmer 

Vice President of Medical Services & Corporate Compliance 

Privacy Officer 
 

 

 

 

 

 


 


 


 


 


 

 

 

 

 

 

From: Patrice Porter [mailto:pporter@alumni.virginia.edu]
 

Sent: Wednesday, June 25, 2014 3:05 PM
 

To: Privacy Regulations (SAMHSA)
 

Subject: Confidentiality of Alcohol & Drug Abuse Patient Records Regulations, 42 C.F.R. Part 2. 79 Fed.
 

Reg. 26929; Docket No. 2014-10913.,,
 

June 25, 2014 

Virginia Association of Addiction Professionals 

P O Box 25799 

Richmond, Va 23260 

U.S. Substance Abuse and Mental Health Services Administration1 

Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

RE: Confidentiality of Alcohol & Drug Abuse Patient Records Regulations, 42 C.F.R. Part 2. 79 Fed. Reg. 26929; Docket No. 2014­

10913. 

To Whom It May Concern: 

The Virginia Association of Addiction Professionals was formed to promote the advancement of Alcoholism and Drug Counseling through the 

Professional Code of Ethics of the Association, and the adoption of standards of competence which will insure the highest quality of counseling 

treatment to help persons who have problems related to the use of alcohol and/or other drugs. 

While the Virginia Association of Addiction Professionals supports updating the mechanics of the federal alcohol and drug confidentiality 

regulations to facilitate more effective integration of care and needed communication in the electronic age, 42 C.F.R. Part 2’s core privacy 

protections MUST be maintained. 

With regard to the modifications to 42 C.F.R. Part 2 proposed in SAMHSA’s May 12, 2014 Notice of Public Listening Session (79 Fed. Reg. 

26929), the Virginia Association of Addiction Professionals supports the following principles: 

•	 Addiction treatment should be integrated with mental and physical health care, and communication among health care providers 

should be encouraged. We support maximizing inclusion of substance use disorder (SUD) records in electronic health record (EHR) 

systems and health information exchanges (HIEs) while maintaining 42 C.F.R. Part 2’s core privacy protections. 

•	 42 C.F.R. Part 2’s heightened privacy protections are as critical today as they were when they were enacted more than 40 years ago, 

and a move toward HIPAA’s looser privacy standards would not sufficiently protect people seeking and receiving substance use 

disorder treatment. If patient records can be easily accessed in order to criminally investigate or prosecute or patient, or deny them 

insurance or a job, or be used against them in a divorce or child custody proceeding, many patients will be afraid to enter treatment 

in the first place. 
 

 

 

 

 

	 

	 

	 

• LAC continues to believe that patients in alcohol and drug programs should retain the power to decide when and to whom their 

records are disclosed, even for treatment and payment purposes, given the continued prevalence of discrimination in our 

society. This includes disclosures to the general health care system, HIEs, health homes, ACOs, and CCOs. The best way for patients 

to retain that power is by requiring patient consent for most disclosures, together with a strong prohibition on redisclosure. 

•	 It is both necessary and technologically possible to integrate addiction and other health care and effectively exchange addiction 

treatment data while maintaining the core protections of 42 C.F.R. Part 2. We urge the continued development of technical 

solutions for consent management. 

•	 Since HIPAA requires compliance with state and federal laws that mandate greater privacy protections, electronic health record 

systems (EHRs) must be designed so as to comply with the many state statutes that require heightened protections for information 

related to mental health, HIV/AIDS, reproductive health, domestic violence and other types of sensitive health information, as well 

as with 42 C.F.R. Part 2. It is important to keep in mind, therefore, that EHRs would be required to accommodate enhanced 

protections for the medical records of some illnesses in order to be HIPAA-compliant even if 42 C.F.R. Part 2 did not exist. 

We also support the comments submitted by the Legal Action Center. 

Thank you for your consideration. 

Sincerely, 

Patrice Porter 

President, the Virginia Association of Addiction Professionals 
From: Janet Sullivan [mailto:madwomannh@gmail.com]
 

Sent: Monday, June 23, 2014 3:14 PM
 

To: Privacy Regulations (SAMHSA)
 

Subject: 42 C.F.R. Part 2 

42 C.F.R. Part 2's core privacy protections MUST be maintained. While behavioral health care 

should be integrated with physical health care, and communication between health care 

providers should be encouraged, the regulations' protections are as necessary today as they 

were when they were issued in the 1970's in light of ongoing stigma and discrimination faced 

by people with substance use disorders. 

42 C.F.R. Part 2 enables people with substance use disorders to seek treatment without fear of 

exposure of their treatment records - without their permission - to law enforcement, employers, 

insurers, and other health care providers or others. Changes to the regulations would threaten 

these critical patient protections. 

Thank you for your time. 

Sincerely, 

Janet R. Sullivan, LADC 

Grafton, NH 
COMMONWEALTH of VIRGINIA 

David E. Brown, D.C. 

Director 

Department a/Health Professions 

Perimeter Center 

9960 Mayland Drive, Suite 300 

Henrico, Virginia 23233-1463 

MEMORANDUM 

www.dhp.virginia.gov 

TEL (804) 367- 4400 

FAX(804)527-4475 

TO: Substance Abuse and Mental Health Services Administration 

FROM: Ralph A. Orr 

Director 

Virginia's Prescription Monitoring Program 

DATE: June 23, 2014 

RE: Comments to May 12, 2014 Federal Register Notice: 42 CFR Part 2, Confidentiality of 

Alcohol and Drug Abuse Patient Record 

SAMHSA 

FR Docket No. 2014-10913 

g. Addressing Potential Issues With Electronic Prescribing and Prescription Drug Monitoring

Programs (PDMPs)

This paragraph describes the prohibition on the redisclosure of information received directly from a 

Part 2 program, specifically when a pharmacy receives an electronic prescription directly from a Part 

2 

program. This would require a pharmacy to obtain patient consent to send that information to a 

POMP, and would also require the POMP to obtain patient consent to redisclose that information to 

those with access to the POMP. It appears that SAMHSA is considering restricting access to law 

enforcement for records held by the POMP. 

Comment: Prescriptions received by a pharmacy may be electronic, oral, faxed, or paper. In 

each of these scenarios the patient directs where the prescription is to be filled; otherwise there is 

no 

difference. Placing a restriction on electronically prescribed prescriptions adds confusion and 

further restricts the availability of medication history to healthcare professionals, forcing them to 

make 

prescribing and dispensing decisions with incomplete information, placing not only their patients at 

risk but their licenses to practice as well. 

Comment: Prescribers must meet the requirements of a bona fide practitioner-patient 

relationship prior to prescribing. The obtaining of a prescription history report of controlled 

substances from a POMP assists the practitioner (and pharmacist) in meeting the requirements of 

this 

Board of Audiology & SpeechLanguage Pathology Board of Counseling Board of Dentistry Board of Funeral Directors &
relationship leading to more informed treatment ( and dispensing) decisions. The review of a 

prescription history report from a POMP aids in monitoring compliance with treatment plans, 

determining the validity of a prescription, screening for need for intervention, screening for need to 

refer to specialized care, and informing modifications of treatment plans. 

Comment: A POMP has no mechanism to determine if a prescription in its database is an 

electronic prescription, a called-in prescription, a faxed prescription, or a paper prescription. The 

prescription is reported to the PMP because it has been dispensed, it is a covered substance, and no 

exemption or waiver applies. Additionally, a POMP does not know if a patient or the prescriber is 

covered under 42 CFR Part 2. Attempting to comply with this new requirement would require a 

POMP to collect additional information from dispensers about the type of prescription, whether the 

prescriber is covered by Part 2, and more substantial patient information to insure that patient consent 

can be obtained or has been obtained, placing additional burdens on dispensers to identify, collect, 

store, and send this information. This information has very limited value as far as providing healthcare 

to a patient; the actual prescription information is the information needed to make informed treatment 

and dispensing decisions. 

Comment: The primary users of Virginia's Prescription Monitoring Program are prescribers 

and pharmacists, accounting for 99% of all requests in 2013. (See 2013 Annual Statistics at: 

http://www.dhp. virginia. gov Idhp programs/pmp/ docs/ProgramStats/20 13 P MP Stats Final. pdf) 

Authorized users from the Office of the Chief Medical Examiner made O .5 % of requests and the 

remaining 0.5% was spread among Medicaid, federal, state and local law enforcement, regulatory, and 

health practitioner monitoring program ( also known as impaired provider program) users. Virginia has 

seen a dramatic drop in indications of doctor shopping behavior since 2012, and while the number of 

individuals receiving prescriptions continues to increase, the number of doses being received for pain 

relievers, sedatives, and tranquilizers are decreasing. This has primarily occurred because of increased 

use by prescribers and pharmacists; working with stakeholder groups to provide education and training 

on prescribing requirements, pain management best practices, office based addiction treatment, and use 

of PMP; and efforts for appropriate access and use of POMP data to assist law enforcement and 

regulatory investigations. It is important to note that while prescription drug abuse is a major public 

health concern, it is also a major public safety concern. There is, and will continue to be, a place and 

need for law enforcement and regulatory access to PDMP information. This access should not be 

further restricted on a federal level but left to the states. 

Thank you for this opportunity to comment. 

Sincerely, 

Ralph A. Orr 

Director, Virginia's Prescription Monitoring Program 

804-367-4566 

ralph.orr@dhp. virginia. gov 
Faces and Voices of Recovery is pleased to have the opportunity to comment on proposed 

changes to the confidentiality of alcohol and drug abuse patient records, found in the code 

of federal regulations known as 42 CFR Part 2. 

Faces & Voices of Recovery is a national nonprofit organization working to mobilize, 

organize and rally the 23 million Americans in recovery from addiction to alcohol and other 

drugs, their families, friends and allies in a campaign to end discrimination; broaden social 

understanding; and achieve a just response to addiction as a public health crisis. 

Confidentiality of SUD Treatment Records is Essential 

42 CFR Part 2’s privacy protections must continue. While Faces and Voices supports the 

mechanical changes needed to integrate addiction care with medical care and to modernize 

medical records, we believe privacy and confidentiality need not be sacrificed in the name of 

integration and expansion of electronic health records (EHR). 

Based on our conversations with policymakers and software manufacturers, we believe 

there is a solution that provides the necessary updates to facilitate integration and EHRs 

while preserving privacy for individuals so they may enjoy the benefits most Americans take 

for granted: to be able to parent their children without fear of removal, work through marital 

issues without undue legal interference, access essential government programs, and protect 

themselves against catastrophic financial loss through equitable access to health, life and 

disability insurance. 

After surveying out members, we learned that due to improper disclosure of their alcohol 

and drug treatment records, many individuals in or seeking recovery lost access to these 

basic benefits most Americans enjoy. For example: 

	 We spoke to a 29 year old mother who lost her 3 year old in a child custody case 

because, after the unlawful disclosure of her addiction treatment records, she was 

deemed unfit by a judge and her child was put in the custody of child protective 

services. 

	 We met with a bright young lawyer who learned after two weeks at her new job that 

she would be terminated because the fact she was on methadone came up in a 

background check. 

We received numerous cases where individuals were not able to get various types of 

insurance because their treatment records had been re-disclosed. We learned lack of 

access to insurance often changed the trajectory of individuals’ lives: 

	 A small businesswoman had to give up her dream of owning her own business 

because she could not get a health insurance policy for her employees; and 
	 A husband with four children who was in a high risk fisheries job was unable to get 

life insurance to protect his wife and children. 

42 CFR Part 2 Privacy Protections Encourage People to Seek Treatment 

Approximately 10% of those with a diagnosable substance use disorder seek treatment. 

Faces and Voices of Recovery is concerned that if patient records can be accessed easily in 

order to criminally investigate or prosecute a patient, deny them insurance or a job, or be 

used against them in a divorce or child custody proceeding, many patients will be afraid to 

enter into treatment at all. 

Patients Should Decide Who Receives their Medical Records 

Faces and Voices of Recovery believes that patients in alcohol or drug programs should 

retain their power to decide when and to whom their records are disclosed, including to 

health insurance exchanges, health homes and accountable care organizations, even for 

treatment and payment purposes. Given the prevalence of stigma and discrimination in our 

society against those in or seeking recovery from addiction, we think the best way for 

patients to retain that power is by requiring patient consent for most disclosures, including a 

strong prohibition against re-disclosure. 

Conclusion 

Faces and Voices of Recovery believes that we can include substance use disorder records 

in electronic health records and integrate addiction into medical care while maintaining the 

core primary protections guaranteed under 42 CFR Part 2. Without these protections, 

individuals with substance use disorders will continue to face the loss of employment, 

housing, child custody, access to health, life or disability insurance, criminal arrest, 

prosecution and incarceration and a host of other negative consequences. 
 

 

 

 

 

 

 

 

 

 

 

The Substance Abuse and Mental Health Services Administration
 

Public Listening Session Comment Template
 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2 

This document is meant to provide the public with a simple and organized way to submit comments on the 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2, and respond to 

questions presented in meeting notice which is published in the Federal Register at 79 FR 26929. While use of 

this document is entirely voluntary, commenters may find it helpful to organize their comments. 

This document alone is not intended to provide a full and complete opportunity to comment on all of the 

provisions within the regulation. Please keep in mind that it only reflects those topics included in the meeting 

notice and a section for “other” comments. 

To be considered, all comments (including comments provided through this document) must be submitted 

according to the instructions in the meeting 

notice: https://www.federalregister.gov/articles/2014/05/12/2014-10913/confidentiality-of-alcohol-anddrug-abuse-patient-records. 

Applicability of 42 CFR Part 2 

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. Covered information could 

be defined based on what substance abuse treatment services are provided instead of being defined by the type of 

facility providing the services. 

FR Citation: 79 FR 26930 

Questions: 

• How would redefining the applicability of 42 CFR Part 2 impact patients, health care provider organizations, HIEs, 

CCOs, HIT vendors, etc.? 

• Would this change address stakeholder concerns? 

• Would this change raise any new concerns? 

Public Comment Field: 

Page 1 of 4 
 

 

 

 

 

 

 

 

 

 

 

 

 

Consent Requirements 

While technical solutions for managing consent collection are possible, SAMHSA is examining the consent requirements 

in § 2.31 to explore options for facilitating the flow of information within the health care context while ensuring the 

patient is fully informed and the necessary protections are in place. Specifically, we are analyzing the current 

requirements and considering the impact of adapting them to: 

1. Allow the consent to include a more general description of the individual, organization, or health care entity to which 

disclosure is to be made. 

2. Require the patient be provided with a list of providers or organizations that may access their information, and be 

notified regularly of changes to the list. 

3. Require the consent to name the individual or health care entity permitted to make the disclosure. 

4. Require that if the health care entity permitted to make the disclosure is made up of multiple independent units or 

organizations that the unit, organization, or provider releasing substance abuse related information be specifically 

named. 

5. Require that the consent form explicitly describe the substance abuse treatment information that may be disclosed. 

FR Citation: 79 FR 26931 

Questions: 

• Would these changes maintain the privacy protections for patients? 

• Would these changes address the concerns of HIEs, health homes, ACOs, and CCOs? 

• Would these changes raise any new concerns? 

Public Comment Field: 

Redisclosure 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on redisclosure only applies to 

information that would identify an individual as a substance abuser, and allows other health-related information shared 

by the Part 2 program to be redisclosed, if legally permissible. This would allow HIT systems to more easily identify 

information that is subject to the prohibition on redisclosure enabling them to utilize other technological approaches to 

manage redisclosure. If data are associated with information about where the data were collected (data provenance) 

which reveals that the data were collected by a practice that exclusively treats addiction, the data would still be 

protected under the proposed change. 

FR Citation: 79 FR 26931 

Questions: 

• Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 in an EHR or HIE 

environment? 

• Would these changes maintain the privacy protections for patients? 

Public Comment Field: 

Page 2 of 4 
 

 

 

 

 

 

 

 

 

 

 

Medical Emergency 

SAMHSA is considering adapting the medical emergency exception to make it more in-line with the statutory language 

and to give providers more discretion as to when a bona fide emergency exists. For example, amending this standard to 

allow providers to use the medical emergency provision to prevent emergencies or to share information with a 

detoxification center when a patient is unable to provide informed consent due to their level of intoxication. 

FR Citation: 79 FR 26931 

Questions: 

• What factors should providers take into consideration in determining whether a medical emergency exists? 

• Are there specific use cases SAMHSA should take into consideration?Show citation box 

• Are there patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

Qualified Service Organization (QSO) 

SAMHSA is analyzing the regulations to identify options for allowing Part 2 data to flow to health care entities for the 

purpose of care coordination and population management while maintaining patient protections. One potential solution 

includes expanding the definition of a qualified service organization (QSO; § 2.11) to explicitly include care coordination 

services and to allow a QSO Agreement (QSOA) to be executed between an entity that stores Part 2 information, such as 

a payer or an ACO that is not itself a Part 2 program, and a service provider. 

FR Citation: 79 FR 26931 

Questions: 

• Are there other use cases we should be taking into consideration? 

• Are there specific patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

Research 

SAMHSA is considering expanding the authority for releasing data to qualified researchers/research organizations to 

health care entities that receive and store Part 2 data, including third-party payers, health management organizations, 

HIEs, and care coordination organizations. 

FR Citation: 79 FR 26932 

Questions: 

• Are there factors that should be considered related to how current health care entities are organized, how they 

function or how legal duties and responsibilities attach to entities that make up an umbrella organization? 

• Would this change address concerns related to research? 

• Are there specific privacy concerns associated with expanding the authority or releasing data to qualified 

researchers/research organizations in this way? 

• Are there additional use cases that should be considered in the research context? 

Public Comment Field: 

Page 3 of 4 
 

 

 

 

 

 

 

Addressing Potential Issues With Electronic Prescribing and Prescription Drug Monitoring Programs (PDMPs) 

Part 2 protections include a prohibition on the redisclosure of information received directly from a Part 2 program. A 

pharmacy that receives electronic prescription information directly from a Part 2 program must obtain patient consent 

to send that information to a PDMP, and patient consent is also required for the PDMP to redisclose that information to 

those with access to the PDMP. 

Preamble FR Citation: 79 FR 26932 

Questions: 

• How do pharmacy information system vendors anticipate addressing this issue? Are there specific technology 

barriers SAMHSA should take into consideration? 

• Are there other concerns regarding 42 CFR Part 2 and PDMPs? Please describe relevant use cases and provide 

recommendations on how to address the concerns. 

• Are there patient concerns about the impact of e-prescribing and PDMPs on their privacy? 

Public Comment Field: 

Other Comments 

Topic: 

Public Comment Field: We would like to see 42 CFR part 2 stay the same, except we would like to see the restrictions eased 

between healthcare providers and reflect how they are currently defined for meaningful use. 

Page 4 of 4 
1 

COMMONWEALTH OF PENNSYLVANIA 

DEPARTMENT OF DRUG AND ALCOHOL PROGRAMS 

OFFICE OF SECRETARY 

Room 903 Health and Welfare Building J 625 Forster Street J Harrisburg, PA 17120 1717.214.1937 I Fax 717.214.19391 www.ddap.pa.gov 

June 23, 2014 

The Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Rockville, MD 20857 

Room 5-1011 

Docket Number: 2014-10913 

Re: Public comment period on consideration of changes to 42 CFR 

To whom it may concern: 

The Department of Drug and Alcohol Programs of the Commonwealth of Pennsylvania 

would like to thank you for your serious consideration of the value and impact of 42 CFR. We 

understand that there have been some concerns expressed regarding how confidentiality 

protections are a barrier to shared communications, especially in light of the progressive 

movement toward integration of electronic records. 

It is our position that these concerns, rather than justifying a weakening of these critical 

protections, demonstrate a fundamental misunderstanding of the regulation, their necessity for 

effective treatment, and the process of proper disclosures. Therefore we are strongly opposed to 

the proposed changes which would substantially weaken the protections offered to this 

stigmatized field. We believe that the proposed changes would increase the prejudice and 

discrimination of our vulnerable population, and therefore would create further barriers of access 

to treatment in the form of fear that one's personal information will be shared. Based on 

NHSDUH findings, approximately 18% of individuals who want treatment are currently 

avoiding treatment due to the feared negative consequences of stigma and discrimination in the 

workplace and their communities. For this reason we are particularly opposed to the proposed 

changes in the area of research and Qualified Service Organizations, which would directly affect 

these protections. 

We understand that the concerns expressed about confidentiality are based in the medical, 

criminal justice and payer communities who desire increased access to confidential information; 

the solution however is not to repeal the protections but rather to address the clear lack of proper 

education on the effective use of disclosures currently available under the law. For example, 

while criminal justice professionals may want detailed information on the client history, client 
2 

Substance Abuse and Mental Health Services Administration June 23, 2014 

Docket Number: 2014-10913 

consent for the information legitimately needed is easily obtained; there simply is no need to 

include extensive and humiliating details such as that of being the victim of child abuse. 

Similarly, although emergency departments may have need of medical history for emergency 

treatment, there are already exceptions in the law to allow information sharing in the case of 

emergency. Proper training and education on disclosure should resolve these perceived 

concerns. 

We are aware that concerns expressed about confidentiality are being driven by the cost 

and complication of development of Information Technology systems which would need to 

develop consent management systems for protected substance abuse information. However, 

this concern will not be resolved by changing 42 CFR since there are a number of other protected 

classes of information which would require permissions also such as mental health issues, HIV 

and juvenile information. (Please see the attached analysis for addition consideration.) 

The answer is not to compromise the lifesaving provisions of 42 CFR, but rather to 

provide the resources necessary to develop the proper Information Technology systems that will 

support the current landscape of medical, mental health and substance use disorder information. 

Again, thank you for your thoughtful consideration of our views as you consider this 

issue. We appreciate your heroic efforts to champion the rights our struggling citizens who 

struggle in the darkness and shame of substance use disorder, afraid to get help due to fear of 

discrimination should their stories be shared. We strongly urge you to retain the protections 

offered by 42 CFR, by leaving it in its current form. 

Thank you for your consideration. 

Sincerely, 

Gary Tennis

Secretary

Pennsylvania Department of Drug and Alcohol Programs 
42 CFR Statement of Problem: 

42 CFR has come to be seen as a barrier to integration of care, which is no longer necessary. 

This has led to the proposal to repeal or modify 42 CFR. 

Rationale: 

1) 	 With the movement toward integration of the roles of medical, mental health and 

substance abuse professionals, it is asserted that having special confidentiality laws 

creates complications for the development of information sharing in electronic records. 

2) With the implementation of HIPAA, it has been claimed that additional protections of 42 

CFR are no longer needed. 

3) It has been claimed that 42 CFR is in conflict with HIPAA, and therefore confusing for 

professionals to understand. 

Discussion: 

1) 	 Integration and information technology 

a. 	 Detail: Under 42 CFR, in order to have integration of medical records and 

substance abuse records, certain elements of the medical record may not be shared 

without client consent. 

1. In order to do this, there are additional IT development costs: 

1. 	 Development of separate permissions for certain protected 

information; for example, a user's login \viii allow access to 

certain parts of the record but will not allow access to other parts. 

2. 	 Development of electronic process for request for consent; for 

example, when an individual goes to a new clinician, there is an 

electronic process for release of consent and granting permission to 

the new clinician to view the protected records 

b. 	 Response: 

1. 	 While this change requires some additional resources, it is function ofthe 

challenges of integration, not a barrier due to 42 CFR. 

1. 	 There are a wide range of specialized data that will also require 

specialized permissions and consent, including: 

a. 	 Mental health records 

b. 	 HIV records 

c. 	 Juvenile records 

d. 	 Content protected by more restrictive state laws 

2. 	 Repeal of 42 CFR wiH not resolve these parallel issues that are 

present with a range of other laws and protected health information 

3. 	 Extra effort to resolve these issues does not outweigh the benefits 

of the provided protections 

3 
 
c.	‹ Recommendation: 

1.	 Provide appropriate funding for IT development of integrated electronic 

record. 

11.	 Provide confidentiality and stigma training to users to increase 

understanding of the need for. and how to execute, these additional steps. 

2)	/ Protections of 42 CFR in relationship to HIPAA 

a.	‹ Detail: HIP AA and 42 CFR are similar in that they both provide protections for 

health information and include detailed instructions on release of confidentiality, 

as well as specific exceptions where release may be possible without consent (for 

example, emergency, risk of harm etc.) 

b.	‹ Response: 

1.	 There are significant differences with better protections provided by 42 

CFR: 

1. HIP AA allows disclosure without client consent 

a.	‹ By developing a simple business partner relationship. 

HIP AA allows disclosure of client information to a wide 

range of individuals 

2.	‹ Re-disclosures 

a.	‹ HIP AA does not protect against the re-disclosure of 

protected information. So once information has been 

disclosed, it is no longer protected information. 

11.	 These protections are needed due to the continued high stigmatization and 

risk of adverse effects for this population 

1.	‹ Stigma attached to Substance Use Disorder continues to create a 

serious risk of discrimination in employment, insurance coverage, 

legal/criminal decisions. 

c.	‹ Recommendation: 

i.	‹ Maintain the protections afforded by 42 CFR. 

3)	‹Confusion related to differing laws 

a.	‹ Detail: Since there arc differences between 42 CFR and I lfPAA, it can be 

confusing to some professionals to know what is required. 

b.	‹ Response 

1.	 There currently exist hundreds of federal, state, and local laws protecting 

confidentiality, so the removal of 42 CFR does simply does not resolve 

this issue; the appropriate solution is increased training. 

c.	‹ Recommendation: 

1.	 Increase training for professionals to understand the details of 

confidentiality, its rationale and benefits. 

4 
Richard Z. Freemann, Jr., Esq. 

Chairman of the f:Joard 

GAUDEN IA, inc 

Corporate Offices 

1 06 West Main Stwet 

Norristown, flA 19401 

(610) 2.19-9600 

Fax: (61 OJ 239"9195 

Gaudenzia, Inc. 

Michaei Harle, M.H.S. 

Presidenl/Chicf Executive Of(iccr 

Helping people help thernselves since 196H 

Caudenzia is registered as a charitable organization with the Pennsylvania !Jc,partment of State's Bure,11.1 of Charitable Organizations under the Solicitation of 

Funds for Charit-1ble Purposes Act. A copy oi' this official registr,ition cmd financial informal ion may be obtained from the PC'nnsylvaniJ Dt'pari"men! of StJtc by 

cc1lling loll free within 1-'ennsylvaniJ, 1·-H00-732-0999. Rcgisti·ation does no! imply endori;cment. 

June 23, 2014 

Cathy J. Friedman 

SAMHSA, Public Health Analyst 

Substance Abuse & Mental Health Services Administration 

1 Choke Cherry Road 

Rockville, MD 20857 

RE: Docket No. 2014-10913 - Confidentiality of alcohol & Drug Abuse Patient Records, 42 

C.F.R., Part 2, Fed. Reg./Volume 79, No. 91, pages 26929-26932 

Dear Ms. Friedman, 

I am writing you as the Chief Executive Officer of Gaudenzia, Inc. and The Gaudenzia 

Foundation. We are a multi-state Drug & Alcohol Treatment Intervention and Prevention 

Program. We treat over 18,000 individuals and provide services to families and the children of 

our clients. Our Foundation has a separate program that provides Employee Assistance 

Programs for multiple police departments. We, until recently, operated a program for lawyers 

and their families in multiple states. This program has recently included a program for Judges. 

As you can surely recognize, confidentiality is extremely critical to the very existence of these 

programs. Without strong confidentiality laws, these individuals would not use these programs. 

We also provide services to over 1,200 human services workers, many of whom work in the 

substance abuse field. I am very concerned that anything that would possibly weaken these 

necessary laws be enacted. 

Although I understand that many would like them relaxed to make things easier to transfer health 

records etc., I am totally against any changes that would weaken these critical laws. I have read 

the proposal and cannot see any reason why weakening re-disclosure rules would be a good thing 

for peoples' privacy. As an organization that has and does participate in many research projects, 

we have done this quite successfully and would urge you to maintain the existing regulations. 
GAUDENZIA 

As a citizen I am very concerned with the weakening of a federal privacy protection with 

technology moving so fast. We should be strengthening protections vs. weakening them. 

Please recognize that the decision to go to treatment is a difficult one and that disclosure may 

have negative consequences now and in the future. 

Sincerely 

Michael Harle 

Chief Executive Officer 
Richard Z. Freemann, Jr., Esq. 

Chairman of the Board 

GAUDENZIA, INC. EASTERN REGION OFFICE 

130G Spring Garden Street, 5th floor 

Philadelphia, P.\ 10123 

(215) 238-0623 

Fax: (215) 238-0712 

Caudenzia, Inc. 

Michael Harle, M.H.5. 

President/Chief Executive Officer 

Helping people help themsel, es since 1968 

Gaudenzia is rl ·istered as a charitable or1,anization v. ;th the Ptnn, ·I· 111ia Department of State's Bureau of Charitable Organizations under the Sol,citMion of 

Funds for Charit;ble Puqx,se; Act. A cop, oi this official regi,tration and iinanci,11 inform1tion ma, be obtained from the Penns,han,a D, nartnwnt 01 State b•, 

c.1llini toll frfe within Penns. lvania, 1 ·800-732-0999. Re6

istration does not irrpli' rndorsement. 

June 25, 2014 

Cathy J. Friedman 

SAMHSA, Public Health Analyst 

Substance Abuse & Mental Health Services Administration 1 Choke Cherry Road 

Rockville, MD 20857 

RE: Docket No. 2014-10913- Confidentiality of alcohol & Drug Abuse Patient Records, 42 

C.F.R., Part 2, Fed. Reg./Volume 79, No. 91, pages 26929-26932

Dear Ms. Friedman, 

I am writing you as the Division Director of Together House Co-Occurring Programs at 

Gaudenzia, Inc. We are a multi-state Drug & Alcohol Treatment Intervention and Prevention 

Program. We treat over 18,000 individuals and provide services to families and the children of 

our clients. Confidentiality is extremely critical to the very existence of these programs. Without 

strong confidentiality laws, these individuals would not use substance abuse treatment programs. I 

am very concerned that anything that would possibly weaken these necessary laws be enacted. 

Although I understand that many would like the confidentiality laws changed to make things easier to 

transfer health records etc., however I am against any changes that would weaken these critical laws. 

I have read the proposal and do not see any reason why changing re-disclosure rules would be a good 

thing for program participants' privacy. As an organization that has and does participate in many 

research projects, we have done this quite successfully and would urge you to maintain the existing 

regulations. 

As a resident of this community I am very concerned with the weakening of a federal privacy 

protection. We should be strengthening safeguards as opposed to weakening them. 

Please recognize that the decision to go to substance abuse services is a difficult one and that 

disclosure may have negative consequences because of the trust issues of those we serve. 

Thank you in advance for listening to my concerns as a provider of services, 

Warre 

Division Director of Together House Co-Occurring Programs 
 

 

 

 

 

 

 

 

 

June 26, 2014 

Cathy J. Friedman 

SAMHSA, Public Health Analyst 

Substance Abuse & Mental Health Services Administration 

1 Chock Cherry Road 

Rockville, MD 20857 

Via email: PrivacyRegulations@SAMHSA.hhs.gov 

RE: Docket No. 2014-10913 – Confidentiality of Alcohol & Drug Abuse Patient Records, 42 C.F.R., Part 2, 

Fed. Reg./Volume 79, No. 91, pages 26929-26032 

Dear Ms. Friedman, 

I am writing the letter to have on record that I am against the proposed changes in the Confidentiality of 

Alcohol & Drug Abuse Patient Records, 42 C.F.R., Part 2, Fed. Reg/Volume 79, No.91, pages 26929-

26932. 

Confidentiality protection allows individuals to seek substance abuse treatment without the fear of their 

anonymity being exposed. We must assure that our health care policy and systems continue to meet 

the needs of our clients within a safe confidential environment. I wholeheartedly am against the 

proposed changes. 

As professional in the field of substance abuse for the past 35 years I am concerned that any changes 

that will deteriorate the confidentiality laws will greatly impact individuals seeking treatment affect the 

lives of millions of substance abusers. 

Respectfully, 

Christine Abdur Rhaim 

Gaudenzia Eastern Region 

Eastern Region Women & Children’s, Division Director 
 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Cathy J. Friedman 

SAMHSA, Public Health Analyst 

Substance Abuse & Mental Health Services Administration 

1 Chock Cherry Road 

Rockville, MD 20857 

Via email: PrivacyRegulations@SAMHSA.hhs.gov 

RE: Docket No. 2014-10913 – Confidentiality of Alcohol & Drug Abuse Patient Records, 42 C.F.R., Part 2, 

Fed. Reg./Volume 79, No. 91, pages 26929-26032 

Dear Ms. Friedman, 

I am writing the letter to have on record that I am against the proposed changes in the Confidentiality of 

Alcohol & Drug Abuse Patient Records, 42 C.F.R., Part 2, Fed. Reg/Volume 79, No.91, pages 26929-

26932. 

Confidentiality protection allows individuals to seek substance abuse treatment without the fear of their 

anonymity being exposed. We must assure that our health care policy and systems continue to meet 

the needs of our clients within a safe confidential environment. 

As professional in the field of substance abuse for the past 40 years I am concerned that any changes 

that will deteriorate the confidentiality laws will greatly impact individuals seeking treatment and affect 

the lives of millions of substance abusers. 

Respectfully, 

Dr. Julia Monaco, MSPH, MS 

Gaudenzia Eastern Region 

Compliance Director 
- - ~ ---

IMPORTANT: This facsimile transmission contains confidential information, some or all of which 

may be protected health information as defined by the federal Health Insurance Portability & 

Accountability Act (HIPAA) Privacy Rule. This transmission Is Intended for the exclusive use of 

the Individual or entity to whom ft is addressed ,aind may contain information that is proprietary, 

privileged, confidential and/or exempt from disclosure under applicable law. If you are not the 

Intended recipient (or an employee or agent responsible for delivering this facsimile 

transmission to the intended recipient), you are hereby notified that any disclosure, 

dissemination, distribution or copying of this information Is strictly prohibited and may be 

subject to legal restriction or sanction. Please notify the sender by telephone (number listed 

above) to arrange the return or destruction of the information and all copies. Permission to use 

or disclose this information has been granted either by law or the patient. Further use or 

disclosure without additional patient authorization or as otherwise permitted by law Is 

prohibited. Use or release of any Information contained In this document can and will be 

prosecuted under HIPAA (Health Insurance Portability and Accountability Act of 1996) 

guidelines. 

06/24/2014 15:44 #579 P.001/002

GAUVENZIA1 INC. 

CcNt'RAL 'REGION OFFICE 

2 9 30 'DBYry St:Y0 

1larvWOU,Yg,, PfN' 17111 

717-238-4200 1

fw,u.· 717-238-9206 

fAX TRANSMISSION CC!JVE'R SffEET 
' 

06/24/2014 15:44 #579 P.002/002 From: 

CONFIDENTIALITY OF ALCOHOL AND DRUG ABUSE PATIENT RECORDS, 

42CFRPART2 

Applicability 

The Confid-. entiality Regulations were established to protect the rights of individuals 

seeking addiction treatment services. For the past 37 years ofmy career in the Drug and 

A1cohol field, I have become convinced that these rights need to be protected. Addiction 

is an illness that has an attached stigma; one that only further marginalizes the most 

vulnerable of our society. 

Confidentiality opens an avenue for people to seek treatment knowing ,, that their ... diagnosis 

and what they reveal and discover during the treatment process will be protected. 

Removing any of the existing confidentiality laws will certainly drive individuals away 

from services; not the opposite. 

Consent Requirements 

Consents must be maintained with no changes made. A patient should never have to give ., a general consent; essentially signing away their rights to the computerized, mechanized 

world. Once the information has been digitized, it can never be removed. This is 

victimization by default. 

Redisclosure 

Redisclosure should never be permitted. One sole consent for one sole entity and never 

redisclosure. 

QSO 

The individual patient's rights should never be negotiated away for the benefit of the 

insurance industry, third-party payers, HMO's or care coordinators. 

Research 

No. Never. 

Paula Ruane 
Amertcan Association for the Treatment of Opioid Dependence. Inc. 

Board or Directorc; 

\l,,rh W. Parrino \I P. \ . 

P1csidu11 

Janke I~ Kauffman. R.N .• 1\1.P.II 

hrs1 \ '1rt' P1c,1tln11 

I\tassach uscu s 

George f. ',1a, ro~. \I . D. 

~ru111tl I '1«· P11·,1tl!'JII 

Arizona 

\lichacl Ri=zi 

T,f(l\llJt'I 

Rhode hland 

Jennilt·r i\lin1horn, l\li\ 
 

\f{)fltll\' 


'E'KJ'anding .91.ccess to Quality Opioid .91.tfcfiction 'Treatment Services s ince 1984 

225 Varick Street, 4th Floor • New York, NY 10014 • Phone: (212) 566-5555 • Fax: (212) 366-4647 

E-mail: info@aatod.org • www.aatod.org 

June 23, 2014 

Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

Re: Docket# 2014-10913 

To Whom It May Concern: 

1 am writing on behalf of the American Association for the Treatment of Opioid 

Dependence, which represents more than 950 Opioid Treatment Programs in the 

United States through 30 state member association chapters and individual 

programs in non-member states. We are specifically writing with regard to the 

above-referenced docket concerning recommended changes/modifications to 42 

CFR Part 2 Confidentiality Protections. 

We participated in the SAMHSA "Listening Session" ofJune 11 , 2014. Some of 

the comments that follow reflect a number of topics, which were raised during 

the listening session. We understand that the confidentiality protections were put 

in place more than 40 years ago and could not have anticipated changes in 

electronic record keeping, Health Care Reform, or the increased abuse of 

prescription opioids which would lead to the use of Prescription Monitoring 

Programs. We also understand the arguments that were put forward, indicating 

that the confidentiality protections need to be reevaluated in light of these new 

policy initiatives and the interest ofintegrating the medical care for patients who 

receive treatment for their substance use. 

Maine 


Board Mcmhcrc, 


Alahama 


~n1,.111 C;1,e \1.',, 


California 

Ja,on i-k11.-r. Ph.D. 

Colorado 

I ina lk,·klc). \I..\. 

Conncc1int1 

Paul l\lcl a11ghl111. \I.,\ . 

I lorida 

(, Inti,, llan.1111a I II IC 

Georgia 

",tat'C\ l'C,llU' 

lllinoh 

ls.;11c \lahone), I l '> \\ 

lndia1rn 

Iim Buhmau 

l.oui,i,111:1 

Ro)t' I Bn1wn, 1\1 ",, 

l\laryland 

K,·n111·th '>wlkr \I I). 

Mn:ico 

hnili.1 r,gm'""' C,udkn. \I.D. 

l\lkhigan 

Bn.in l\k( :11 rnll ~I.'.'>. D.(), 

Mi\so11ri 

U,nvl (,anlm,·, I ( ',\\ 

Nevada 

'>hirkv Lin=)· R'- ~I', 

New Jcr,t·y 

I d".irdJ. 1111-:,~11". \I.\ 

Ne" York 

ll<'nl) \1. Bardell 

onh Carolin:, 

1'.cnny I lou~t, I < •\ ', 

Ohio 

Kc11h llmh,ulcl, \LI ti 

Oklahoma 

\1111 ja11111'SOl1, ( \I)( 

Pennsylvania 

Ril'h.ird l'r,mdllo. L( I)<; 

South Carolina 

\\, Jon," l oah\\ 1111h. \I\ 

Tcnncs~1·c 

Drhh,c ( m" It•, 

Utah

Stigma 

Unfortunately, we are still living in a society that actively stigmatizes people 

with substance use disorders, especially those with opioid addiction. The 

confidentiality regulations, while written 40 years ago, understood this reality. 

We agree with the perspective of the Legal Action Center that "people with 

substance use disorders still face loss of employment, housing, child custody; 

insurance and health care discrimination; criminal arrest, prosecution, and 

incarceration; and a host of other negative consequences." This reality is 

reflected in many reports, which we continue to receive from Opioid Treatment 

Programs throughout the United States and through concerns expressed by 

patient advocates. 

Employment Discrimination Joel I.. ~lill.trd l) ',,\\ 

Virginia

l1h, .ird \. l )hlingc1 

Wa~lu ngton, DC 

Bnan Cn,,man 

Washington 

Ron Jack.on. \I',\\ 

Members-at-Large 

Richard Bilang1, \I.S. 

Studies that AA TOD has been involved in since 2005 (RADARSTM System as 

managed by the Denver Health and Hospital Authority) have indicated that 

1 

AATOD/1:UROPAD • fou11lling Organi::ing Pm·mers t1{ thr World frdfrnlionfor llw frec11m cn1 of Of'ioid Dcpewlc11r'c. 
approximately 41% of patients in OTPs are employed. Many of these patients 

actively discuss with OTP counselors whether they should inform their 

employers about their involvement with methadone maintenance treatment. This 

continues to be a sensitive topic since many patients are of the judgment that 

informing their employers of their involvement with methadone treatment will 

have negative consequences and potentially result in the loss oftheir job. 

Criminal Justice 

The Criminal Justice System has not had a favorable view in understanding why 

patients continue to receive maintenance treatment for opioid addiction whether 

it is the use of methadone or buprenorphine. Very few correctional facilities 

provide continued access to these medications although recent policy initiatives 

and published reports are intent on changing this reality. Patients who are 

maintained on methadone and buprenorphine are frequently told by judges in 

various jurisdictions that they cannot continue to receive their maintenance 

treatment if they want to recover custody of their children (Family Court) or 

face jail time if they continue their treatment in various Drug Courts. Once 

again, this reality depends on the particular jurisdiction but this is a widespread 

practice at the present time. This condition does not exist in the treatment of any 

other chronic disease in the U.S. where medications are used to treat the patient 

effectively and to preserve continued health. 

Pregnancy 

Another important topic came to surface during the listening session and that 

involves the protections that pregnant women require when they are receiving 

methadone or buprenorphine maintenance treatment. Tennessee has recently 

passed legislation which could endanger the continuity of such patients in 

treatment depending on who is making the determination. While the intent ofthe 

Tennessee legislation is allegedly not to end the treatment for such people in 

maintenance care, it could be used that way by various parts of the Criminal 

Justice system. Many pregnant methadone maintained women are extremely 

fearful of having anyone know oftheir involvement in treatment, including other 

medical professionals and other family members. They have reason for such fear 

when speaking with representatives from Child Protective Services in different 

states and Family Court Judges. 

Medical Professionals 

We also agree with the correspondence which the National Alliance for 

Medication Assisted Recovery submitted on June 9, 2014. "Medical 

professionals do not get their information about methadone treatment in medical 

schools or from the scientific literature. Rather it comes from the media and they 

believe the myths and misunderstandings about methadone treatment and opioid 

addiction." This is why many patients are apprehensive about disclosing their 

2 
involvement in treatment to medical professionals. We have been advised by 

many of the patients who are treated in OTPs about the change in attitude 

demonstrated by medical professionals once they disclose that they are involved 

in opioid treatment programs. This includes misunderstandings about how 

patients should get access to pain management medications when there is a 

legitimate need to provide analgesic relief for chronic pain. 

NAMA Recovery makes an extremely important point in the aforementioned 

correspondence. "Until the medical professional is educated about methadone 

and addiction, methadone patients need the right to first develop a relationship 

with the physician or medical professional before they tell them they are a 

methadone patient in addiction treatment." The Legal Action Center has made 

this point in their public comments and we support the premise. "The Legal 

Action Center continues to believe that patients in alcohol and drug programs 

should retain the power to decide when and to whom their records are disclosed, 

even for treatment and payment purposes, given the continued prevalence of 

discrimination in our society. This includes disclosures to the general health care 

system, HIEs, health homes, ACOs, and CCOs. The best way for patients to 

retain that power is by requiring patient consent for most disclosures, together 

with a strong prohibition on re-disclosure". 

HIPAA Protections 

We listened with interest to the comments that were made by a number of 

parties during the SAMHSA June 11 , 2014 listening session. A number of 

representatives who presented are of the judgment that the protections afforded 

to patients under HIP AA are sufficient. In our judgment, such individuals have 

not carefully read the confidentiality protections with regard to prohibition on 

re-disclosure. If they had, they could not arrive at the conclusion that HIP AA 

protections are equally strong. The patient needs to be in control of who knows 

about their treatment, which is the point that has also been made by NAMA 

Recovery and the Legal Action Center. 

It is also important to point out that one of the speakers at the listening session 

indicated that we should pay attention to the ultimate consumers of this 

treatment system. NAMA Recovery is the preeminent patient advocacy group in 

the United States with regard to the use of medications for opioid addiction 

treatment. Their correspondence has already been referenced in this 

communication and AATOD supports their point of view. Many administrators 

and clinicians, who work in OTPs, understand that we are simply custodians of 

the individual patient's care. It is the patient who takes on the risk of entering 

and remaining in treatment. Research has proven repeatedly that such patients 

benefit from ongoing care as long as they achieve therapeutic outcomes. This 

was certainly the cornerstone ofthe SAMHSA Treatment Improvement Protocol 

#43, "Medication Assisted Treatment for Opioid Addiction in Opioid Treatment 

Programs". While patients continue to get benefit from remaining in treatment, 

3 
they still take on the risk of discrimination if that treatment is improperly 

disclosed to other parties. 

Preserving Core Protections 

We also agree with the Legal Action Center perspective in updating the 

mechanics of the federal Alcohol and Drug Abuse Confidentiality Regulations 

to facilitate better integration of care and communication in an age of electronic 

health care records. We also support the Legal Action Center's position that the 

"core privacy protections must be maintained". If not, we believe that there will 

be tragic consequences with regard to admitting people to treatment programs 

and for stable patients to continue their treatment. NAMA Recovery makes this 

point succinctly in their submitted comments. "First and foremost is the fact that 

prospective patients will be wary to seek treatment if they know that this 

knowledge will be disseminated, and through that distribution possibly become 

known by friends, family, employers, insurers, and other providers of medical 

services to them". The patients who participate in NAMA Recovery know all 

too well about the stigma and discrimination that they routinely suffer 

throughout their treatment experience. It is not a policy question for them, or a 

philosophical point. It is a bedrock reality that shapes what they disclose to 

medical professionals, and what they disclose to their closest family members. 

While we have made strides in developing electronic records and in an interest 

in ensuring that patients get the most comprehensive and coordinated care 

possible, the reality of stigma persists in the society towards opioid addiction 

and people entering such treatment. 

Prescription Opioid Abuse 

We are in an age where prescription opioid abuse has increased the need for 

treatment interventions including methadone and buprenorphine maintenance in 

addition to the more recently approved medication, NaltrexoneNivitrol. All 

three federally approved medications need to be used throughout the nation as 

we provide increased access to care for the millions of Americans who need 

such treatment interventions, both in the general health care setting and in the 

Criminal Justice setting. We also know that providing access to such services 

and reimbursing such services continues to be a major struggle. 

Most states have now adopted the use of Prescription Monitoring Programs in 

order to better track who is getting access to prescription opioids and other 

psychoactive substances. AA TOD has supported the expansion of PMPs and 

have encouraged our members to access data from such programs in order to 

provide more therapeutic care for our patients. We have also discouraged all 

OTPs from disclosing confidential patient information into PMPs. This issue 

was raised during the June 11 , 2014 listening session. A representative indicated 

that 18 PMPs provide data access to enforcement organizations. In some cases, 

the PMP is under the direct aegis of a state narcotic enforcement agency. One 

4 
such agency informed AA TOD that they wanted access to confidential patient 

data for individuals participating in OTPs so they could cross match such data 

against outstanding warrants. This is clearly not the purpose of establishing 

PMPs and indicates what can happen if patient information is disclosed. 

Summary 

In summary, we are urging the Substance Abuse and Mental Health Services 

Administration to exercise every caution in redrafting the protections afforded to 

patients in substance abuse treatment as it relates to current political and policy 

initiatives. While our society has moved to a greater degree in understanding the 

value of treating addiction, there is still major stigma concerning the use of 

medications to treat opioid addiction. This point cannot be emphasized enough. 

We are of the judgment that any loosening of the privacy standards afforded to 

patients under 42 CFR Part 2 will have terrible consequences on patients' 

interest in seeking care for their addiction and in their interest in remaining in 

treatment. 

The decision to enter and remain in treatment is a deeply personal challenge to 

each and every patient. They struggle with the public perceptions of why they 

decide to enter treatment and why they decide to remain in treatment. We must 

do everything we can to assist them in their decision to enter and remain in care, 

and in preserving the core elements of the existing confidentiality protections. 

Thank you for taking these comments into account. 

Sincerely yours, 

Mark W. Parrino 

President 

062314wm 

5 
 

 

 

 

 

 

 

From: Hickey, Scott [mailto:Scott.Hickey@mhmraharris.org]
 

Sent: Wednesday, June 25, 2014 3:15 PM
 

To: Privacy Regulations (SAMHSA)
 

Subject: 42CFR Part 2
 

While I appreciate the special need to maintain confidentiality in order to encourage people to 

voluntarily engage in substance abuse treatment, the current laws are dated and prove to be an 

impediment to the proper and appropriate sharing of data for coordinating clinical care. The 42CFR 

restrictions are more severe than the already conservative laws concerning mental health treatment 

information. Please consider easing 42CFR to bring it in line with mental health –related privacy laws. 

Thanks, Scott Hickey 

“What gets measured gets done.” – Attributed to several sources 

“Research is formalized curiosity. It is poking and prying with a purpose.” Zora Neale Hurston 

“I wanted to be the first person on the planet to know something before anyone else,” James Allison, 

celebrated Cancer Immunologist 

J. Scott Hickey, Ph.D. 

Director, Outcomes Management 

MHMHRA of Harris County 

7011 Southwest Freeway 

Houston, Texas 77074 

(713) 970-7131 Office 

(832) 969-6663 Mobile 

scott.hickey@mhmraharris.org 
Ms. Pamela Hyde June 23, 2014 

Administrator 

Substance Abuse and Mental Health Services Administration 

1 Coke Cherry Road 

Rockville, MD 20857 

RE: Comments on SAMHSA Public Listening Session on Confidentiality of Alcohol and Drug Abuse Patient 

Records (Document Citation:79 FR 26929Page:26929 -26932 (4 pages) CFR:42 CFR 2Document 

Number:2014-10913) 

Dear Ms. Hyde: 

I appreciate the opportunity to comment on the privacy requirements for substance abuse health 

information (42 CFR Part 2). The SAMHSA questions are in regular font and comments offered are in 

italics. 

a. Applicability of 42 CFR Part 2 

42 CFR Part 2 currently applies to federally funded individuals or entities that "hold themselves out as 

providing, and provide, alcohol or drug abuse diagnosis, treatment or treatment referral" including units 

within a general medical facility that hold themselves out as providing diagnosis, treatment or treatment 

referral(§ 2.11 Definitions, Program). The U.S. health care system is changing and more substance abuse 

treatment is occurring in general health care and integrated care settings which are typically not 

covered under the current regulations. It has also posed difficulties for identifying which providers are 

covered by Part 2; whether a provider or organization is covered by Part 2 can change depending on 

whether they advertise their substance abuse treatment services (i.e. 'hold themselves out'), which can 

change over time. 

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. Covered 

information could be defined based on what substance abuse treatment services are provided instead of 

being defined by the type of facility providing the services. For example, the regulations could be applied 

to any federally assisted health care provider that provides a patient with specialty substance abuse 

treatment services. In this scenario, providers would not be covered if they provided only substance 

abuse screening, brief intervention, or other similar pre-treatment substance abuse services 

How would redefining the applicability of 42 CFR Part 2 impact patients, health care provider 

organizations, HIEs, CCOs, HIT vendors, etc.? 

First 42 CFR Part 2 should be repealed in its entirety or alternatively defined in a way that it is 

operationally identical to the requirements of HIPAA. Any health information privacy requirements 
related to substance abuse treatment that differ from the privacy requirements related to general 

medical care will always be a barrier to increasing access to substance abuse services, and integrating 

substance abuse services with the rest of healthcare, and from providing high-quality substance abuse in 

general medical care treatment services. Having separate health information privacy requirements for 

substance abuse treatment makes it much less likely that persons with substance abuse disorders will 

receive the additional attention and time to support continuing remission and identify early recurrence 

that is routinely provided persons with other chronic medical conditions. When healthcare providers 

know a person's had a chronic healthcare condition they inquire about it and look more closely for signs 

that the person remains healthy in that aspect. Keeping the condition secret deprives the person with a 

substance abuse disorder of the additional care and treatment that they would deserve and receive had 

they any other chronic condition. The risk ofADE increases if access to medication history is restricted. 

The healthcare system spends an amount equal to the cost the medications themselves due to the 

associated ADEs. If access to a group of meds is restricted then those are unknown risks in drug regimen 

review. We also know that the increase ofADE increases linearly with the increase in the number of 

unique medications in the patient's drug regimen. 

One of the largest drivers of hospital readmission is due to inappropriate or reconciled drug regimens. If 

additional restrictions were placed on medication history the ability to support coordinated care will 

further diminish. 

In addition, specialty substance abuse individual treatment providers and organizations are arguably the 

most underfunded and undercapitalized providers in the healthcare system. The special requirements of 

42 CFR Part 2 imposes significant additional administrative burdens and costs on the providers least able 

to bear them. Further, having separate health information privacy requirements for substance abuse 

treatment is discriminatory and perpetuates stigma, keeping persons with substance abuse disorders 

and the providers who treat them marginalized and disadvantaged compared to other patients and 

providers in the healthcare system. Separate is never equal. 

If SAMHSA determines that it cannot recommend treating substance abuse treatment information in a 

manner identical to other healthcare information, the following changes would be helpful. 

1} The regulation should be limited to substance abuse specialty treatment and not include 

screening, diagnosis, or referral. Including screening, diagnosis, and referrals creates 

negative incentives for healthcare providers who are not specialty substance abuse 

treatment providers from inquiring about substance abuse. Including screening, diagnosis, 

and referrals dis-incentivizes organizations from implementing substance abuse screening. 

Excluding healthcare information derived from screening, diagnosis, and referrals adds 

significant analytic complications and costs for integrating with health information 

exchanges. 

2) The regulation should be limited to substance abuse specialty treatment programs and 

providers who are specifically licensed, credentialed, or accredited by generally recognized 
state and national bodies. It should not apply to programs and individual treatment 

providers who have no specialty license, credential, or accreditation specific to specialty 

substance abuse treatment. This would more clearly define what providers can be 

considered covered entities. It would assure the protected status is only attached to 

programs and providers that meet the specific quality standards required for specialty 

license, credential, or accreditation. It is not appropriate to consider a service to be specialty 

substance abuse treatment unless it is being performed by a provider organization with a 

specialty credentials. 

3} It would make it easier to attach providers designated as SA treatment specialists to the 

covered health information they generate if it can be tracked with their provider billing and 

NP/ numbers. 

4) 	 The regulation should not apply to individual certified or licensed specialty substance abuse 

treatment providers who are practicing within a larger organization unless the larger 

organization is also accredited, certified, or licensed as a specialty treatment provider. 

Requiring any healthcare organizations that hires an individual employee with specialty 

substance abuse treatment credentials to be considered a covered entity is a substantial 

disincentive for general healthcare organizations to integrate substance abuse treatment 

services into their predominant treatment operations and significantly restricts integration 

of substance abuse treatment with general healthcare. 

5) 	 The regulation should continue to limit covered entity status only to organizations and 

individuals that hold themselves out to the public as being substance abuse specialty 

treatment providers. This provision gives providers and organizations some control over 

whether they are considered a covered entity. It allows organizations and individual 

providers to offer specialty substance abuse treatment internally to their patients without 

having to bear the decrease quality of clinical care and increased administrative costs and 

burdens of42 CFR Part 2. 

If this provision is deleted, the requirement that substance abuse treatment information 

requires additional protection even when not advertised should not be applied retroactively. 

This will allow organizations the opportunity to eliminate their specialty substance abuse 

treatment services in order to avoid having to reengineer their consent procedures and 

connections to health information exchanges. 

6} 	 The regulation should be amended so that the special protections of the regulations only 

apply to treatment that occur either after the date the entity begins holding itself out to the 

public as a specialty substance abuse treatment facility and should not apply if it has been 

more than one year since the organization or provider holds out to the public that it is 

providing substance abuse treatment. This would allow a simpler date certain method of 

segmenting when the special requirements need to be applied to information being shared 

for coordination of care. 

Would this change address stakeholder concerns? 
With regard to repeal of 42 CFR Part Two persons with a history ofspecialized substance abuse 

treatment who fear discrimination and value their reputations more than they value reducing the health 

risks and increased costs to themselves and others may object. 

Would this change raise any new concerns? 

The SAMHSA proposed changes would reduce the quality of care, the ability to coordinate care, and the 

ability to reduce cost 

b. Consent Requirements 

SAMHSA has heard a number of concerns from individuals and stakeholders regarding the current 

consent requirements of 42 CFR Part 2. 42 CFR 2.31 requires the written consent to include the name or 

title of the individual or the name of the organization to which the disclosure is to be made. This is 

commonly referred to as the "To Whom" consent requirement. Some stakeholders have reported that 

this requirement makes it difficult to include programs covered by 42 CFR Part 2 in HIEs, health homes, 

ACOs and CCOs. These organizations have a large and growing number of member providers and they 

generally do not have sophisticated consent management capabilities. Currently, a Part 2 compliant 

consent cannot include future un-named providers which requires the collection of updated consent 

forms whenever new providers join these organizations. As a result, many of these organizations are 

currently not including substance abuse treatment information in their systems. 

While technical solutions for managing consent collection are possible, SAMHSA is examining the 

consent requirements in § 2.31 to explore options for facilitating the flow of information within the 

health care context while ensuring the patient is fully informed and the necessary protections are in 

place. Specifically, we are analyzing the current requirements and considering the impact of adapting 

them to: 

1. Allow the consent to include a more general description of the individual, organization, or health care 

entity to which disclosure is to be made. 

This would be an extremely helpful change to the regulation, particularly ifit were permitted for the 

patient to consent to a template statement that he or she is consenting to the healthcare information 

covered by the regulation being handled in a manner consistent with the privacy protections of the 

Health Insurance Portability and Accountability Act (HIPAA}. The requirement ofseparate specific 

consent would remain a substantial obstacle as described above . . It would be helpful if identifying the 

statewide HIE {MHC} as the organization to which disclosure is made would be acceptable rather than 

the individual HIE participants. Payers such as Medicaid or State Mental Health authorities involved in 

care management would want treatment, payment, and operations as defined by HIPAA to be allowable 

data uses covered by the consent. If it is not possible to get we cannot get treatment, payment, and 

operations as defined by HIPAA to be allowable data uses then at least allow treatment, case 

management, and coordination or care. 
2. Require the patient be provided with a list of providers or organizations that may access their 

information, and be notified regularly of changes to the list. 

This would be entirely unworkable and assure that information about substance abuse treatment 

covered by the regulation was almost never shared on HIEs, in urban areas with many providers, or for 

persons with multiple medical conditions who see multiple providers. Lists ofspecified providers would 

likely go on for many pages and change frequently, so that the lists would have to be constantly revised 

and notification of changes continually provided. The only way this is workable is if patients can be 

referred to web sites that are regularly updated with the list of HIE participants and providers. Some 

oversight organization would have to be sanctioned and resourced to maintain updated lists. 

3. Require the consent to name the individual or health care entity permitted to make the disclosure. 

This would not be workable for a Health Information Exchange (HIE}, because the consent would be 

captured by the entity currently providing treatment, but that entity would be requesting the other HIE 

participants that have treated the patient in the past disclose their substance abuse and treatment data. 

Those other entities could only do so if they had previously captured consent from the patient with their 

entity named to make the disclosure. For use outside a HIE this would ensure that information about 

substance abuse treatment covered by the regulation was shared significantly less often than it is now. If 

the requirement is that an individual provider be named, the medical records department would 

constantly have to crosscheck whether that provider is still employed by the organization. If the consent 

names the organization, any merger or acquisition would void all prior consent. Adding an additional 

requirement that health information related to specialized substance abuse treatment be handled in a 

different manner than under the privacy provisions of HIPAA would create greater obstacles for providers 

and patients. 

4. Require that if the health care entity permitted to make the disclosure is made up of multiple 

independent units or organizations that the unit, organization, or provider releasing substance abuse 

related information be specifically named. 

This would ensure that information about specialized substance abuse treatment is never shared in 

organizations with multiple independent units. Such organizations often use the same EMR and most, if 

not all, EMRs lack the functionality to segregate information that can and cannot be shared within the 

EMR. Where organizations with multiple units have separate EMRs, they still extensively exchange and 

aggregate data for purposes of treatment, payment, and operations; this requirement would create a 

substantial disincentive for those organizations to offer specialized substance abuse treatment. Any 

change to the regulation that creates additional standards that differ from HIPPA would create more 

obstacles that disadvantage specialized substance abuse treatment patients and providers. This would 

create additional complexities in the HIE systems if the consent forms used by various healthcare entities 

do not include the same substance abuse treatment data. This would also create confusion for users of 

data obtained through the HIE if the included information varies by healthcare entity. 

5. Require that the consent form explicitly describe the substance abuse treatment information that 

may be disclosed. 
This would ensure the information about specialized substance use treatment is shared much less often 

than it already is. Since many patients continue to receive treatment over time the consent would have 

to be continuously updated to reflect the treatment received. There would be confusion about how 

detailed, and specific the descriptions of treatment would have to be. Any change to the regulation that 

creates further requirements that differ from the privacy provisions of HIPAA creates more obstacles that 

disadvantage specialized substance abuse treatment patients and providers. 

SAMHSA welcomes comments on patient privacy concerns as well as the anticipated impact of the 

consent requirements on integration of substance abuse treatment data into HI Es, health homes, ACOs, 

and CCOs. 

Any health information privacy requirements related to substance abuse treatment that differ from the 

privacy requirements related to general medical care will always be a barrier to increasing access to 

substance abuse services and the integration ofsubstance abuse services with the rest of healthcare, as 

well as a barrier to providing high-quality substance abuse in general medical care treatment services. 

Having separate health information privacy requirements for substance abuse treatment makes it much 

less likely that persons with substance abuse disorders will receive the additional attention and time 

required to support continuing remission and identifying early recurrence that is routinely provided for 

persons with other chronic medical conditions. Healthcare providers that know a person has had a 

chronic healthcare condition will inquire about it and look more closely for signs that the person remains 

healthy. Keeping the condition secret deprives the person with a substance abuse disorder of the 

additional care and treatment they would deserve and receive had they any other chronic condition. 

In addition, specialty substance abuse individual treatment providers and organizations are arguably the 

most underfunded and undercapitalized providers in the healthcare system. The special requirements of 

42 CFR Part 2 impose significant additional administrative burdens and costs on the providers least able 

to bear them. Further, having separate health information privacy requirements for substance abuse 

treatment is discriminatory and perpetuates stigma ,keeping persons with substance abuse disorders 

and the providers who treat them marginalized and disadvantaged compared to other patients and 

providers in the healthcare system. Separate is never equal. 

42 CFR Part 2 should either be repealed in its entirety or at the very least defined in a way that it is 

operationally identical to the privacy requirements under HIPAA. 

Would these changes maintain the privacy protections for patients? 

HIPAA provides adequate privacy protections for patients receiving specialized substance abuse 

treatment. 

Would these changes address the concerns of HI Es, health homes, ACOs, and CCOs? 

Yes,it would allow them to provide specialized substance abuse treatment patients and providers with 

the same information technology and data analytic treatment supports and benefits as other healthcare 

providers are able to provide to other patients. 
Would these changes raise any new concerns? 

Revising the current regulation so that it is operationally identical to the privacy provisions of Hf PAA 

would require extensive provider education and repeated clarifications. Outright repeal of the regulation 

would be clearer and simpler. 

c. Redisclosure

SAMHSA has also heard numerous concerns regarding the prohibition on redisclosure (§ 2.32). Currently 

most EH Rs don't support data segmentation. Without this functionality, EHR systems must either keep 

alcohol and drug abuse patient records separate from the rest of the patient's medical record or apply 

the 42 CFR Part 2 protections to the patient's entire medical record if such record contains information 

that is subject to 42 CFR Part 2. 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on redisclosure 

only applies to information that would identify an individual as a substance abuser, and allows other 

health-related information shared by the Part 2 program to be redisclosed, if legally permissible. This 

would allow HIT systems to more easily identify information that is subject to the prohibition on 

redisclosure enabling them to utilize other technological approaches to manage redisclosure. If data are 

associated with information about where the data were collected (data provenance) which reveals that 

the data were collected by a practice that exclusively treats addiction, the data would still be protected 

under the proposed change. 

Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 in an EHR or HIE 

environment? 

This change would be of very/imited benefit due to the significant resource demands involved in the 

technology required to manage redisclosure of selected portions of each patient's private health 

information. EM Rs will only be able to filter out the substance abuse treatment data that is are defined 

data elements and do not include free text. Providers having free text fields in their EH Rs such as 

progress notes still run the risk of a progress note containing information that would identify a patient as 

a substance abuser. 

Would these changes maintain the privacy protections for patients? 

Yes 

d. Medical Emergency

SAMHSA has heard concerns regarding the medical emergency exception of 42 CFR Part 2 (§ 2.51). The 

current regulations state that information may be disclosed without consent "for the purpose of treating 

a condition which poses an immediate threat to the health of any individual and which requires 

immediate medical intervention." The statute, however, states that records may be disclosed to medical 

personnel to the extent necessary to meet a bona fide medical emergency. SAMHSA is considering 

adapting the medical emergency exception to make it more in-line with the statutory language and to 
give providers more discretion as to when a bona fide emergency exists. For example, amending this 

standard to allow providers to use the medical emergency provision to prevent emergencies or to share 

information with a detoxification center when a patient is unable to provide informed consent due to 

their level of intoxication. 

What factors should providers take into consideration in determining whether a medical emergency 

exists? 

The current regulation should be amended to allow the release ofspecialized substance abuse treatment 

information in an emergency using the same methods and standards that would be applied under the 

privacy provisions of HIPAA. The exigencies of a medical emergency permit no time or opportunity to 

apply specialize complicated requirements for handling information. In addition, "medical emergency" 

should be defined as any treatment provided in the emergency department of an acute care facility. 

There is no time in a medical emergency to consider nuanced descriptions of what does and does not 

constitute an emergency. Creating different versions of the "break the glass" functionality would also 

create additional complexity within the HIE systems with additional cost to create and maintain this 

functionality. It would also create additional steps within the workflow for the EDs to determine which 

version of "break the glass" is warranted and to make the proper request of the system. 

Are there specific use cases SAMHSA should take into consideration? 

Are there patient concerns about the impact of this change on their privacy? 

Patients with chronic pain conditions and a history ofspecialized substance abuse treatment would be 

concerned about emergency medical personnel being reluctant to provide them with pain medication. 

However persons with chronic pain should not have their medication managed by emergency 

department providers, but should instead be working with their ongoing provider. 

e. Qualified Service Organization (QSO) 

SAMHSA has also heard concerns from payers and health management organizations related to 

disclosing information that is subject to 42 CFR Part 2 to health care entities (ACOs/CCOs) for the 

purpose of care coordination and population health management; helping them to identify patients with 

chronic conditions in need of more intensive outreach. Under the current regulations, substance abuse 

information may not be shared for these purposes without consent. 

SAMHSA is analyzing the regulations to identify options for allowing Part 2 data to flow to health care 

entities for the purpose of care coordination and population management while maintaining patient 

protections. One potential solution includes expanding the definition of a qualified service organization 

(QSO; § 2.11) to explicitly include care coordination services and to allow a QSO Agreement (QSOA) to 

be executed between an entity that stores Part 2 information, such as a payer or an ACO that is not itself 

a Part 2 program, and a service provider. 
If42 CFR part two cannot be repealed its entirety this would be a helpful change. 

Are there other use cases we should be taking into consideration? 

This change should also include subcontractors that health care entities employ, contract with, or 

otherwise engage to perform the same services. Case management should also be added as an allowable 

use. 

Are there specific patient concerns about the impact of this change on their privacy? 

f. Research 

Under the current regulations, the Part 2 "program director" has to authorize the release of information 

for scientific research purposes. This issue has been brought to SAMHSA's attention from organizations 

that store patient health data, including data that are subject to Part 2, which may be used for research 

(e.g. health management organizations). Under the current regulatory framework, absent consent, 

these organizations do not have the authority to disclose Part 2 data for scientific research purposes to 

qualified researchers or research organizations. This issue can be addressed by expanding the authority 

for releasing data to qualified researchers/research organizations to other health care entities that 

receive and store Part 2 data, including third-party payers, HIEs, and care coordination organizations for 

the purposes of research, audit, or evaluation. 

SAMHSA is considering expanding the authority for releasing data to qualified researchers/research 

organizations to health care entities that receive and store Part 2 data, including third-party payers, 

health management organizations, HIEs, and care coordination organizations. 

If42 CFR part two cannot be repealed its entirety this would be a helpful change. 

Are there factors that should be considered related to how current health care entities are organized, 

[or] function, or how legal duties and responsibilities attach to entities that make up an umbrella 

organization? 

Unknown 

Would this change address concerns related to research? 

Unknown 

Are there specific privacy concerns associated with expanding the authority or releasing data to 

qualified researchers/research organizations in this way? 

No 

Are there additional use cases that should be considered in the research context? 
Unknown 

g. Addressing Potential Issues With Electronic Prescribing and Prescription Drug Monitoring Programs 

(PDMPs) 

Part 2 protections include a prohibition on the redisclosure of information received directly from a Part 

2 program. A pharmacy that receives electronic prescription information directly from a Part 2 program 

must obtain patient consent to send that information to a POMP, and patient consent is also required 

for the POMP to redisclose that information to those with access to the POMP. Pharmacy data systems 

do not currently have mechanisms for managing patient consent or segregating data that are subject to 

Part 2 and preventing the data from reaching the POMP. Pharmacy systems also lack the ability to 

identify which providers are subject to Part 2, making it difficult to prevent the Part 2 data from reaching 

the POMP. 

If a patient does not consent to sharing their data via e-prescribing, their only option for filling their 

prescription is to bring a paper prescription to the pharmacy. In this instance, since the information is 

given by the patient, it is not protected by 42 CFR Part 2. They, therefore, cannot prevent the 

information from reaching the POMP which in some states is accessible by law enforcement and has the 

potential to lead to investigation/arrest and other forms of discrimination. 

How do pharmacy information system vendors anticipate addressing this issue? Are there specific 

technology barriers SAMHSA should take into consideration? 

First, we do not believe there is a technically, financially, or administratively feasible way to bring 

PDMPs into compliance with the current regulation. Older PDMPs aggregate the data from weekly or 

monthly disk dumps from the pharmacy systems. Maintaining the drug list and the patient list would be 

daunting. What if the patientfirst wanted to withhold access to reduce detection ofillicit behavior and 

then when in treatment decided to allow access, how would the pharmacy maintain the opt in versus the 

opt outs in context of date ofservice and in context of new versus refills. In newer PDMPs, the transfer of 

pharmacy data to the POMP occurs via less than a half dozen large national companies usually referred 

to as "the switch" whose entire business is switching data between the various entities involved in 

pharmacy payments. Some would pull data at the Surescripts site where centralized databases are 

maintained. None of the three types of entities receiving the pharmacy data-pharmacies themselves, 

switch companies, or PDMPs-have any way to identify which prescriptions have been sent by covered 

entities under 42 CFR Part 2. In order to selectively screen out prescriptions received from covered 

entities under 42 CFR Part 2 either the individual pharmacies or the switch companies would need to 

have a digital list uniquely identifying all covered entities, cross-walked to their NP/ numbers; it is unlikely 

they would be able or willing to compile such a list. It is also unlikely they would be willing to accept such 

a list from an outside entity unless the entity were willing to accept liability for any errors on the list. Any 

entity compiling and maintaining such a list would have continuously update it, on almost a daily basis as 

providers came and went. It is unclear who would bear the extensive costs involved in such frequent 

updates. 
The other alternative would be to mandate the switch companies to screen out all medications 

deemed to be indicative ofspecialty substance abuse treatmentfrom data they transmit to PDMPs, 

although this too would create additional administrative costs. The list of drugs they would screen out as 

indicative of specialty substance abuse treatment would need to be nationally standardized, government 

endorsed, and continuously updated as new manufacturers enter and leave the market and as new 

formulations are marketed or dropped. This would require a substantial ongoing regulatory assessment 

and updating of the drugs to be screened out. 

Second, at least two medications used in specialized substance abuse treatment are commonly 

abused controlled substances-methadone and buprenorphine. Methadone is reported by the Centers for 

Disease Control and Prevention to be involved in 30 percent of prescription overdose deaths. CDC also 

reports that the death rate from methadone overdoses was 6 times higher in 2009 than in 1999. While 

buprenorphine abuse and overdose deaths are much rarer, they are rapidly increasing in number. 

Prescription drug abuse in general has become a national epidemic. While indiivduals who have received 

specialized substance abuse treatment are less likely to abuse prescription medications than substance 

abusers who have not received treatment, they remain more likely to abuse prescription medications. 

Some persons who have received specialty substance abuse treatment relapse to prescription drug abuse 

and subsequently die of prescription drug overdoses. For these persons, not applying 42 CFR Part 2 to 

PDMPs would be literally life-saving. 

Third, another medication used in specialty substance abuse treatment, naltrexone renders all 

opiate pain medication completely ineffective. Naltrexone is very long-acting, with its effects lasting from 

3 to 40 days. When a person on naltrexone undergoes surgery or another medical procedure requiring 

anesthesia or analgesia, the anesthesiologist must know to use medications other than the usual 

opiates. If the anesthesiologist is not informed of the presence of naltrexone in the patient's system, the 

patient will experience extreme pain. Not applying 42 CFR Part 2 to PDMPs would help to prevent such 

tragedies. 

Are there other concerns regarding 42 CFR Part 2 and PD MPs? Please describe relevant use cases and 

provide recommendations on how to address the concerns. 

First 42 CFR Part 2 should be repealed in its entirety. If that is not possible, 42 CFR Part 2 should not 

apply to the transmission ofpharmacy data to PDMPs, or at the very least, should not apply to 

transmitting pharmacy data about the prescription opiates methadone and buprenorphine to PDMPs. 

The National Association of Boards of Pharmacy is developing a state-by-state network to share data 

from one POMP to another. Applying 42 CFR Part 2 to PDMPs wouldfurther complicate the transfer, use 

and interpretation of the data. If 42 CFR Part 2 is applied to PDMPs it should only be applied to 

medications that are used solely for specialized substance abuse treatment. 

Are there patient concerns about the impact of e-prescribing and PDMPs on their privacy? 

Patients seeking prescription medications in order to abuse or divert medications will object. 
Thank you for the opportunity to comment on 42 CFR Part 2. In closing I urge that so long as the current 

underlying statute remains in place that the a new regulation be drafted that: 

1) As much as possible is consistent with and references HIPAA 

2) Only exceeds HIPAA where absolutely unavoidable due to underlying federal statute 

3) Limits the definition of a covered entity as much as possible 

a. Providers licensed, accredited, or certified as a SA specialty provider 

b. Providers holding themselves out to the public as a SA specialty provider 

c. If part of an organization that provides other health care such as primary care or mental health 

the special protection only applies if more than 50% of patients treated are treated by the specialty 

substance abuse treatment programs and providers in the organization 

4) For medications limit the addition protection to medications used solely for treatment of
=

substance abuse that are prescribed by a covered entity 

Sincerely, 

Joseph Parks, MD 

Distinguished Professor of Science 

Missouri Institute of Mental Health St Louis 

4633 World Parkway Circle, Berkeley, MO 

63134 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Comments on 42 CFR 

Netcare Corporation is a freestanding 24 hour crisis and emergency psychiatric service agency 

in Columbus, OH. Because most of the people we serve have co-occurring mental health and 

substance use disorders, we are subject to the mandates of BOTH 42 CFR and HIPAA, as well as 

our own state rules protecting privacy and confidentiality. 

In general, we feel that 42 CFR promotes, rather than eliminates, stigma and barriers to care, 

and we support the repeal or revision of this law. In an era where behavioral health is viewed 

as an essential element of overall health, limiting access to alcohol or drug treatment by 

complicating and hampering communication increases the stigma of the alcohol/drug issues 

and presents barriers to treatment by isolating treatment of alcohol/drug issues into its own 

silo instead of integrating care. Truly integrated care does not have separate rules for 

alcohol/drug issues, other mental health issues, and physical health care. 

As a psychiatric emergency facility, we need access to information from other providers so that 

we can appropriately treat a person and achieve the best possible outcome for that person. 

Additionally, because we work closely with many community partners, including law 

enforcement, courts, children’s services agencies and other social services agencies, as well as 

with parents, guardians and schools, we need the ability to provide information to these groups 

in order to coordinate the patient’s care with them. And, while we respect patient’s rights to 

control their own information, patients often refuse to sign authorizations as required by 42 

CFR due to their mental illness, which precludes sharing of information and hinders the ability 

to care properly for the patient. 

One particular challenge in our crisis setting is whether the law recognizes psychiatric 

emergencies as “bona fide medical emergencies” as stated in the law. We believe that they are, 

and rely on this to share information with hospitals when someone is in need of psychiatric 

hospitalization and refuses to sign authorization or is incapacitated to sign. We also rely on this 

when hospitals have patients in their Emergency Departments who refuse to sign 

authorizations or are incapacitated to sign. 

All clients presenting to our crisis sites are initially triaged by a nurse to determine whether 

they are medically stable to receive services in our outpatient setting. Often times, clients are 

found to have symptoms that require urgent or immediate medical intervention, so we send 

them to hospitals for medical clearance before we can treat them. If we are unable to obtain 

the patient’s authorization, our staff are required to redact any alcohol/drug information from 

the records we share with the hospital, which imposes yet additional administrative burden on 

the clinical staff, and delays our ability to release the patient to the hospital for treatment. It 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

also precludes hospital staff from receiving alcohol/drug information which is relevant to their 

ability to properly care for the patient. 

Another challenge presented by 42 CFR in a crisis setting is that, unlike HIPAA, the law offers no 

provisions for duty to warn or protect individuals from threats by clients. As a result, we must 

weigh the balance between public health and safety with compliance with the law. 

Although 42 CFR does contain provisions for reporting child abuse, there are no provisions for 

reporting elder abuse, or abuse of persons who are developmentally disabled which our state 

requires us to do. It is very difficult to communicate important information via exceptions 

contained in 42 CFR Part 2. For example, the court order provisions do not exactly fit most of 

the situations we face regularly. 

We also provide behavioral health assessments for clients on a walk-in basis with the goal of 

referring persons for ongoing treatment services. Before the client leaves, staff typically obtain 

releases for the agency or agencies at which the client wishes to seek ongoing treatment. If the 

client subsequently wishes us to send the information to a different provider in order to be 

linked for ongoing services, we cannot do so without obtaining his/her authorization if the 

person is being referred for alcohol/drug abuse treatment. This is just another frustration for 

clients in their efforts to obtain the ongoing services that they need. 

One of the biggest challenges 42 CFR presents for us is with respect to assessment and/or 

treatment of youth. The law requires youth to sign authorizations for disclosure of information, 

even though parents/guardians consented for the child to receive services and despite the fact 

that persons under 18 are typically unable to legally sign consent for services, as their signature 

is not usually legally binding. While we recognize one goal of 42 CFR was to encourage people 

to seek treatment, typically this will not happen among youth without parental awareness, 

involvement, and intervention, and this often sets up situations in which parents who are 

unaware of their child’s AOD problem may not be able to access their child’s record if the youth 

does not sign the authorization. This places staff at odds with parents who legitimately feel 

responsible for their minor children’s health care and expect to be informed of issues to be 

addressed when they bring them here. 

Based on the comments above, we urge SAMHSA to consider HIPAA as the standard for ALL 

health care information, which would facilitate information sharing and promote continuity of 

care, as well as provide the necessary protections for confidential health care information. 

Thank you for the opportunity to provide input into this process. 
 

 

 

 

 

 

 

 

 

 

 

 

From: Judith Chaskes [mailto:JChaskes@HPTC.ORG]
 

Sent: Tuesday, June 24, 2014 11:05 AM
 

To: Privacy Regulations (SAMHSA)
 

Subject: hippa
 

concerning hippa......if nothing else, this is the absolute mascot for “making a federal case” out of
 

something.
 

in past years, all of the privacy regulations were merited.
 

Now, however, aids is medically treatable as a chronic disease! I work in the healthcare field as a 

clinician, primarily with drug and alcohol issues. the millions if not billions of dollars spent on hippa 

compliance would and should probably be much better spent in education and prevention efforts.
 

medical records ought to be confidential, period. we now have an established hippa bureaucracy that
 

is deeply entrenched and unwilling to give up any budget money or power and control. I really feel it is
 

time to look again at the original need for federal regulations and see if there are not some ways to
 

make confidentiality a much less onerous process.
 

j 

CONFIDENTIALITY: This email and any attachments are considered confidential, if you are 

not the intended recipient(s), any distribution or use of this email or the information contained 

therein is strictly prohibited. If you are not the intended recipient(s), please notify the sender 

immediately and do not disclose the contents, use it for any purpose, or store or reproduce the 

information in any medium, Thank you. 
 

 

 

 

 

 

 

 

 

 

 

	 

	 

	 

	 

	 

Public Health 

Administration

Administration • 3450 Broadway • Boulder, Colorado 80304 • Tel: 303.441.1100 • Fax: 303.441.1452 

www.BoulderCountyHealth.org 

June 23, 2014 

Substance Abuse and Mental Health Services Administration (SAMHSA) 

1 Choke Cherry Road, Room 5-1011 

Rockville, MD 20857 

RE:	 Federal Register Docket No. 2014-10913, Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 

42 CFR Part 2 

To Whom It May Concern: 

Boulder County (Colorado) Public Health is submitting the following comments relative to proposed changes on the 

confidentiality of alcohol and drug abuse patient records. To ensure clarity, our comments below are arranged by 

section to correspond with the Supplemental Information of the document that SAMHSA has organized for public 

listening and comment. 

I. BACKGROUND.

Section a. Applicability of 42 CFR Part 2

 How would redefining the applicability of 42 CFR Part 2 impact patients, health care provider organizations,

HIEs, CCOs, HIT vendors, etc.?

We at Boulder County Public Health (BCPH) believe this would be a good change, provided that the change

to defining the service versus the facility does not inadvertently place additional restrictions on

organizations that wouldn’t currently fall under these provisions, as they would then become subject to

more restrictions further limiting their ability to share information between providers. For example, with

the strong focus of integrating behavioral health with primary care, it is critically important that hospitals

seeing patients in their emergency rooms multiple times are able to link the clients with a stable source of

medical care (i.e. medical home) to provide comprehensive and prevention focused care, as well as assure

that the clients get the substance abuse and mental health treatments they need.

Section b. Consent Requirements 

 Would these changes maintain the privacy protections for patients?

Yes, patients would be aware of who can view and disclose their information. With the expectation and

sanctions for organizations that are not moving to health information exchange, it makes sense that the

regulations support the exchange of health information between the providers that are serving the clients.

The regulations should make it clear that multi-party releases are acceptable.

 Would these changes address the concerns of HIEs, health homes, ACOs, and CCOs?

We believe that it would help our agency to get closer to more reliable and efficient exchange of

information. When we look at costs within our own health system, it is clear that clients with significant

substance abuse issues are driving top-of-the-pyramid costs, yet our regulations are structured in such a

way that makes it difficult for us, as providers, to assure comprehensive supportive care in a way that could

truly help clients achieve a healthier life.

Section c. Redisclosure 

 Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 in an EHR or HIE

environment?

We believe this will would help providers who have the ability to use technological

advances to assure this, but there are still a lot of care coordination agencies that will
SAMHSA Comments 

Federal Register Docket #2014-10913 

Page 2 

struggle, as this is still restrictive and does not solve the information sharing problem. Ideally, this and the 

following section would be better aligned with HIPAA regarding the use of information to affect more 

effective, comprehensive treatment that allows providers to share information and care plans that would 

help clients reach stabilization more quickly and reduce costs in the system. 

Section d. Medical Emergency 

 What factors should providers take into consideration in determining whether a medical emergency exists?

 Are there specific use cases SAMHSA should take into consideration?

As mentioned above, it would be best to develop a rule that allowed easier information sharing than even

this proposed change would allow.

Section e. Qualified Service Organization (QSO) 

“S!MHS! is analyzing the regulations to identify options for allowing Part 2 data to flow to health care entities 

for the purpose of care coordination and population management while maintaining patient protections. One 

potential solution includes expanding the definition of a qualified service organization (QSO; § 2.11) to explicitly 

include care coordination services and to allow a QSO Agreement (QSOA) to be executed between an entity that 

stores Part 2 information, such as a payer or an ACO that is not itself a Part 2 program, and a service provider.” 

 

 

 

 This would be a big help, as more communities are recognizing that increased coordination among care

providers often results in cost saving and better care for clients. This is being demonstrated by accountable

care organizations (ACO) across the country who not only have reduced emergency room visits and costs,

but are helping to link people to regular sources of care. Expanding this QSO definition would help to assure

that we have the ability to share information with organizations that are part of clients’ safety nets.

We feel this should be expanded to include formal nonprofits that provide wraparound care management 

services, such as emergency housing, shelter, and other key needs to help stabilize a person. The 

importance of this was illustrated in a Robert Wood Johnson Foundation report that talked about the desire 

of providers to “prescribe wraparound services” to clients in need of stabilization services that can’t be met 

in doctors’ offices. 

Section f. Research 

SAMHSA is considering expanding the authority for releasing data to qualified researchers/research 

organizations to health care entities that receive and store Part 2 data, including third-party payers, health 

management organizations, HIEs, and care coordination organizations. 

 

 An expansion, as proposed in this area, would help us to provide data to research organizations that could

help support demonstrating the costs of services, as well as return on investment for improved care

coordination, and it could lead to our ability to better demonstrate cost benefit in services that already

receive scrutiny from some members of our society. We believe this would be a positive change.

We would like to thank SAMHSA for soliciting and listening to feedback from the public to help communities 

determine how best to use information more effectively and reasonably while maintaining patient confidentiality. 

We at Boulder County Public Health look forward to the changes. Should you have any questions or comments 

about our feedback, please contact BCPH Public Health Director Jeff Zayach at jzayach@bouldercounty.org or 303-

441-1456. Thank you.

Sincerely, 

Jeffrey J. Zayach, MS 

Public Health Director 

Boulder County Public Health 

 Paula McKey 

President 

Boulder County Board of Health 

 

 

	 

	 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

At Centerstone we have worked on a number of projects over the past four years integrating behavioral and 

physical health services. As our projects expand, we continually run into the problem of sharing patient 

information. HIPAA allows health care providers to share protected health information absent patient consent for 

the purpose of treatment which includes care coordination. Yet because of 42 CFR Part 2 we are not allowed to 

do this except in an emergency. Virtually all health care providers outside of the behavioral health realm share 

information for the purposes of treatment and care coordination. The legal guidance that we request is how far 

can we stretch limits to communicate without incurring serious legal risk. The following are sample issues that we 

want to work on: 

1. A universal release: Can we develop a release of information that allows for communication across all 

necessary entities and supports our ability to effectively and efficiently coordinate care? Can we add language to 

acknowledge our ability to communicate with potential unnamed as well as current health care providers, 

hospital systems, HIEs, etc. Often, neither we nor the patient know who the patient will be treated by next. 

Can a patient with an addiction acknowledge that he is aware of 42CFR part 2 and is still willing to sign such a 

release? 

2. Sharing with hospital employees: Centerstone has one of two pilot CMHC health information exchange grants 

in the state. We have about 800 patients in Bloomington who have signed releases. The release allows the HIE 

and Bloomington Hospital to send Centerstone an alert when one of our consenting patients is admitted to the ER 

or to any hospital bed. At present, we ask our staff to confirm if there is a release in order for them to contact the 

hospital staff to share information. If we are receiving alerts for medically important issues, do we need to check 

to see if there is a release before talking with a hospital employee? Also, because of this relationship hospital 

employees may call us whether or not a formal alert has been sent to us. Do we still need to check and see if 

there is a release before we can share information? 

3. Bloomington appears to be ahead of our other 16 counties in developing unified community-driven care plans. 

Unified community-driven care plans are a path for seeing that patients receive the proper care in the proper 

location and reduce unnecessary high-cost services such as emergency room use and hospitalization. We want to 

participate in such planning which occurs with relative ease with other health care providers. We tend to be held 

back because it is not clear if we can communicate and it is difficult to keep track of all releases. A comprehensive 

release as noted above would be helpful. 

4. A basic feature in electronic medical record software allows access to Sure Scripts. The prescriber to see all 

prescriptions filled by his or her patient at other pharmacies (excluding Walmart and VA). Outside of psychiatry, 

there is no release requested. However, in psychiatry, the software asks if the patient has signed a release. 

Oftentimes, patients are poor historians on medications and dosage. It would seem that not knowing the other 

medications that a patient is on a high risk if not emergency issue. Again, it is cumbersome for prescriber to 

always check to see if a release has been signed. What risk do we take if we open up Sure Scripts to all of our 

psychiatric providers? 

5. Medication reconciliation is a major issue in improving the quality of health care. In South Carolina, 

Pharmacehome is leading a health home movement based on extensive reconciliation efforts especially at 

hospital discharge. In Bloomington IU Health and the HIE collaborate with Pharmacehome. We want to 

participate but this raises the question of releases. We also have on-site Genoa pharmacies in Bloomington and 

Columbus and want them to do reconciliations when scripts are filled. Can we participate in medication 

reconciliation efforts without certainty that a release is signed? 

6. Related to sharing medical information, how far can we stretch the term “emergency”? A Pharmacehome 

attorney told us that she works with psychiatrists who tend to be liberal in their interpretation. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 


















 


 


 


 

From: Michele Hughes [mailto:mhughes@pyramidhc.com]
 

Sent: Tuesday, June 24, 2014 2:34 PM
 

To: Privacy Regulations (SAMHSA)
 

Subject:
 

To whom it may concern; 

I am writing in response to public comment on 42CFR Part 2 confidentiality regulations. I am 

greatly opposed to any such movement that would weaken the protection of our clients 

confidentiality rights. Even with the current protections; clients are compromised regularly when 

attempting to access treatment and maintain their compliance with the department of corrections. 

Less protection will impeded clients access to treatment and increase already present 

discrimination. 

Clients are already fearful with the current protections, I can not imagine the impact of less 

protection for an already vulnerable and stigmatized population.. 

The best method of protection is the current protection offered by PA 42CFR 

Michele Hughes, LSW, CADC, RN 

Program Director 

Pyramid Allentown Outpatient Office 

1605 N. Cedar Crest Blvd 

Suite 105 

Allentown, PA 18104 

o. (610) 434-1126 ext 3501 f. (610) 434-1179 

Click here to watch our 3-minute video! 

This email and any files transmitted with it are confidential and are intended solely for the use of the 

individual or entity to which they are addressed. This communication may contain material protected 

by HIPAA legislation (45 CFR, Parts 160 & 164). If you are not the intended recipient or the person 

responsible for delivering this email to the intended recipient, be advised that you have received this 

email in error and that any use, dissemination, forwarding, printing or copying of this email is strictly 

prohibited. If you have received this email in error, please notify the sender by replying to this email 

and then delete the email from your computer. 

This email and any files transmitted with it are confidential and are intended solely for the use of 

the individual or entity to which they are addressed. This communication may contain material 

protected by HIPAA legislation (45 CFR, Parts 160 and 164). If you are not the intended 

recipient or the person responsible fr delivering this e-mail to theintended recipient, be advised 

you have received this email in error and that any use, dissemination, forwarding, printing or 

copying of this email is strictly prohibited. If you have received this email in error, please notify 

the sender by replying to this email and then delete the email from your computer. 
 

 

 

 

 


 


 


 


 


 


 


 


 

Kenneth Minkoff, MD
 

Board Certified Addiction Psychiatrist
 

Clinical Assistant Professor of Psychiatry, Harvard
 

Senior System Consultant
 

ZiaPartners, Inc
 

369B Third Street #223
 

San Rafael, CA 94901
 

42CFR RECOMMENDATIONS
 

RE: federalregister.gov/articles/2014/05/12/2014-10913/confidentiality-of-alcohol-and-drug-abuse-patientrecords 

Background 

As a system integration consultant who has worked with state and county systems in over 40 states, I have an 

excellent “on the ground” experience of the current role of 42 CFR confidentiality regulations regarding alcohol 

and drug abuse treatment records in affecting the outcomes of people receiving services in complex health, 

mental health, and alcohol and drug abuse service systems. 

For this reason, I am providing these written comments to SAMHSA to contribute to decision making concerning 

these regulations at this important point in time in the transformation of our overall health care system. 

I have also attached a separate bio for more information on my work, and am happy to answer questions or 

provide more information if that would be helpful. 

Recommendations 

SAMHSA has requested comment on proposed changes to 42 CFR regarding special confidentiality requirements 

for substance abuse treatment. My position is as follows: 

My recommendation is that 42 CFR 290dd-2 should be repealed in its entirety. My rationale for this position is 

stated below. 

In the Federal Register, SAMHSA identifies a wide range of changes that have occurred in the health and 

behavioral health delivery systems since the last revision of 42 CFR in 1987. SAMHSA indicates that these changes 

prompt a need for reconsideration of 42 CFR in light of numerous barriers presented by that regulation. I agree. 

SAMHSA also states “There continues to be need for confidentiality regulations that encourage patients to seek 

treatment without fear of compromising their privacy”. I agree with this as well. 

What SAMHSA has not demonstrated is that there continues to be a need for special confidentiality regulations 

for substance abuse treatment that are different from the regulations applied to every other type of condition. 

My position is that while this was once the case, it is no longer so, and the risks and harms of such special 

regulations substantially outweigh the continued benefits. 

The following is a bulleted list that supports this position: 
 

 

 

 

 

 

 

 

 

	 

	 

	 

	 

	 

	 

	 

	 

	 

	 

	 

	 

•	 The stigma and discrimination associated with substance use disorders and treatment has been 

substantially reduced over the past 25 years, as witness the open discussion of these issues in public 

media and acceptance of substance abuse recovery for people in the public eye. 

•	 Other disorders that may be far more stigmatizing (e.g., schizophrenia) are not subject to similar 

protections. Confidentiality of information is adequately protected by current federal and state 

regulations without need for special restrictions in 42 CFR. 

•	 The association of substance use disorders with criminal behavior is neither universal, nor unique to 

these conditions. Individuals who seek other types of medical treatment that may be associated with 

illegal activities (eg, receiving medical treatment for subacute bacterial endocarditis due to illicit IV drug 

use) are not afforded special protections, and yet individiuals are able to access care. 

•	 It is now well understood that evidence based best practice interventions for substance use disorders 

should be integrated into both general health treatment and mental health treatment. Creating a 

special category of information protection for substance use disorders is confusing for providers and in 

conflict with best practice care. 

•	 Special regulations interfere with information exchange in health systems in ways that are more likely 

to be detrimental (rather than protective) to the health and well being of individuals with co-occurring 

health, mental health, and substance use issues. 

•	 Special regulations interfere with provision of care in medical emergencies by creating an additional 

layer of confusion about what types of information can be shared. 

•	 Special regulations interfere with the performance and effectiveness of potentially life saving 

prescription monitoring programs. 

•	 Special regulations interfere with the implementation of life saving evidence based best practice 

medication assisted treatment for opioid dependence and other types of substance dependence. 

•	 Special regulations create barriers to implementation of best practice “therapeutic justice” approaches 

to substance treatment (e.g., treatment courts) for individuals with substance use disorders who are 

involved with the criminal justice system, as well as to screening and diversion efforts. 

•	 Special regulations interfere with the operation of performance improvement, quality service 

organizations and other mechanisms for better management of population health and outcomes, all of 

which may be detrimental to individuals with substance use issues who have complex needs. 

•	 Elimination of special regulations by SAMHSA can still permit capacity for state systems and providers 

to determine the level of information protection that is appropriate for the populations they serve. 

Individual states may (as at least one state – Pennsylvania - does currently) enact more restrictive 

regulations if they choose. Individual substance abuse treatment providers may choose to offer more 

restricted access to protected health information for their clients, and advertise accordingly. 

•	 Providers may still have discretion to offer individual clients an opt out to maintain a higher level of 

protection for their health information (of any kind). Systems that have done this proactively (and 

clearly explained the benefits – as well as risks – of information sharing) have discovered that only a 

very small minority of individuals choose the opt out provision. This is preferable to have a 

burdensome provision that affects everyone, and may be contrary to what the majority of clients would 

choose, if they had a choice. 

In conclusion, my position is that the harms of maintaining a special confidentiality regulation for substance 

abuse treatment substantially outweigh the benefits. The special regulations are discriminatory and 

stigmatizing, and create burden for clients, families, providers, payors, and health/behavioral health systems. 

Further, the current array of proposed changes by SAMHSA does little to alleviate this issue, and in some 

instances may make the situation worse. It is my view that incremental improvements (while perhaps better 
 

 

than no improvements) are impossibly challenging given the degree to which attention to substance use 

disorders needs to be integrated into all aspects of health care. 

In short, I recommend the total elimination of the special confidentiality protections for substance abuse 

treatment under 42 CFR, and provision of protection for substance abuse treatment through the same 

regulatory mechanisms that provide privacy and confidentiality protection for all other health and behavioral 

health conditions. 
 

 

 

 

 

 

From: sallykeck71@comcast.net [mailto:sallykeck71@comcast.net]
 

Sent: Monday, June 23, 2014 8:30 PM
 

To: Privacy Regulations (SAMHSA)
 

Subject: 42cfr part 2
 

I have worked for many years in the substance use treatment field. This privacy 

protection has been a priority with my clients due to the stigmatization in our society of 

substance use disorders. Please do not eliminate this important layer of privacy 

protection. Sally A. Keck, MLADC, CCS, TTS-C, CIDIPI 
 

 

 

 

 

 

 

 

From: Kate Horle [mailto:khorle@corhio.onmicrosoft.com] 

Sent: Monday, June 23, 2014 6:50 PM 

To: Privacy Regulations (SAMHSA) 

Subject: written comments on the Confidentiality of Alcohol and Drug Abuse Patient Records 

Regulations 

Response to: Confidentiality of Alcohol and Drug Abuse Patient Regulations 

June 25, 2014 

Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

Healthcare providers and patients alike agree that treating the body and mind together is critical 

to successful healthy outcomes. Many primary care practices routinely assess for depression, 

smoking, alcohol addictions, and drug or other substance use. And as long as they do not hold 

themselves out as specifically providing treatment to patients for substance abuse, providers 

can share this information with others within the patient’s care team without specific patient 

consent. Integrated care is the right way to treat patients, and most providers agree that knowing 

about patients’ relationships to substances will enable them to treat patients with more depth and 

attunement. 

When a patient, however, receives a specific substance abuse evaluation or treatment, and the 

facility is subject to the provisions of 42 CFR Part 2, they must segregate that information 

and, as a result, it’s not available to providers during an emergency or other critical situation 

when it could be used to better care for the patient. In addition, the lack of this information 

means a provider isn’t treating their patients in a holistic way. Further, substance abuse treatment 

providers need to be able to see if other doctors are providing medications to patients that are in 

treatment programs. The flow of information should be bidirectional in all aspects. 

Treating the entire patient is a critical factor in healthy outcomes. However, what is equally 

important is protecting the privacy and confidentiality of every patient. Privacy takes on 

significant importance for patients receiving substance abuse treatment because of the complex 

legal and social issues surrounding the effective treatment of this type of disorder. Inappropriate 

disclosure of substance abuse treatment data could lead to potentially damaging 

information becoming accessible to law enforcement, the legal system, professional licensing 

boards, insurance organizations and other entities. However, there is a path forward that 

continues to protect the right to privacy and also the right to being cared for as a whole human 

being. 

Changing some of the provisions of 42 CFR Part 2 could enable significantly better care for 

patients. The Mid-States Consortium of Health Information Organizations, an organization 

composed of 21 health information organizations across 15 states, is concerned that in today’s 

digital health environment, 42 CFR Part 2 limits access to complete, integrated care for patients. 

To that end, we have a proposal for several of the sections that SAMSHA is considering. 
 

 

 

 

Substance Abuse Treatment Disclosure 

The requirement against disclosure of patients who are receiving substance abuse treatment 

is a critical challenge to health information exchange of patient data. Our proposal is to modify 

42 CFR Part 2 to allow for disclosure of sensitive data that may be available from the health 

information exchanges (HIEs) for that patient to appropriate providers who are part of the 

patient’s care team. The patient could then, at the point of care, authorize their consent for the 

providers with a direct treatment relationship with the patient to access that information. 

Currently, because of the issue of disclosure, HIEs would be prohibited from even 

acknowledging that someone was receiving, or had received, substance abuse treatment. 

Another challenge to health information organizations is the prohibition against redisclosure of 

substance abuse treatment information. Currently within 42 CFR Part 2 there is a provision for 

disclosure of substance abuse treatment data to organizations that have specific business 

relationships with, or provide services to, substance abuse treatment organizations. In these 

cases, specific patient consent to disclose data is not needed as long as the patient is made aware 

of these arrangements. We recommend that the definition of what constitutes a Qualified Service 

Organization Agreement (QSOA) be expanded in such a way that a group of organizations, 

including health information exchanges, can redisclose substance abuse treatment information as 

long as it remains within the cohort group of organizations defined by the QSOA. 

We recognize that patient’s exposure as a recipient of substance abuse treatment should be on an 

individual care team member level. Only after the provider has authenticated themselves to the 

HIE as a member of a specific care team should they be allowed to see an individual’s data. This 

is, of course, beyond the care provided on an emergency case. In that way, the HIE can become 

the facilitator for substance abuse treatment data and freely exchange that information with any 

provider residing at any of the QSOAs within that group. 

Substance Abuse Data for Research 

Finally, we support the idea of expanding access to substance abuse data for the purposes of 

research. Health information organizations are gaining the capacity to de-identify data. Deidentified data means that the data contains no individual patient information and cannot be 

connected to a particular patient. Population health and metrics are increasingly important to 

local governments and being able to analyze both small and big data is dependent on access to a 

full range of information. 

To that point, health information organizations across the country are interested in, or already 

connecting to, prescription drug monitoring programs (PDMPs). Because these programs contain 

schedule 2-5 narcotics and other regulated prescriptions, this information is important to access 

for the longitudinal health record of patients. Undoubtedly, there are medications prescribed 

contained in this list that could connect a patient to substance abuse treatment, and certainly the 

purpose for a PDMP is to ensure that patients are not doctor shopping to gain access to multiple 

prescriptions of narcotics — an indication of substance abuse. 

Unfettered access to this list is critical to providers and ultimately patient health. 
 

 

None of the information above proposes radical change to 42 CFR Part 2. That said, these 

changes would make 42 CFR Part 2 much more effective in both protecting patient privacy and 

ensuring that they get the integrated care they need and deserve. 

Sincerely, 

Jeffrey Messer 

Director, Outreach and Development 

Colorado Regional Health Information Organization 

Kate E. Horle 

Director, State and Federal Initiatives 

Colorado Regional Health Information Organization ( CORHIO) 

(p) 720-285-3269

(c) 720-201-2522

CONFIDENTIALITY NOTICE: CORHIO encourages you to seek advice, including legal counsel, specific to your 

organization’s situation and needs. The contents of this electronic mail message and any attachments are 

confidential, possibly privileged and intended for the addressee(s) only. Only the addressee(s) may read, 

disseminate, retain or otherwise use this message. If received in error, please immediately inform the sender and 

then delete this message without disclosing its contents to anyone. 
 

 

 

I think that my privacy as a person on methadone maintenance would be greatly affected by 

having my name in some type of database. 

There is so much stigma with methadone. I know from experience. Whenever I have had to go 

to the emergency room and as soon as I told them I was a methadone patient, I was treated like 

scum of the earth. They didn't even acknowledge my health problem, they just thought I was a 

doper and sent me home. 

I would rather tell my doctor on my own time. I have had so many problems due to just telling 

them myself. I sure don't want it where they find out even before talking to me. 
	 

 

HEALTHeLINK is a regional health information organization (“RHIO”) headquartered 

in Buffalo, New York, that provides services to healthcare constituents, including payors, 

hospitals and other healthcare data users, throughout the eight counties comprising the Western 

New York region. HEALTHeLINK is also part of the Statewide Health Information Network of 

New York (“SHIN-NY”), a technology framework spanning all of New York State that allows 

health care providers efficient access to their patients' data utilizing data from health information 

exchanges (“HIEs”) certified as “Qualified Entities” by the New York State Department of 

Health. 

 

 

 

 

 

Page 1 of 9 

June 25, 2014 

Submitted electronically via privacyregulations@SAMHSA.hhs.gov 

The Substance Abuse and Mental 

Health Services Administration 

1 Choke Cherry Road 

Rockville, MD 20857, Room 5-1011 

Subject:	 Docket #2014-10913 –Request for Public Comments on Confidentiality of 

Alcohol and Drug Abuse Patient Records Regulations, 42 C.F.R. Part 2. 

Ladies and Gentlemen: 

This letter is submitted on behalf of Western New York Clinical Information Exchange, 

Inc. d/b/a HEALTHeLINK (“HEALTHeLINK”) with respect to the proposed new regulations 

the Substance Abuse and Mental Health Services Administration (“SAMHSA”) has put forward 

as a means to address concerns raised by the current restrictions imposed by the Confidentiality 

of Alcohol and Drug Abuse Patient Records regulations, 42 C.F.R. Part 2 (“Part 2”). 

HEALTHeLINK was recognized by the Office of National Coordinator for Health 

Information Technology of the Office of the Secretary for the United States Department of 

Health and Human Services (“ONC”) as a “Beacon Community” and was one of 17 Beacon 

Communities nationwide tasked with building and strengthening local health information 

technology infrastructure and testing innovative approaches to make measurable improvements 

in health, care, and cost. Western New York, with HEALTHeLINK as the lead grantee, received 

a $16.1 million award, one of the largest Beacon Community awards in the country, from ONC. 

The comments expressed in this letter represent the views of HEALTHeLINK. 

HEALTHeLINK thanks SAMHSA for the opportunity to comment on the challenges the 

Part 2 regulations pose to HEALTHeLINK, specifically, and to other health care constituents, 

including other RHIOs, HIEs and electronic health record systems (“EHRs”), generally. Our 

comments are intended to highlight matters we believe SAMHSA should consider in formulating 

revised proposed Part 2 regulations or providing guidance pursuant thereto. 
 

 

 

 

 

 

 

 

 

Page 2 of 9 

Background: 

The Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and 

Rehabilitation Act of 1970 (the “CAAAPTRA”),

1 the Drug Abuse Office and Treatment Act ot 

1974 (the “DAOTA”, and together with the CAAAPTRA, the “Governing Legislation”)2 and 

the complementary Part 2 regulations govern the disclosure of information acquired in 

connection with alcohol and drug treatment. The Part 2 restrictions,3 which are among the most 

stringent of all health care privacy laws, were enacted in the 1970s.4 

Meanwhile, health care delivery and information sharing, as well as health information 

privacy and security regulations, have evolved significantly, to the point where Part 2 has 

become unwieldy. For example, Part 2 drastically limits the circumstances under which certain 

drug and alcohol treatment information may be shared – even with other providers or entities 

involved in a health care delivery system. Health care delivery, on the other hand, has been 

evolving into new and increasingly complex models of integrated care, such as account care 

organizations (“ACOs”), coordinated care organizations (“CCOs”), RHIOs and HIEs, supported 

by electronic data exchanges, EHRs and performance measurement. Because of this 

discrepancy, the existing Part 2 regulations on information sharing risk excluding substance 

abuse treatment providers and their patients from these innovative care models and their 

resulting benefits. 

While, there continues to be a need for patients to be assured of privacy when they seek 

treatment for drug or alcohol abuse, we believe that the Health Insurance Portability and 

Accountability Act of 1996 (“HIPAA”) and the rules, regulations and guidance thereunder,5 as 

well as the protections afforded to such protected health information (“PHI”) under existing 

State laws, sufficiently address these concerns. In addition, unlike the current Part 2 restrictions, 

the HIPAA framework is currently incorporated into, and is an integral part of, the business 

models and day-to-day operations of the existing integrated care organizations and other 

healthcare provider constituents within the United States healthcare system. 

Discussion: 

The suggestions set forth below are intended to assist SAMHSA in promulgating revised 

Part 2 regulations. We have organized our comments below based on (a) the specific topic areas 

that SAMHSA requested public comment on,6 and (b) the issues we believe SAMHSA should 

address in its proposed rulemaking or in any accompanying release. 

1

 42 U.S.C. § 290dd-3 (2014). 

2

 42 U.S.C. § 290ee-3 (2014). 

3

 42 C.F.R. Part 2 (2014). 

4 See Footnotes 2 and 3, supra. 5 See 42 U.S.C. § 130d et. seq. for Federal laws and 45 C.F.R. Parts 160 and 164 for Federal 

regulations).

6 See The Substance Abuse and Mental Health Services Administration Public Listening Session 
 

 


 


 


 

 

 

 

 

 


 


 


 













Page 3 of 9 

1. Applicability of 42 C.F.R. Part 2

SAMHSA is considering options for defining what information is covered under Part 2.

Covered information could be defined based on what substance abuse treatment services are 

provided instead of being defined by the type of facility providing the services 

79 FR 26930. 

Questions Posed: 

How would redefining the applicability of Part 2 impact patients, health care provider organizations, HIEs, 

CCOs, HIT vendors, etc.?
 

Would this change address stakeholder concerns?
 

Would this change raise any new concerns?
 

Comments:

 Part 2 currently applies to federally funded individuals or entities that “hold themselves 

out as providing, and provide, alcohol or drug abuse diagnosis, treatment or treatment referral,” 

including units within a general medical facility that hold themselves out as providing diagnosis, 

treatment or treatment referral.7 However, the United States health care system is changing and 

more substance abuse treatment is occurring in general health care and integrated care settings 

which are typically not covered under the current Part 2 regulations. Part 2 has also made it 

difficult to identify which providers are covered by Part 2 because whether a provider or 

organization is covered by Part 2 can change depending on whether they advertise their 

substance abuse treatment services (i.e. “hold themselves out”), which can change over time. 

We believe that the Governing Statutes and Part 2 regulations should be repealed in their 

entirety in order to allow substance abuse information to be treated in the same manner as all 

other PHI under HIPAA. HIPAA already imposes suitable protection to patients, in terms of 

both use and disclosure, of their PHI, including PHI related to substance abuse treatment. 

Furthermore, while RHIOs and other HIEs have the ability to properly identify and control the 

flow of PHI, because of the fluid nature of the current and proposed parameters of what PHI is 

also subject to the restrictions of Part 2, the regulations will result in an ever changing and 

amorphous body of information that is covered by the regulations. This “moving target” will 

neither properly protect patients’ information with a reasonable degree of certainty nor facilitate 

the innovations that have occurred, and continue to occur, in connection with the United States 

movement toward a more efficient integrated healthcare model. In addition, if the revised Part 2 

regulations do not narrowly define what substance abuse PHI is subject to its restrictions, it could 

have the impact of expanding the application of Part 2 instead of narrowing its scope. 

7 See 42 C.F.R. § 2.11 Definitions, Program. 
 

 

 


 


 


 

 

Page 4 of 9 

Alternatively, if the Governing Legislation and Part 2 are not repealed, we respectfully 

submit that Part 2 should be revised in a manner that limits its applicability solely to dedicated 

substance abuse facilities where substance abuse is the primary diagnosis and the facility is 

primarily federally funded. This is the approach taken by many of the States and would (a) allow 

RHIOs and other existing integrated care organizations to accurately identify and segregate 

information covered by Part 2, and (b) provide patients with adequate protection from the misuse 

or improper dissemination of their identifiable substance abuse related PHI. 

2. Consent Requirements: 

SAMHSA is examining the consent requirements in Part 2 to explore options for 

facilitating the flow of information within the health care context while ensuring the patient is 

fully informed and the necessary protections are in place. Specifically, SAMHSA is analyzing 

the current requirements and considering the impact of adapting them to: 

1. Allow the consent to include a more general description of the individual, 

organization, or health care entity to which disclosure is to be made. 

2. Require the patient be provided with a list of providers or organizations that may 

access their information, and be notified regularly of changes to the list. 

3. Require the consent to name the individual or health care entity permitted to make the 

disclosure. 

4. Require that if the health care entity permitted to make the disclosure is made up of 

multiple independent units or organizations that the unit, organization, or provider 

releasing substance abuse related information be specifically named. 

5. Require that the consent form explicitly describe the substance abuse treatment 

information that may be disclosed. 

79 FR 26931 

Questions Posed: 

Would these changes maintain the privacy protections for patients?
 

Would these changes address the concerns of HIEs, health homes, ACOs, and CCOs?
 

Would these changes raise any new concerns?
 

Comments: 

Currently, Part 2 requires the written consent to include the name or title of the individual 

or the name of the organization to which the disclosure is to be made.8 This is often referred to 

as the “To Whom” consent requirement. This “To whom” requirement makes it difficult to 

8

 42 C.F.R. § 2.31. 
 

 

 


 


 


 

 

 

 

 

 

 

 

Page 5 of 9 

include programs covered by Part 2 in RHIOs, HIEs, EHRs, health homes, ACOs and CCOs 

because these organizations have a large and growing number of member providers and they 

generally do not have sophisticated consent management capabilities. Currently, a Part 2 

compliant consent cannot include future un-named providers which requires the collection of 

updated consent forms whenever new providers join these organizations. As a result, many of 

these organizations are currently not including substance abuse treatment information in their 

systems. This exclusion serves neither current or potential patients who have substance abuse 

problems nor the United States healthcare system as awhole. While the recommendations put 

forward by SAMHSA would be a significant improvement on the current “To Whom” approach, 

we believe they would not provide the changes necessary to allow RHIOs, HIEs and EHRs to 

include and properly manage substance abuse related PHI. 

We propose that SAMHSA should put forward proposed rules that allow a patient to sign 

(a) with respect to use in connection with treatment, payment and operational purposes (“TPO”), 

a general consent to the use of substance abuse PHI without listing specific recipients, and (b) 

with respect to release of such information for any other purpose, a general consent that includes 

a description of the recipient or a list of potential recipients. 

3. Redisclosure 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on 

redisclosure only applies to information that would identify an individual as a substance abuser, and 

allows other health-related information shared by the Part 2 program to be redisclosed, if legally 

permissible. This would allow HIT systems to more easily identify information that is subject to the 

prohibition on redisclosure enabling them to utilize other technological approaches to manage 

redisclosure. If data are associated with information about where the data were collected (data 

provenance) which reveals that the data were collected by a practice that exclusively treats addiction, the 

data would still be protected under the proposed change. 79 FR 26931. 

Questions Posed: 

Would this type of change facilitate technical solutions for complying with Part 2 in an EHR or HIE
 

environment?
 

Would these changes maintain the privacy protections for patients?
 

Comments: 

Currently most RHIOs, HIEs and EHRs don't support data segmentation. Without this 

functionality, HIEs and EHRs must either keep alcohol and drug abuse patient records separate 

from the rest of the patient's medical record or apply the Part 2 protections to the patient's entire 

medical record if such record contains information that is subject to Part 2. 

Additionally, the proposed changes put forward by SAMHSA would be equally as 

impractical as the current Part 2 regulation for purposes of implementation by RHIOs, HIEs and 

EHRs. The proposed alternative would present the same implementation issue as the current 

regulations. As mentioned above, the majority of EHR systems don’t currently have the ability 
 

 

 

 

 


 


 


 

 

 

 

Page 6 of 9 

to readily and accurately identify PHI subject to Part 2 (i.e. PHI related to substance abuse 

treatment), based on location or otherwise. Therefore, a clarification that Part 2 does not apply 

to PHI in a record that is not related to substance abuse treatment where other Part 2 PHI is 

present, does virtually nothing to address the concerns that Part 2 restrictions are incompatible 

with the current information segregation capabilities of most EHR systems. 

While the proposed changes are helpful and worthy of support, we submit that 

SAMHSA, rather than rearticulating a standard unattainable for most repositories for substance 

abuse PHI, should remove the restrictions on redisclosure by HIEs and their participants to any 

recipient who acknowledges that it is covered by, and adheres to, the restrictions under HIPAA. 

We believe, as discussed above, that HIPAA provides sufficient protections against the misuse or 

improper disclosure of substance abuse PHI. However, any entity who is not a covered entity 

under HIPAA or fails to acknowledge compliance therewith, should remain subject to the 

redisclosure consent requirements under Part 2 as currently drafted. 

4. Medical Emergency 

SAMHSA is considering adapting the medical emergency exception to make it more in-line 

with the statutory language and to give providers more discretion as to when a bona fide emergency 

exists. 79 FR 26931. 

Questions Posed: 

What factors should providers take into consideration in determining whether a medical emergency exists?
 

Are there specific use cases SAMHSA should take into consideration?
 

Are there patient concerns about the impact of this change on their privacy?
 

Comments: 

The current regulations state that information may be disclosed without consent “for the 

purpose of treating a condition which poses an immediate threat to the health of any individual 

and which requires immediate medical intervention.”9 In addition, for each emergency 

disclosure, the Part 2 provider must document in the medical record the name & affiliation of the 

recipient of the information, name of the individual making the disclosure, date and time of the 

disclosure and the nature of the emergency. The Governing Legislation, however, states that 

records may be disclosed to medical personnel to the extent necessary to meet a bona fide 

medical emergency. 

We fully support alignment of the Part 2 regulations with the language in the Governing 

Statutes. 

5. Qualified Service Organization (QSO) 

9

 42 C.F.R. § 2.51. 
 


 


 

 

 

 


 


 


 


 


 


 

 

Page 7 of 9 

SAMHSA is considering options for defining what information is covered under Part 2. 

Covered information could be defined based on what substance abuse treatment services are provided 

instead of being defined by the type of facility providing the services. 79 FR 26931. 

Questions Posed: 

Are there other use cases we should be taking into consideration?
 

Are there specific patient concerns about the impact of this change on their privacy?
 

Comments: 

We understand that payors and health management organizations have concerns related 

to disclosing PHI that is subject to Part 2 to health care entities (ACOs/CCOs) for the purpose of 

care coordination and population health management in order to help them identify patients with 

chronic conditions in need of more intensive outreach. Under the current regulations, substance 

abuse information may not be shared for these purposes without consent. 

We agree with SAMHSA that PHI subject to Part 2 should be available to and shared by 

health care entities for purposes of care coordination and population health management. We 

strongly encourage SAMHSA to put forward revised regulations that align the requirements for a 

QSO agreement with the requirements for a Business Associate Agreement under HIPAA 

because an organization often plays both roles for the same entity. 

6. Research 

SAMHSA is considering expanding the authority for releasing data to qualified 

researchers/research organizations to health care entities that receive and store Part 2 data, including 

third-party payers, health management organizations, HIEs, and care coordination organizations. 79 FR 

26932. 

Questions Posed: 

Are there factors that should be considered related to how current health care entities are organized, how they
 

function or how legal duties and responsibilities attach to entities that make up an umbrella organization?
 

Would this change address concerns related to research?
 

Are there specific privacy concerns associated with expanding the authority or releasing data to qualified
 

researchers/research organizations in this way?
 

Are there additional use cases that should be considered in the research context?
 

Comments: 

Under the current regulations, the Part 2 “program director” has to authorize the release 

of information for scientific research purposes, unless waived by the Institutional Review Board 
 

 

 

	 
 


 

 

 


 


 


 


 


 

 

 

 
 


 

Page 8 of 9 

(“IRB”).

10 This consent requirement has caused an issue for organizations that store patient 

health data, including data that are subject to Part 2, which may be used for research (e.g. health 

management organizations). Under the current regulatory framework, absent the consent from 

the “program director” or waiver by the IRB, these organizations do not have the authority to 

disclose Part 2 data for scientific research purposes to qualified researchers or research 

organizations. 

We request clarification regarding the reference to “health care entities.” That said, we 

support SAMHSA’s proposed expansion of the authority for releasing data to include qualified 

researchers and research organizations to other health care entities that receive and store Part 2 

data, including third-party payors, RHIOs, HIEs and CCOs, for the purposes of research, audit, 

or evaluation. 

7.	 Addressing Potential Issues with Electronic Prescribing and Prescription Drug
 

Monitoring Programs (PDMPs)
 

Part 2 protections include a prohibition on the redisclosure of information received directly from 

a Part 2 program.11 A pharmacy that receives electronic prescription information directly from a Part 2 

program must obtain patient consent to send that information to a PDMP, and patient consent is also 

required for the PDMP to redisclosed that information to those with access to the PDMP. 79 FR 

26932 (preamble). 

Questions Posed: 

How do pharmacy information system vendors anticipate addressing this issue? Are there specific
 

technology barriers SAMHSA should take into consideration?
 

Are there other concerns regarding 42 C.F.R. Part 2 and PDMPs? Please describe relevant use cases and
 

provide recommendations on how to address the concerns.
 

Are there patient concerns about the impact of e-prescribing and PDMPs on their privacy?
 

Comments: 

We believe that pharmacy data systems do not currently have mechanisms for managing 

patient consent or segregating data that are subject to Part 2 or preventing that data from reaching 

the PDMP. Pharmacy systems also lack the ability to identify which providers are subject to Part 

2, making it difficult to prevent the Part 2 data from reaching the PDMP. In addition, if a patient 

does not consent to sharing their data via e-prescribing, their only option for filling their 

prescription is to bring a paper prescription to the pharmacy. In this instance, since the 

information is given by the patient, it is not protected by Part 2. The patient, therefore, cannot 

prevent the information from reaching the PDMP which, in some states, is accessible by law 

enforcement and has the potential to lead to investigation/arrest and other forms of 

discrimination. 

10 42 C.F.R. § 2.52.
 11 42 C.F.R. § 2.13.
 
 

 

Page 9 of 9 

We propose the redisclosure requirements under Part 2 should be revised in a manner that 

excludes HIEs, pharmacies and PDMPs from the redisclosure consent requirements when 

disclosure is to a recipient who is covered by, and has acknowledged compliance with, HIPAA. 

Conclusion: 

HEALTHeLINK appreciates the opportunity to submit these comments. We look 

forward to working with SAMHSA to ensure maximum coordination of the final proposed rules 

with the current limitations, business practices and operational realities of HEALTHeLINK and 

the present state of United States health care. Should you have any questions regarding the 

comments in this letter, please contact the undersigned, Daniel E. Porreca, Executive Director, at 

2658 Walden Avenue, Suite 107, Buffalo, NY 14225, telephone number 1-716-206-0993 

extension 302. 

Very truly yours, 

/s/ Daniel E. Porreca 

Daniel E. Porreca 

Executive Director 
of Trustees 

2014-2015 

Paul SUmmergrad, M.D. 

President 

Renee L. Birder, M.D. 

President-Elect 

Maria A. Oquerdo, M.D. 

Secretary 

Frank W. Brown, M.D. 

Treasurer 

Jeffrey A. Lieberman, M.D. 

DUip V. Jeste, M.D. 

John M. Oldlam, M.D. 

Past Presidents 

Jeffrey L. Geller, M.D., M.P.H. 

Vivian B. Pender, M.D. 

Brian Crowley, M.D. 

Judith F. Kashtan, M.D. 

R. Scott Benson, M.D. 

Melirda L. Young, M.D. 

Jeffrey Akaka, M.D. 

Anita S. Everett, M.D. 

Molly K McV(Jof, M.D. 

Gail E. Robinson, M.D. 

Lara J. Cox. M.D., M.S. 

Ravi N. Shah, M.D. 

Trustees 

Assembly 

2014-2015 

Jenny L. B(Jofer, M.D. 

Speaker 

Glenn A. Martin, M.D. 

Speaker-Beet 

Daniel J. Anzia, M.D. 

Recorder 

Administration 

Saul Levin, M.D., M.P.A. 

CEO aoo Medical Diroctor 

Paul,: Burke 

Executive Diroctor 

American Ps;dliatric Foundat

American Psychiatric Association 

1000 Wilson Boulevard 

Suire 1825 

Arlington, VA 22209 

Telephone 703.907.7300 

Fax 703.907. 1085 

E-mail apa@psych.org 

Internet: www.psychiatry.org 

ion 

June 24th, 2014 

Pamela S. Hyde, JD 

Administrator 

Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Rockville, MD 20857 

Dear Administrator Hyde, 

The American Psychiatric Association, the national medical specialty representing over 

35,000 psychiatric physicians and their patients, is pleased to have the opportunity to 

comment on the recently convened Substance Abuse and Mental Health Services 

Administration (SAMHSA) listening session on proposed changes to Title 42 of the Code 

of Federal Regulations (CFR) Part 2 regarding the confidentiality of certain substance use 

disorder records. We appreciate that SAMHSA has given stakeholders an opportunity to 

comment and engage in this dialogue before expected proposed rulemaking. 

APA is fully aware of the difficulties in updating Part 2 regulations to comport with the 

Department of Health and Human Services‟ efforts to move to electronic health records, as 

well as with existing privacy standards. As mentioned in the listening session notice, Part 2 

standards have not been updated since 1987 and there have been enormous changes to the 

healthcare landscape in that time. Most notably, the enactment of the Health Insurance 

Portability and Accountability Act of 1996 (HIPAA) and the subsequent HITECH 

legislation have provided baseline national privacy standards for patients and providers. 

Further, the shift towards integrated models of care delivery systems and the widespread 

use of electronic health records have made guidance on Part 2 details and consideration of 

wider Part 2 reform critical. 

APA appreciates that SAMHSA is studying Part 2 closely and taking these challenges 

seriously, but cautions that any reforms under consideration should be made to promote 

integrated care and not be a barrier to care for specific patient populations in the future. 42 

CFR Part 2 currently covers “federally funded individuals or entities that „hold themselves 

out as providing, and provide, alcohol or drug abuse diagnosis, treatment or treatment 

referral‟ including units within a general medical facility that hold themselves out as 

providing diagnosis, treatment or treatment referral.” One of the changes that SAMHSA 

has proposed includes extending Part 2 to cover the information, as opposed to the entities 

or individuals providing the treatment. APA understands the concerns SAMHSA has 

regarding the difficulties in identifying who is a covered provider and how that may 

change over time, however, we believe that this change would be a significant expansion of 
 

 

 

 

 

 


	


	

the regulation and would result in a chilling effect on the provision of SUD treatment by clinicians 

who provide these services as a minority of their practice and are currently not covered by Part 2. 

SAMHSA released two rounds of subregulatory guidance on 42 CFR Part 2 several years ago. The 

first created an open question regarding Part 2 applicability to general psychiatrists that are federally 

supported but provide SUD treatment as a minority of their practice. This was very concerning to 

general psychiatrists in addition to the SBIRT and OBOT advocacy community. At that time, APA 

commented on the similar effects this expansion could have on the number of providers who might 

cease to offer SUD treatment services due to the administrative burden and financial costs of 

managing multiple privacy regimes that may not even be supported by the latest technology. 

SAMHSA clarified in the second FAQ that Part 2 covered entities consist of those whose principal 

practice consists of providing alcohol or drug abuse diagnosis, treatment or referral for treatment. 

Given the potential unintended consequences of expanding Part 2 applicability, APA urges SAMHSA 

to reconsider its proposed broadening of Part 2 applicability to general psychiatrists and other 

potentially affected physicians and allied professionals that provide “specialty substance abuse 

treatment services”. 

In the ongoing movement to merge necessary privacy protections with the expansion of electronic 

health records, APA recommends that all relevant HHS agencies including SAMHSA redouble their 

efforts to promote granular privacy control capabilities within electronic medical records and health 

information exchanges for all potentially sensitive health condition data. APA strongly believes that 

this type of built-in functionality has the potential to alleviate concern over mass electronic records 

sharing in the 21st century health delivery model while allowing for appropriate consensual record 

sharing between providers and across larger healthcare systems. The importance of these types of 

granular privacy standards were recognized by Congress in the HITECH Act, and their promise must 

be translated into reality. 

Once again, APA thanks you for your interest in studying this important topic and we look forward to 

reviewing SAMHSA‟s proposals as they progress through your agency‟s processes. APA is happy to 

be a resource on SUDs and we appreciate your review of our initial feedback regarding proposed 

reforms to 42 CFR Part 2. 

Sincerely, 

Saul Levin, M.D., M.P.A. 

CEO and Medical Director 
Association for Behavioral
%

Health and Wellness
%

Advancing benefits and services 

in 1nental health, substonce use 

and behavior chonge. 

June 25, 2014 

Submitted via Email: PrivacyRegulations@SAMHSA.hhs.gov 

Department of Health and Human Services 

The Substance Abuse and Mental Health Services Administration 

Room 5-1011 

1 Choke Cherry Road 

Rockville, MD 20857 

Re: Confidentiality of Alcohol and Drug Abuse Patient Records; 42 C.F.R. Part 2 (FR Doc. 2014-

10913)
�

Dear Sir or Madam: 

The Association for Behavioral Health and Wellness (ABHW) is writing to offer comments on the 

potential changes to 42 C.F.R. Part 2 under consideration which address the confidentiality of substance 

abuse treatment information for persons receiving substance abuse treatment services from federally 

assisted programs, as published in the Federal Register on Monday, May 12, 2014, by the Department of 

Health and Human Services (DHHS) Substance Abuse and Mental Health Services Administration. 

(SAMHSA). 1 

ABHW is an association of the nation's leading behavioral health and wellness companies. These 

companies provide an array of services related to mental health, substance use, employee assistance, 

disease management, and other health and wellness programs to approximately 125 million people in 

both the public and private sectors. ABHW and its member companies use their behavioral health 

expertise to improve health care outcomes for individuals and families across the health care spectrum. 

On behalf of its members, ABHW appreciates the opportunity to comment and urges you to consider and 

include our recommendations described in more detail below during revision of the SAMHSA 

confidentiality and consent regulations, which will be critical to improving the treatment and care 

coordination provided to one of the nation's most vulnerable populations. 

I. 	 � SAMHSA should revise 42 C.F.R. § 2.31(a)'s consent requirements to mirror HIPAA's

exceptions. 

Under 42 C.F.R. § 2.31( a), strict consent requirements are in place that mandate that written 

consent must include the name or title of the individual or the name of the organization to which 

disclosure can be made as well as numerous other fonn and descriptions requirements.2 

2 "Confidentiality ofAlcohol and Drug Abuse Patient Records," 79 Fed. Reg. 26929, 26929 (May 12, 2014). This is referred to as the "To Who1n" consent requirement. 

1325 G Street, NW, Suite 500, Washington, DC 20005 i Tel 202.449.7660 I Fax 202.449.7659 ! v,11r-Jw.abhw.org 

1
 

 

 

 

While the current regulations pennit organizations to share information with a specific form of consent 

from the patient, obtaining this consent is challenging and creates barriers to member-centric, integrated 

approaches to care, which are part of our cmTent health care framework. The consent requirements in 

42 C.F.R. § 2.31 are, at times, impractical or even impossible, given the particularities and conditions of 

the population undergoing treatment and ultimately harms substance use disorder patients by denying 

them an opportunity for better and more integrated care. From a clinical standpoint, characteristics of 

certain conditions make it difficult for organizations to repeatedly request and obtain consent, given the 

state of the patient's conditions at certain points in time. For example, consumers with substance use 

disorders can exhibit paranoia that makes it difficult to obtain consent. The need to obtain numerous 

written consents and re-consents hampers the ability of providers to communicate and effectively treat 

consumers when they have the greatest need for treatment. Additionally, Medicaid populations are 

oftentimes difficult to reach to obtain such consent as they may not have residential stability; granted, if 

the consumer arrives at the hospital, consent can be obtained, but critical time periods lapse when 

consumers should be receiving treatment. The inability to obtain consent ensures that consumer has a 

more difficult time receiving the care that they need. Finally, obtaining consent for minors with 

substance use disorders poses great challenges as the parents may need to provide consent, and it is 

difficult to obtain consent without revealing potential substance use disorders. 

Simply stated, the population that falls under the current regulations often has multiple health 

issues and would benefit the most from coordination of care and the integrated approaches to care that 

are available to all other populations. However, the cmTent consent requirements in 42 C.F.R. Part 2 

make these goals extremely challenging, if not impossible. 

Because the regulations do not take into account the current model for health care delivery and 

ultimately create baJTiers to a medically needy population, ABHW agrees with SAMHSA that the 

regulations need to be revised; and the issue of consent is at the forefront of the changes. ABHW 

supports incorporating the exceptions present in the Health Insurance Portability and Accountability Act 

(HIPAA) regulations ( allowing for disclosures related to treatment, payment, and - in some cases -

healthcare operations) into the consent requirements under 42 C.F.R. Part 2. 

A. Treatment 

HIP AA allows disclosures among providers for the treatment of a patient, a concept which 

should be reflected in the revised 42 C.F.R. Part 2 regulations proposed by SAMHSA. HIP AA provides 

that a "covered entity may disclose protected health information for treatment activities of a health care 

provider."3 Treatment is defined as 

... the provision, coordination, or management of health care and related services by one 

or more health care providers, including the coordination or management of health care 

by a health care provider with a third party; consultation between health care providers 

relating to a patient; or the refe1Tal of a patient for health care from one health care 

provider to another.4 

However, the cmTent regulations under 42 C.F.R. Part 2 do not allow organizations to effectively treat 

patients without written, specifically detailed consent, which is often impossible or impractical to obtain. 

3 45 C.F.R. § 164.506(c)(2). 4 Id. at§ 164.501. 

1325 G Street, NW, Suite 500, \AJashington, DC 20005 Tel 202.449.7660 I Fax 202.449.7659 I \NWW.abhw.org 
5 

Under the cmTent regulations, organizations cannot share consumer histories or treatment information or 

protocols with other providers or organizations. From a care delivery standpoint, outpatient providers 

may be unaware of care provided by inpatient providers. Similarly, inpatient providers may be unaware 

of care or medications provided in an outpatient setting. Or, if an individual who is in jail gets treahnent 

from a hospital and the hospital cannot disclose the consumer's treatment records, the individual may 

end up relapsing without the proper follow-up care. This inability to coordinate member-centric care is 

to the deh·iment of the consumer and could subject the consumer to inappropriate or repetitive treatment 

and therapies. For example, a treating provider may be unaware of potential adverse drug interactions 

when providers are unable to communicate, and the consumer does not or cannot provide a complete 

and accurate medical profile and history. If health infonnation for treatment was excepted from the 

consent rule under revised 42 C.F.R. Part 2, organizations would be able to better effectuate care 

coordination. 

Evidence supports that when providers keep records separate, there is a detrimental effect on the 

consumer's treatment. A recent report from Johns Hopkins has shown that maintaining behavioral 

health documentation private and separate from the rest of a patient's medical record leads to a higher 

incidence of patient readmissions to the hospital when com ared to cases where behavioral health and p physical health records are shared in the inpatient setting. Of the hospitals reviewed in that study, 

fewer than half had all inpatient psychiatric records in their electronic health record systems, and fewer 

than 25% gave non-psychiatrists full access to those records. Significantly, the study found that 

psychiatric patients were 40% less likely to be readmitted to the hospital within the first month after 

discharge in institutions that provided full access to those medical records.6 The leader of the study 

explained, "there are unintended consequences of trying to protect the medical records of psychiatric 

patients. When you protect psychiatric patients in this way, you 're protecting them from getting better 

care."7 Thus, revising the consent requirements in 42 C.F.R. Part 2 to incorporate an exception for 

patient treatment will enable providers to achieve better consumer outcomes and have more care 

coordination. 

B. Payment

HIP AA allows for disclosures of infonnation related to payment activities, which should be 

reflected in the revised 42 C.F.R. Part 2 regulations proposed by SAMHSA. 8 Payment encompasses the 

various activities of health care providers to obtain payment or be reimbursed for their services and of a 

health plan to obtain premiums, to fulfill their coverage responsibilities and provide benefits under the 

plan, and to obtain or provide reimbursement for the provision of health care.9 

"Separate may not be equal: A preliminary investigation of clinical correlates of electronic psychiatric record 

accessibility in medical centers," International Journal of Medical Informatics {December 20102). The survey was taken 

from psychiatry departments at 18 of the top American hospitals as ranked by U.S. News &World Report's "Best 

Hospitals" in 2007. The discussion of this study was contained in Lardiere, Michael R. "Unlocking and Sharing Behavioral 

Health Records: Movement Emerges to Exchange Sensitive Records through HI Es." Journal of AHIMA 84, no.4 {April 

2013): 36-40. 

6 Lardiere at 38. 

'Id.

8 A covered entity 1nay disclose protected health information to another covered entity or a health care provider for the 

rayment activities of the entity that receives the information. 45 C.F.R. 145.506(c)(2). 

' The general definition of payn1ent in 45 C.F.R. 145.501 provides examples of common pay1nent activities which include, 

but are not lin1ited to detennining eligibility or coverage under a plan and adjudicating clallns; risk adjusttnents; billing and 

collection activities; revie,ving health care services for 111edical necessity, coverage, justification of charges, and the like; 

I 1325 G Street, NW, Suite 500, VJashington, DC 20005 Tel 202.449.7660 j Fax 202.449.7659 j \,vww.abhv-1.org 
Without an exception to consent for payment, organizations find numerous challenges in 

conducting standard operations. If unable to release info1mation, providers may be unable to obtain 

reimbursement for care provided, or may need to exclude infonnation related to a secondary diagnosis 

which can negatively impact necessary follow-up care and coordination. Additionally, in some cases 

appeals can be delayed ( or decided without full infonnation) if, for example, a health plan needs to 

receive a second consent to provide infonnation to the external review organization. The challenges 

presented to providers in obtaining consent become magnified for health plans - the ultimate result is the 

consumer may not receive a full and fair review of the claims at issue. Thus, 42 C.F.R. Part 2 should be 

revised to include a consent exception for payment. 

C. Health Care Operations 

HIP AA pennits disclosures for healthcare operations under limited circumstances, which should 

be reflected in the revised 42 C.F.R. Part 2 regulations proposed by SAMHSA. HIP AA provides that a 

covered entity may disclose protected health information to another covered entity for 

health care operations activities of the entity that receives the information, if each entity 

either has or had a relationship with the individual who is the subject of the protected 

health info1mation being requested, the protected health infonnation petiains to such 

relationship, and the disclosure is: for conducting quality assessment and improvement 

activities, ... population-based activities ... , contacting of health care providers and 

patients with infonnation about treatment alternatives, and related functions that do not 

include treatment; [r]eviewing the competence or qualifications of health care 

professionals, evaluating performance ... conducting training programs ... ; or [f]or the 

purpose of health care fraud and abuse detection or compliance. 10

Under the current regulations, providers and organizations are unable to disclose the information 

covered by 42 C.F .R. Part 2 for health care operations. Obtaining consent to conduct health care 

operations is impractical and denies this population the full benefits of quality assessment and 

improvement activities. These barriers produced by the lack of an exception for health care operations 

affect consumer care as a whole, and the benefits achieved by care integration are often lost on this atrisk population because of the current regulations. 

The current limitations are dehimental to health care operations and negatively impact care coordination 

activities for the consumers. Allowing such disclosures would facilitate programs that monitor and aid 

in eliminating gaps in care for this vulnerable population. Additionally, patients in hospitals could 

receive better care coordination with the consent exception for health care operations, as managed care 

organizations often have information that can fill in gaps in a provider's records. Allowing care 

coordination through a "health care operations" exception would facilitate better treatlnent for these 

consumers. With this exception for disclosure, the managed care organizations could coordinate the care 

with the hospital which would ultimately lead to more effective outcomes. 

utilization review activities; and disclosures to consu1ner reporting agencies (Ii1nited to specified identifying information 

about the individual, his or her payment history, and identifying information about the covered entity). 

'° (internal numbering omitted} 45 C.F.R. § 164.506(c)(4). Health care operations activities are listed to those included in the 

definition at 45 C.F.R. § 164.501. 

1325 G Street, NV,J, Suite 500, \.Vashin9ton, DC 20005 ! Tel 202.449.7660 I Fax 202.449.7659 ! vvv-.:w.abhw.org 
II. At a minimum, SAMHSA should revise the consent requirements to permit more general 

descriptions of authorized recipients. 

In the event that SAMHSA is unwilling to consider incorporating the HIP AA exceptions to allow 

for disclosures for treatment, payment, and health care operations, SAMHSA should still revise the 

consent regulations. These revisions should enable organizations to more easily share certain health 

info1mation and ultimately effectuate better care, while at the same time meet privacy and 

confidentiality concerns. 

ABHW greatly appreciates the discussion of the difficulties the "To Whom" disclosure 

requirement presents to Health Information Exchanges (HIEs) and those coordinating care for substance 

abuse patients. 11 We fully support allowing consents to include more general descriptions of authorized 

recipients. We believe this will allow organizations to obtain the informed consent of an individual in 

an enviromnent where new providers might join a care team or health information exchange with 

regularity, without requiting multiple re-consents. Thus, consumers would be able to receive better care 

coordination among their providers, as they would be able to communicate; and the consent would not 

need to be obtained each time. Alternatively, this method of more generalized description of authmized 

recipients would still protect privacy interest of those consumers who wish to have more limited and 

stringent consent parameters. Those consumers concerned about excessive re-disclosure or the consent 

being too broad could simply opt not to give a general description, and list only their intended recipients 

specifically. 

Individuals authorizing the release of their private information should be presented their options 

in a simple and manageable way, rather than multiple forms. Therefore, we also suggest that the rules 

expressly pe1mit the combination of w1itten or electronic consents for the release of Part 2-protected 

infonnation with other similar consents, such as authorization to release PHI pursuant to 42 CFR 

164.508, or consents to participate in a Health Information Exchange. The decision to release Part 2 

info1mation could be indicated by a check-box, initiating or other additional indicium of consent specific 

to Part 2, but on the combined fmm. 

As to the issue of recipients receiving a list of providers or organizations that may access their 

information, and be notified regularly of changes to the list, ABHW suggests that disclosers of such lists 

be permitted to do so via websites. Alternatively, we suggest that disclosers be permitted to refer 

individuals to other existing lists, such as provider directories, rather than an individualized list. This 

requirement would align with the more general descriptions of authorized recipients of the information. 

III. The applicability of 42 C.F.R. Part 2 should be clarified in revised regulations to ensure 

ease of application. 

42 C.F.R. Part 2 currently applies to federally funded individuals or entities that "hold 

themselves out as providing, and provide, alcohol or drug abuse diagnosis, treatment or treatment 

refe1Tal" including units within a general medical facility that hold themselves out as providing 12 diagnosis, treatment or treatinent referral. ABHW agrees with SAMHSA's assessment that the cmTent 

construction of applicable entities poses difficulties for identifying which providers are subject to the 

requirements of 42 C.F.R. Part 2, and thus which infonnation is implicated, particularly which electronic 

11 79 Fed. Reg. at 26,931. 

12 42 C.F.R. 9 2.11. 79 Fed. Reg. at 26,930. 

1325 G Street, NV,/, Suite 500, \rVashington, DC 20005 i Tel 202.449.7660 ! Fax 202.449.7659 ! vv\,vw.abhw.org 
information. For example, payers cannot readily or easily verify what services an organization provides 

or how it holds itself out based on claims data. Moreover, many organizations conservatively apply a 

notice to all disclosures that 42 C.F.R. Part 2 could be implicated; thus, recipients of the information 

cannot reliably know which information is actually protected information under 42 C.F.R. Part 2. This 

results in organizations treating all mental health or alcohol or substance use disorder diagnosis and 

treatment information as protected under 42 C.F.R. Part 2, which creates barriers to integrated care. 

While providers and protected information could be defined in numerous ways under 42 C.F .R. 

Part 2, we suggest that the definitions be unambiguous, constant, and applied in a manner that facilitates 

ease of application so as not to result in over inclusiveness. If the definition is to be based on the 

provider type from which the information originated, providers covered under 42 C.F .R. Part 2 should 

be easily identifiable, perhaps through a national index of such entities. Additionally, if a sub-unit of a 

large provider organization is to be covered under 42 C.F .R. Part 2, it should be required to identify 

itself to recipients of information as separate from the larger organization (i.e., through a separate 

provider identification number). When the definition of who is covered under 42 C.F.R. Part 2 is 

ambiguous, the result is that recipients of information include more providers and information than are 

actually protected, resulting in less integration and more challenges to patient care. 

IV. The redisclosure provision should be revised to be broader, but limitations would still exist 

that pose issues for care. 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on 

redisclosure only applies to infonnation that would identify an individual as a substance abuser, and 

allows other health-related information to be redisclosed, if legally permissible. ABHW appreciates the 

proposed revisions which would allow other health related information to be redisclosed without 

authorization. However, these revisions still pose two problems for organizations. First, given the 

limitations on data segmentation that have been acknowledged, it may not be possible to release only 

non-substance abuse info1mation. This is particularly the case if an HIE must perform a "provenance" 

test, which may be difficult to administer electronically. Second, the end result of these revisions would 

still be the presentation of a clinically incomplete record of a patient's treatment, since substance abuse 

infonnation cannot be redisclosed. This would still pose the same clinical risks, failure to coordinate 

care, and lack of an integrated approach, which threaten the reliability of electronically shared health 

records. 

V. 9The Medical emergency exception should be broadened to be proactive in preventing 

emergencies. 

The current regulations regarding the medical emergency exception state that infonnation may 

be disclosed without consent "for the purpose of treating a condition which poses an immediate threat to 

the health of any individual and which requires immediate medical intervention."13 SAMHSA is 

considering amending this standard to allow providers to use the medical emergency provision to 

prevent emergencies or to share information with a detoxification center when a patient is unable to 

provide inf01med consent due to their level of intoxication. 14 ABHW commends SAMHSA in its goal 

of preventing emergencies and believes that the standard should be expanded. The exception should 

encompass more than intoxication situations involving consent. Providers should be able to utilize their 

" 42 C.F.R. § 2.51; 79 Fed. Reg. at 26,931. 

14 79 Fed. Reg. at 26,931. 

1325 G Street, NW, Suite 500, Washington, DC 20005 ! Tel 202.449.7660 j Fax 202.449.7659 i v,ww.abh\lv.org 
 

knowledge of the consumer's treatment to be proactive in preventing emergencies rather than reactive 

after the emergency has occurred. For example, if a consumer arrives at the hospital and is in danger of 

alcohol withdrawal, without the knowledge of the consumer's history, the treating team may not be 

aware of whether the consumer will go into withdrawal. In order to prevent a medical emergency, 

providers should be able to utilize the medical emergency exception in broader circumstances, and the 

updated regulations should be revised to achieve this goal. 

VI. Qualified service organizations should be able to enter into multi-party agreements for the 

sharing of health information. 

One potential solution SAMHSA is considering includes expanding the definition of a qualified 

service organization (QSO). The definition would explicitly include care coordination services and 

allow a QSO Agreement (QSOA) to be executed between an entity that stores 42 C.F.R. Part 2 

info1mation, such as a payer or an ACO that is not itself covered under 42 C.F.R. Part 2, and a service 

provider. 15 ABHW suppo1is expanding the use of QSOAs as a useful means of enabling data sharing 

amongst payers and providers, ACOs or H!Es. However, we suggest that in evaluating this option, 

SAMHSA consider broadening this idea further, to include developing an agreement that is not merely a 

two-party, one-way arrangement for the storage or use of data, but rather a multi-paiiy agreement for the 

multi-directional sharing of infonnation covered under 42. C.F.R. Part 2. The multi-pai·ty agreement 

could establish a baseline of collective responsibilities for ensuring privacy of the disclosed infonnation. 

ABHW supports that such disclosure of information through agreements would enable better care 

coordination and population health management. The ability to enter into these multi-party agreements 

would enable organizations to identify and care for consumers with a need for more intensive outreach, 

which ultimately would lead to more effective care. 

We appreciate the opportunity to comment on the potential revisions of 42 C.F.R. Paii 2. If you 

would like to discuss our comments, please contact Pamela Greenberg, President and CEO, at (202) 

449-7660 or greenberg@abhw.org. 

Pamela Greenberg, MPP

President and CEO 

Association for Behavioral Health and Wellness 

15 42 C.F.R. § 2.11; 79 Fed. Reg. at 26,931. 

1325 G Street, NW, Suite 500, \rVashington. DC 20005 ! Tel 202.449.7660 ! Fax 202.449.7659 I \.VW\-v.abhv-1.org 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

June 24, 2014 

Cathy J. Friedman 

Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Rockville, MD 20857 

Submitted electronically to PrivacyRegulations@SAMHSA.hhs.gov 

Dear Ms. Friedman: 

On behalf of our 143 member hospitals and related health systems, the Minnesota Hospital 

Association (MHA) appreciates the opportunity to comment on the proposed changes to 42 CFR 

Part 2, Confidentiality of Alcohol and Drug Abuse Patient Records Regulations. 

Minnesota hospitals and health systems support the integration of mental, behavioral, and 

physical health care. This integration includes the ability of providers to access clinically 

appropriate health care information such as patient records related to substance use treatment. 

Providers need to be able to safely treat the entire patient. Without this important information, 

patients may not be receiving the most appropriate care. Patients also do not receive the full 

benefits of care coordination when important treatment records are not disclosed. Finally, 

segregating substance abuse treatment records reinforces the very stigma the regulations were 

originally put in place to counteract. 

MHA supports changing 42 CFR Part 2 to make substance use treatment records available to 

other health care providers. As noted in the background of the notice, the current consent 

requirements make it difficult for providers to exchange important information regarding patient 

care. Minnesota has led the nation in providing community-based care to people living with 

mental illnesses, including substance use disorders. Updating 42 CFR Part 2 will enhance 

providers’ abilities to continue delivering care in the community and coordinate with acute care 

when necessary to ensure patients receive appropriate treatment and support. 

a. Applicability of 42 CFR Part 2

MHA supports defining covered information based on services provided instead of by the type of

facility providing the service.

b. Consent requirements

MHA supports more flexibility in the consent notice requirements, as proposed in part b of the

notice.
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

c. Redisclosure 

MHA supports changes regarding redisclosure. Electronic health records cannot easily segment 

substance use treatment records from other health records. However, the proposal to continue 

current practice for patient treatment data collected by a practice that exclusively treats 

addiction seems to contradict the proposal to redefine covered information by service as 

opposed to facility. MHA recommends clarifying this discrepancy. 

d. Medical emergency 

MHA supports the proposal to adapt the medical emergency exception to make it more in-line 

with statutory language allowing record disclosure to medical personnel in order to meet a bona 

fide medical emergency by giving providers more discretion as to when a bona fide emergency 

exists. 

e. Qualified service organization 

MHA supports expanding the definition of a qualified service organization to explicitly include 

care coordination services and allow a QSO Agreement to be executed between an entity that 

stored Part 2 information and a service provider. 

f. Research 

MHA supports expanding authority for releasing data to qualified researchers/research 

organizations to health care entities that receive and store Part 2 data. 

g. Addressing potential issues with electronic prescribing and prescription drug monitoring 

programs 

MHA supports protecting individuals who have received substance use treatment from having 

that information used against them by law enforcement. 

Thank you again for the opportunity to comment. Please contact me at (651) 659-1405 or 

jmcnertney@mnhospitals.org with any questions. 

Sincerely, 

Jennifer McNertney, MPP 

Policy Analyst 
AzAHP c/o Gallagher & Kennedy, P.A. 

2575 E. Camelback Rd. 

Phoenix, AZ 85016 

602-530-8160 

Arizona Association of Health Plans 

June 24, 2014 

Via email to PrivacyRegulations@SAMHSA.hhs.gov 

The Substance Abuse and Mental 

Health Services Administration 

1 Choke Cherry Road, Room 5-1011 

Rockville, MD 20857 

Re: 42 CFRPart 2 

Document Citation 79 FR 26969 

Document No. 2014-10913 

To Whom It May Concern: 

The Arizona Association of Health Plans ("AzAHP") submits these comments in 

response to the Notice of Public Listening Session on the "Confidentiality of Alcohol and 

Drug Abuse Patient Records" as published in the May 12, 2014 Federal Register (79 Fed. 

Reg. 26,929-32). 

Background 

AzAHP is a 50l(c)(3) tax-exempt organization whose membership consists of health 

plans that contract with the Arizona Health Care Cost Containment System (Arizona's 

Medicaid agency, known as "AHCCCS"). AzAHP's mission is to work with elected 

officials, AHCCCS administration, health care plans, health care providers, and 

consumers to keep quality health care available and affordable for all Arizonans. As part 

of that mission, AzAHP developed a statewide credentialing process for all health plans 

and providers in the state, eliminating duplicated work and administrative burden for 

plans and providers alike. 1

AzAHP's newest member is Mercy Maricopa Integrated Care ("Mercy Maricopa"). 

Mercy Maricopa is an Arizona nonprofit corporation sponsored by four tax-exempt 

nonprofit and governmental healthcare providers based in Maricopa County (Phoenix), 

Arizona. Mercy Maricopa was selected by the Arizona Department of Health Services 

("ADHS"), in collaboration with AHCCCS, to provide integrated, whole-health care for 

Deb Gullett, "Alliance Aids Health-Care Credentialing," Arizona Republic (Nov. 24, 2013), available at 

http://www.azcentral.com/ opinions/articles/20 l 31124alliance-aids-health-care-credentialing.html. 

Bridgeway I Carel st I Health Choice Arizona I Health Net I Mercy Care I MIHS 

MMIC I Phoenix Health Plan I The UA Health Plans I UnitedHealthcare Community Plan 

1 
2 National Association of State Mental Health Program Directors ("NASMHPD") Medical Directors 

Council, "Morbidity and Mortality in People with Serious Mental Illness," at 4, 5 (Oct. 2006), available at 

http://www.nasmhpd.org/docs/publications/MDCdocs/Mortality%20and%20Morbidity%20Final%20Repor 

t%208.18.08.pdf; Charles Arnold, "New Care System ls Critical to Mentally lll," Arizona Republic (July 7, 

2013), available at http://www.azcentral.com/opinions/articles/20 l 30703new-care-system-criticalmentally-ill.html. 

3 NASMHPD Report, supra note 2, at 4, 5. 

Bridgeway I Carel st I Health Choice Arizona I Health Net I Mercy Care I MIHS 

MMIC I Phoenix Health Plan I The UA Health Plans I UnitedHealthcare Community Plan 

The Substance Abuse and Mental 

Health Services Administration 

June 24, 2014 

Page 2 

approximately 18,000 "members" with serious mental illness ("SMI"), approximately 

340,000 adult members with general mental health and substance abuse issues 

("GMHSA"), and approximately 390,000 child and adolescent members. We understand 

that the state's decision to combine behavioral health care services with acute health care 

management, at the scale of the Maricopa County contract, is unique in the Nation and is 

an innovative effort to address significant health issues among the SMI and GMHSA 

populations. In the United States, life expectancy for persons who are SMI is 25 years 

less than for the general population; in Arizona, life expectancy for persons who are SMI 

2 is 32 years less than the general population. 

Under the state contract, Mercy Maricopa contracts with ADHS to serve as a communitybased organization called the Regional Behavioral Health Authority ("RBHA") to 

administer behavioral health services in Maricopa County and, in coordination with 

AHCCCS, acute health care services for Medicaid and Medicare eligible members. As 

the RBHA, Mercy Maricopa then contracts with a wide, community-based network of 

health care providers, both behavioral and acute, to deliver services to eligible members. 

A key requirement of the state contract with Mercy Maricopa is significant, ongoing, and 

integrated care coordination among members and their families, service providers, and 

benefit managers. Experts have concluded that reduced life expectancy for persons with 

behavioral health conditions is largely caused by treatable non-behavioral conditions, 

including such risk factors as smoking, obesity, substance abuse, and inadequate access 

to care. 3 The integrated approach will lead to better care by focusing on prevention and 

wellness, screening for issues that could lead to illness and directing members to early 

treatment, avoiding redundancies, and reducing hospital admissions and crisis service 

use. To support care coordination, Mercy Maricopa will be implementing an electronic 

Health Infonnation Exchange ("HIE") to facilitate infonnation sharing among members' 

behavioral and physical health care providers to improve the delivery and quality of care. 

Information Challenges Relating to Mercy Maricopa's Members 

Infonnation sharing is vital to Mercy Maricopa's mission of providing high-quality, 

integrated physical and behavioral health care to its members. To fulfill the state contract 

requirements, Mercy Maricopa must provide meaningful care coordination, particularly 
The Substance Abuse and Mental 

Health Services Administration 

June 24, 2014 

Page 3 

because our members have many co-occurring conditions. Additionally, obtaining health 

information directly from members who may have problems with cognitive ability, 

memory, or the ability to communicate can present paiiicular challenges. Consequently, 

it may be more difficult for health providers to rely on members to obtain necessary, 

accurate medical information. This danger is particularly present in the crisis-services 

setting. 

Access to members' prior treatment records, including substance abuse treatment records, 

is especially c1itical if that treatment included pharmacological interventions. Many 

members have complicated prescription drug regimens. Polyphannacy, the use of a large 

number of medications, can create significant problems for our members' health. At the 

same time, other members may have difficulty following their prescription regimen. 

However caused, gaps in information relating to members' medication usage can pose 

serious safety issues and can compromise the effectiveness of members' care. 

Proposed Changes to 42 C.F.R. Part 2 

Paii 2 creates several barriers to the full integration of a patient's health information and 

imposes substantial burdens. Most significantly, Mercy Maricopa often will have to 

apply the more stringent requirements of Part 2 to all members' records, because a large 

number may be receiving, or have received, substance abuse treatment. Mercy Maricopa 

plans to include Part 2 records in the HIE, because integrated care is so important to those 

members who receive substance abuse treatment, and because without sharing and access 

to information, Mercy Maiicopa cannot fulfill its care coordination and management 

functions under the state contract. Thus, Part 2 will impose substantial burdens on 

members and participating providers, and it will often have the effect of depriving 

members of fully integrated care when Part 2's requirements cannot be satisfied. 

Accordingly, AzAHP supports revising Part 2 to facilitate greater infomrntion sharing 

among the entities involved in a patient's integrated care. AzAHP supp01is applying the 

same protections to drug or alcohol treatment information that the Health Insurance 

Portability and Accountability Act of 1996 ("HIP AA") provides to protected health 

infonnation. Part 2 was last updated in 1987, before enactment of HIP AA. The HIP AA 

Privacy Rule, 45 C.F.R. 164 Part E, now provides stringent protections to protected 

health infonnation, and its protections are familiar to the broader health care community. 

AzAHP believes that the protections of the HIP AA P1ivacy Rule st1ike the appropriate 

balance between protecting health info1mation and facilitating the infonnation shaiing 

that is already vital and which will become increasingly important to all people, not just 

the particularly fragile members served by Mercy Maricopa, as integrated providers, care 

Bridgeway I Carel st IHealth Choice Arizona IHealth Net IMercy Care IMIHS 


MMIC I Phoenix Health Plan I The UA Health Plans I UnitedHealthcare Community Plan 
 

The Substance Abuse and Mental 

Health Services Administration 

June 24, 2014 

Page4 

managers, and accountable care organizations take greater prominence in health care in 

the entire country. 

Significantly, the HIP AA Privacy Rule does not provide heightened protection to most 

types of sensitive infonnation, including, for example, HIV IAIDS infomrntion and most 

mental health info1111ation. We believe that the protections of the HIP AA Privacy Rule 

are sufficient to protect drug and alcohol treatment infonnation as well. 

AzAHP addresses the specific proposals regarding consent, redisclosure, medical 

emergencies, and Qualified Service Organizations below, in the comment template 

provided by SAMHSA: 

Consent Requirements 

While technical solutions for managing consent collection are possible, SAMHSA is 

examining the consent requirements in § 2.31 to explore options for facilitating the flow 

of infom1ation within the health care context while ensuring the patient is fully info1med 

and the necessary protections are in place. Specifically, we are analyzing the current 

requirements and considering the impact of adapting them to: 

1. Allow the consent to include a more general description of the individual, 

organization, or health care entity to which disclosure is to be made. 

2. Require the patient to be provided with a list of providers or organizations that may 

access their infonnation, and be notified regularly of changes to the list. 

3. Require the consent to name the individual or health care entity permitted to make 

the disclosure. 

4. Require that, if the health care entity pennitted to make the disclosure is made up of 

multiple independent units or organizations, the unit, organization, or provider 

releasing substance abuse related information be specifically named. 

5. Require the consent fom1 explicitly describe the substance abuse treatment 

infonnation that may be disclosed. 

FR Citation: 79 FR 26931 

Questions: 

• Would these changes maintain the privacy protections for patients? 

• Would these changes address the concerns of HIEs, health homes, ACOs, and 

CCOs? 

• Would these changes raise any new concerns? 

Public Comment Field: 

To facilitate providing the highest quality integrated health care for members, AzAHP 

( on behalf of Mercy Maricopa and the other AzAHP members) supports eliminating the 

requirement for patient consent for treatment, payment, and health care operations. 

Instead, we suppo1i pem1itting disclosure of drug or alcohol treatment inforn1ation for 

Bridgeway I Carel st I Health Choice Arizona I Health Net I Mercy Care I MIHS 


MMIC IPhoenix Health Plan IThe UA Health Plans IUnitedHealthcare Community Plan 
 

The Substance Abuse and Mental 

Health Services Administration 

June 24, 2014 

Page 5 

treatment, payment, or health care operations without patient consent as cun-ently 

pennitted by the HIP AA Privacy Rule. We believe that the protections which the 

HIPAA Privacy Rule provides for almost all other types of sensitive health infomrntion, 

including those with similar, or possibly greater, potential for "stigma," are sufficient to 

protect drug and alcohol treatment information as well. We believe further that the 

protections of the HIPAA P1ivacy Rule strike the appropriate balance between 

protecting health information and facilitating the infonnation sharing that is vital to 

serving Mercy Maricopa's members and satisfying the goals ofthe state contract. 

Alternatively, at a minimum, AzAHP supports the proposal to eliminate the "To Whom" 

requirement from 42 CFR § 2.31 to allow a consent to include a more general 

description of the individual, organization, or health care entity to which disclosure is to 

be made. Because the "To Whom" requirement requires a consent to list by name all 

recipients of information, it deprives patients of the autonomy to consent prospectively 

to disclosure of drug and alcohol treatment information to all entities that will be 

involved in that patient's treatment, which many patients may want to do. Further, 

whenever these specific, advance consents are not in place, such as when a new provider 

joins Mercy Maricopa's network, patients will be deprived of the benefits of fully 

integrated care. In a growing community like Maricopa County, having to add new 

providers to every consent fmm creates an unnecessary and fruitless administrative 

burden. 

The "To Whom" requirement also places significant burdens on our members and 

providers. To satisfy this requirement, a member must sign a new consent every time 

the member wants a new provider to receive his or her infmmation. AzAHP notes that 

this requirement will impose greater obstacles once Mercy Maricopa begins operating 

its HIE, limiting access to complete and accurate infomrntion to only the providers 

named in each member's consent f01m(s). 

AzAHP supp01is continuing to allow a consent to include a general description of the 

individual, organization, or health care entity disclosing the infornrntion. We disagree 

with the suggestion that the consent should be required to name the individual or health 

care entity pennitted to make the disclosure. Each AzAHP member's network of 

providers is large and may change frequently. Such a requirement would create the 

same burdens that the current "To Whom" requirement currently creates. 

Bridgeway ICarel st IHealth Choice Arizona IHealth Net IMercy Care IMIHS 


MMIC I Phoenix Health Plan I The UA Health Plans I UnitedHealthcare Community Plan 
 

Bridgeway I Carel st I Health Choice Arizona I Health Net I Mercy Care I MIHS 

MMIC I Phoenix Health Plan I The UA Health Plans I UnitedHealthcare Community Plan 

The Substance Abuse and Mental 

Health Services Administration 

June 24, 2014 

Page 6 

Redisclosure 

SAMHSA 1s considering revising the redisclosure provision to clarify that the 

prohibition on redisclosure only applies to infomrntion that would identify an individual 

as a substance abuser, and allows other health-related information shared by the Part 2 

program to be redisclosed, if legally pennissible. This would allow HIT systems to 

more easily identify inforn1ation that is subject to the prohibition on redisclosure, 

enabling them to utilize other technological approaches to manage redisclosure. If data 

are associated with information about where the data were collected ( data provenance) 

which reveals that the data were collected by a practice that exclusively treats addiction, 

the data would still be protected under the proposed change. 

FR Citation: 79 FR 26931 

Questions: 

• Would this type of change facilitate technical solutions for complying with 42 CFR 

Part 2 in an EHR or HIE? 

• Would these changes maintain the privacy protections for patients? 

Public Comment Field: 

For the reasons explained above, AzAHP supports aligning the protections of Paii 2 

with the protections provided by the HIP AA Privacy Rule. We believe that the 

protections of the HIP AA Privacy Rule strike the appropriate balance between 

protecting health information and facilitating the sharing infonnation vital to integrated 

care. Under the HIP AA Privacy Rule, no redisclosure limitations would apply to drug 

or alcohol treatment infonnation covered by Part 2. 

Alternatively, at a minimum, AzAHP supports the proposal to limit Part 2's redisclosure 

provision to only information that identifies individuals as substance abusers, and allow 

other health-related information received from a Part 2 program to be redisclosed as 

otherwise legally pe1missible. 

Medical Emer ency 

SAMHSA is considering adapting the medical emergency exception to make it more 

in-line with the statutory language and to give providers more discretion as to when a 

bona fide emergency exists. For example, ainending this standard to allow providers to 

use the medical emergency provision to prevent emergencies or to share information 

with a detoxification center when a patient is unable to provide inforn1ed consent due to 

their level of intoxication. 

FR Citation: 79 FR 26931 
Qualified Service Or*anization ("QSO") 

SAMHSA is analyzing the regulations to identify options for allowing Part 2 data to flow 

to health care entities for the purpose of care coordination and population management 

while maintaining patient protections. One potential solution includes expanding the 

definition of a qualified service organization (QSO; § 2.11) to explicitly include care 

coordination services and to allow a QSO Agreement ("QSOA") to be executed between 

an entity that stores Part 2 inforn1ation, such as a payer or an ACO that is not itself a 

Part 2 program, and a service provider. 

FR Citation: 79 FR 26931 

Questions: 

• Are there other use cases we should be taking into consideration? 

• Are there specific patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

For the reasons explained above, AzAHP supports aligning the protections of Part 2 with 

the protections provided by the HIP AA Privacy Rule as the appropriate balance between 

protecting health information and facilitating infonnation sharing. 

Alternatively, at a minimum, AzAHP supports the proposals to expand the definition of a 

QSO to explicitly include care coordination services, and to allow a QSOA to be 

executed between an entity that stores Part 2 infonnation, such as a payer, and an entity 

serving as a QSO. 

The Substance Abuse and Mental 

Health Services Administration 

June 24, 2014 

Page 7 

Questions: 

• What factors should providers take into consideration in determining whether a 

medical emergency exists? 

• Are there specific use cases SAMHSA should take into consideration? 

• Are there patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

As noted above, AzAHP suppmis aligning the protections of Paii 2 with the protections 

provided by the HIP AA Privacy Rule as the appropriate balance between protecting 

health information and facilitating the sharing of infonnation that is vital to integrated 

care. Under the HIP AA Privacy Rule, all drug or alcohol treatment information could be 

disclosed in a medical emergency without patient consent. 

Alternatively, at a minimum, AzAHP supports the proposal to give health care providers 

more discretion to determine when a medical emergency exists. We support giving 

providers full discretion to make such a detern1ination, because providers are in the best 

position to make those critical safety decisions. 

. 

Bridgeway I Carel st I Health Choice Arizona I Health Net I Mercy Care I MIHS 

MMIC I Phoenix Health Plan I The UA Health Plans I UnitedHealthcare Community Plan 
The Substance Abuse and Mental 

Health Services Administration 

June 24, 2014 

Page 8 

In conclusion, AzAHP thanks SAMHSA for issuing the Notice and calling the Public 

Listening Session on this issue. All AzAHP members are wrestling with integration of 

care, but Mercy Maricopa, in particular, is facing unnecessary difficulties in providing 

modem, highest quality, and integrated care to a population that badly needs a new 

paradigm. We are pleased that SAMHSA is working hard to get in front of these 

problems and look forward to assisting in the process if you have any questions about the 

day-to-day impact of the Part 2 regulations on our efforts to improve all aspects of the 

health of Arizona residents. 

Very truly yours, 

ARIZONA ASSOCIATION OF HEALTH PLANS, INC. 

By: 

Deb Gullett 

Executive Director 

DAG/plp 

23585-1/4286062 

Bridgeway I Carel st I Health Choice Arizona I Health Net I Mercy Care I MIHS 

MMIC I Phoenix Health Plan I The UA Health Plans I UnitedHealthcare Community Plan 
 

 

 

 

 

From: Rick Briggs [mailto:rbriggs@westfallcd.com] 

Sent: Tuesday, June 24, 2014 9:39 PM 

To: Privacy Regulations (SAMHSA) 

Cc: Jeff Smith 

Subject: Review of 42cfr 

It is our perspective that it is vital that long established privacy protections for persons with alcohol and 

other substance use disorders are vital to maintaining the trust and engagement necessary to enable 

successful treatment of these chronic and costly health conditions. Stigma remains unfortunately 

common, and remains a significant barrier to people promptly seeking treatment. Erosion of privacy 

protections increased the risk of stigma driving patient decisions to not go to treatment, and therefore 

becoming much more ill before seeking services. 

Please maintain patient privacy and dignity, it is needed and deserved. 

Thank you for considering our input on this review of the regulations. 

Sincerely, 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

From: grschoener [mailto:grschoener@aol.com]
 

Sent: Tuesday, June 24, 2014 11:50 PM
 

To: Privacy Regulations (SAMHSA)
 

Subject: Suggested changes in CFR - 42
 

Federal Law 92-255 and CFR-42 were created in an era where the federal government was trying to 

make local treatment possible by limiting police ability to execute search warrants. It was believed that 

addicts would not come for help if local police could do this. The central issue was that the federal govt. 

wanted to stop bringing everyone to Lexington, Ky for residential treatment. Along with this came 

federal funds. 

Today of course the definition of federal “funding” has evolved – most programs do not in fact get 

federal grants as they did back in the early 1970’s. 

My career began in 1969 and I was a consultant to the Special Action Office on Drug Abuse prevention in 

the Nixon White House, the Drug Abuse Section of the US Office of Education (Dr. Helen Nowlis), 

Secretary of HEW Elliot Richardson, etc. So I have seen this evolution over a 45 year period. 

CFR-42 was changed in the late 1980’s to authorize the reporting of child abuse. Reporting follows state 

laws. The same is true for records access after death – this follows state laws. 

So, what about: (a) Elder abuse or vulnerable adults act reporting? 

(b) State duties to report misconduct by licensed health professionals? 

(c ) breaching confidentiality to prevent client suicide 

(d) duty to warn or protect in situations where there is a danger of serious harm done 

by client to third parties. 

Substance abuse licensure laws in states like Minnesota require that counselors forewarn clients of 

these duties. This is done in the “informed consent” statement handed out at the time of intake,. 

However, this “solution” is nonsense – it is neither ethical nor would it really pass the test for truly 

“informed consent.” It is necessary BECAUSE CFR-42 does not authorize any of this. Experts have always 

believed that counselors have a duty to warn and that there is no reasonable argument that substance 

abuse counselors should not have the same duties as other counselors and therapists. 

CFR-42 is the problem. 

I teach boundaries and ethics to all manner of professionals, but have been doing so in the substance 

abuse field for 40+ years. It is time to clean up this rule. 

Glad to discuss further. 

Gary R. Schoener, M.Eq., Licensed Psychologist 

Director of Consultation & Training 

Walk-In Counseling Center 
grschoener@walkin.org www.walkin.org 

(612) 870-0565 ext. 107
 
SMRT U•UU H&UfC\l~tll1llt\lJ'

NE\ 'V\J I '" T
l fflt!I 

June 24, 2014 

The Substance Abuse and Mental Health Services Administration, 

1 Choke Cherry Road, 

Rockville, MD 20857 

Document Citation 79FR 26929 

Document Number 2014-10913 

Comments Regarding Proposed Changes to 42 CFR Part 2 

The Secure Medical Records Transfer Network (SMRTNET) is an Oklahoma based health 

information network that contains records on nearly 70% of Oklahoma residents. A focus 

of the network since its funding in 2006 by AHRQ has been identifying methods of 

exchanging mental health and substance abuse records with appropriate patient and 

legal protections. 

Over these years SMRTNET has worked closely with medical providers, mental health 

and substance abuse professionals, attorneys, and had discussions with privacy officers 

at our state mental health agency and SAMHSA to explore possibilities regarding what is 

possible for exchange. And, gratefully, through our efforts and a grant to Oklahoma by 

SAMHSA and HRSA we are in the process of successfully connecting over twenty large 

behavioral health facilities to our medical data sharing system along with other HIOs. 

We appreciate the efforts ofSAMHSA and its conference on June 11 to explore ways to 

develop a capacity to share information under 42 CFR. Currently, as has been discussed, 

the exchange of 42 CFR protected information is simply not practical for HIOs given the 

advanced notice of providers, use cases, time limitation, subsequent release and other 

issues. 

To make our thoughts as concise as possible, we would observe and suggest the 

following. 

Sharing Information from 42 CFR programs to providers seeing the same patient Is vital 

to patient safety. The specific types of disorders, medications and problems in 42 CFR 
programs tend to carry more medical risk and therefore sharing this information to 

providers seeing the same patient is vital to patient safety and care in order to avoid 

medical injury and reduction in the quality of medical services. 

Patients should be given the right to share their Information In the method that they 

choose rather than the government making these decisions for them. The right of 

patients to direct information to caregivers has been working for over two decades 

under HIPAA and an option to utilize the same methods and rights under HIPAA should 

be extended to patients covered under 42 CFR. 

The same type of information as in 42 CFR has been shared across providers and HIOs 

for many years with patient consent In opt-out and opt-In models. The same type of 

patient data in 42 CFR programs from sources not covered under 42 CFR are exchanged 

daily across the country using HIPAA precautions. Therefore, reforms to 42 CFR would 

not truly resolve the issue. Opt out rates are typically in these exchanges at under 5 

percent. 

All patient information, not just 42 CFR program data, should be protected from 

misuse from non-provider sources. It is important to note that patient data such as 

pregnancy, STDs, and cancer can be misused by improper sources. Sensitive data is in 

the eye of the beholder. SAMHSA should work with other regulatory groups and states 

to strengthen protection for all medical data 

Again, we want to acknowledge the serious need for immediate reform in this area due 

to patient safety and data rights issues. We would be very pleased to support SAMHSA in 

their efforts in this regard. 

Sincerely, 

Mark Jones, Director 

Secure Medical Records Transfer Network (SMRTNET) 

Mobile 918 931 9410 

www.SMRTnet.org 
 

 

 

 

 

 

 

 

 

 

 

 

 


 


 


 


 

From: Brown Randy T [mailto:Randy.Brown@fammed.wisc.edu]
 

Sent: Tuesday, July 01, 2014 2:50 PM
 

To: Privacy Regulations (SAMHSA)
 

Subject: 42 CFR
 

As an addiction medicine physician with training in primary care, I write to you in enthusiastic support of 

considering significant revision to (or repeal of) 42CFR pt 2. 

The statute perpetuates significant barriers to needed care and support of patients in recovery, and 

impairs the education of primary care physicians in how to appropriately care for their patients with 

substance use disorders. Feedback from consulting specialists is a major aspect of clinical physician 

education. 42 CFR interferes with that invaluable exchange of information. Primary care will not 

optimally assess or address substance use disorders until 42 CFR is revised (or repealed). Given the 

frequently relapsing remitting nature of substance use disorders, this is a travesty. Primary care needs to 

know how to support patients and follow them longitudinally. 

Through maintaining a model of specialist care “behind closed doors,” (and likely without the level of 

open accountability visited upon other sorts of specialist practices) 42 CFR pt 2 also serves to perpetuate 

the stigma attached to substance use disorders and their treatment in the lay and professional 

communities. 

I do understand that U.S. society continues to apply significant stigma to substance use disorders. I also 

understand that a primary motivation for 42 CFR part 2 is eliminating the risk of that stigma, so that an 

addicted individual might be more likely to seek care. (I don’t know that this belief has been 

substantiated in a scientifically meaningful way, and would appreciate references, if they are available.) 

My belief is that with appropriate integration, collaboration, and accountability, this would fade over 

time (much the way it has started to with diagnoses such as depression, which were highly stigmatized 

only a couple decades ago). However, at least patients could be given the choice to seek out confidential 

care or to participate in a second-tier of an addiction care system, in which collaboration and effective 

communication are part and parcel. 

I sincerely appreciate your consideration. 

Warmest regards, 

Randall Brown MD, PhD, FASAM 

Associate Professor, Dept of Family Medicine, UW School of Medicine & Public Health 

Director, Center for Addictive Disorders, UW Hospital & Clinics 

Director, UW Addiction Medicine Fellowship Program 

Medical Director, VA Interprofessional Advanced Fellowship in Addiction Treatment 

Medical Director, Overdose Prevention Program, AIDS Resource Center of Wisconsin 

Center Scientist, Center for Health Enhancement System Studies 

1100 Delaplaine Ct 

Madison, WI 53715 

608-263-6558 

` 
AGENCY: Substance Abuse and Mental Health Services Administration (SAMHSA)

DOCKET #: 2014-10913

The Substance Abuse and Mental Health Services Administration Comment Template

Confidentiality of Alcohol and Drug Abuse Patient Records Regulation, 42 CFR Part 2

This document is meant to provide the public with a simple and organized way to submit 

comments on the Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 

CFR Part 2, and respond to questions presented in meeting notice which is published in the 

Federal Register at 79 FR 26929. While use of this document is entirely voluntary, commenters 

may find it helpful to organize their comments.

This document alone is not intended to provide a full and complete opportunity to comment on 

all of the provisions within the regulation. Please keep in mind that it only reflects those topics 

included in the meeting notice and the section for “other” comments. 

To be considered, all comments (including comments provided through this document) must be 

submitted according to the instructions in the meeting notice: 

https://www.federalregister.gov/articles/2014/05/12/2014-10913/confidentiality-of-alcohol-anddrug-abuse-patient-records

Applicability of 42 CFR Part 2

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. 

Covered information could be defined based on what substance abuse treatment services are 

provided instead of being defined by the type of facility providing the services.

FR Citation: 79 FR 26930

Questions:

• How would redefining the applicability of 42 CFR Part 2 impact patients, health care 

provider organizations, HIEs, CCOs, HIT vendors, etc.?

• Would this change address stakeholder concerns?

• Would this change raise any new concerns?

Public Comment Field:

No comment
Consent Requirements

While technical solutions for managing consent collection are possible, SAMHSA is examining 

the consent requirements in 2.31 to explore options for facilitating the flow of information within 

the health care context while ensuring the patient is fully informed and the necessary protections 

are in place. Specifically we are analyzing the current requirements and considering the impact 

of adapting them to: 

1. Allow the consent to include more general description of the individual organization or 

health care entity to which disclosure is to be made

2. Require the patient be provided with a list of providers or organizations that may be 

access the information and be notified regularly of changes to the list

3. Require the consent to name the individual or health care entity permitted to make the 

disclosure

4. Require that if the health care entity permitted to make the disclosure is made up of 

multiple independent units or organizations that the unit organization or provider 

releasing substance abuse related information be specifically named

5. Require that the consent form explicitly describe the substance abuse treatment 

information that may be disclosed

FR Citation 79 FR 26931

• Questions: 

Would these changes maintain the privacy protections for patients?

• Would these changes address the concerns of HIEs, health homes, ACOs, and CCOs?

• Would these changes raise any new concerns?

Public Comment Field:

We are concerned that having the "type" of entity which is to receive confidential health 

information as too risky and the each entity must be specifically named. 
Redisclosure

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition 

redisclosure only applies to information that would identify an individual as a substance abuser 

and allow other health related information shared by the Part 2 program to be redisclosed, if 

legally permissible. This would allow HIT systems to more easily identify information that is 

subject to prohibition on redisclosure enabling them to utilize other technological approaches to 

manage redisclosure. If data are associated with information about where the data were collected 

(data provenance) which reveals that the data were collected by a practice that exclusively treats 

addiction the data would still be protected under the proposed change.

FR Citation: 79 FR 26931

Questions:

• Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 

in an HER or HIE environment?

• Would these changes maintain the privacy protections for patients?

Public Comment Field:

We agree that this will allow for ease of information exchange while allowing for individual protections 

as applicable. 

Medical Emergency

SAMHSA is considering adapting the medical emergency exception to make it more in line with 

the statutory language and to give providers more discretion as to when a bona fide emergency 

exists. For example, amending this standard to allow providers to use the medical emergency 

provision to prevent emergencies or to share information with a detoxification center when a 

patient is unable to provide informed consent due to their level of intoxication.

FR Citation: 79 FR 26931

Questions:

• What factors should providers take into consideration in determining whether a medical 

emergency exists?

• Are there specific use cases SAMHSA should take into consideration? Show citation box.

• Are there patient concerns about the impact of this change on their privacy?

Public Comment Field:

This is the area of the most concern. There is disagreement among first responders, government 

entities such as Adult Protective Services, and medical personnel as to what constitutes a 

"medical emergency." This needs to be defined with guidelines. There also needs to be 

collaboration with states currently having substance abuse involuntary commitment laws.
Qualified Service Organization (QSO)

SAMHSA is analyzing regulations to identify options for allowing Part 2 data to flow to health 

care entities for the purpose of care coordination and population management while maintaining 

patient protections. One potential solution includes expanding the definition of a qualified 

service organization (QSO, 2.11) to explicitly include care coordination services and to allow a 

QSO Agreement (QSOA) to be executed between the entity that stores Part 2 information such 

as a payer or an ACO that is not itself a Part 2 program and a service provider.

FR Citation: 79 FR 26931

Questions:

Are there other use cases we should be taking into consideration?

Are there specific patient concerns about the impact of this change on their privacy?

Public Comment Field:

This seems reasonable as allowing for better care coordination enhancing the medical home resulting in 

better outcomes, yet still providing confidentiality protections.

Research

SAMHSA is considering expanding the authority for releasing data to qualified 

researchers/research organizations to health care entities that receive and store Part 2 data, 

including third-party payers, health management organizations, HIEs, and care coordination 

organizations.

FR-Citation: 79 FR 26932

Questions:

• Are there factors that should be considered related to how current health care entities are 

organized, how they function or how legal duties and responsibilities attach to entities that 

make up an umbrella organization?

• Would this change address concerns related to research?

• Are there specific privacy concerns associated with expanding the authority or releasing data 

to qualified researchers/research organizations in this way?

• Are there additional use cases that should be considered in the research context?

Public Comment Field:

Although we understand the need for data collection, there needs to be protections in place, including 

consent particularly for research entities.
Addressing Potential Issues With Electronic Prescribing and Prescription Drug Monitoring Programs 

(PDMPs)

Part 2 protections include a prohibition on the redisclosure of information received directly from

a Part 2 program. A pharmacy that receives electronic prescription information directly from a 

Part 2 program must obtain patient consent to send that information to a PDMP, and patient 

consent is also required for the PDMP to redisclosure that information to those with access to the 

PDMP.

Preamble FR Citation: 79 FR 26932

Questions:

• How do pharmacy information system vendors anticipate addressing this issue? Are there 

specific technology barriers SAMHSA should take into consideration?

• Are there other concerns regarding 42 CFR Part 2 and PDMPs? Please describe relevant use 

cases and provide recommendations on how to address the concerns.

• Are there patient concerns about the impact of e-prescribing and PDMPs on their privacy?

Public Comment Field:

This sounds like a positive step as e-prescribing helps reduce medication errors and re-hospitalization. 

We agree with obtaining consent in this context. One barrier could include coordination of benefits if the 

client had more than one insurance plan.

Other Comments

Topic:

Public Comment Field:

Thank you for the opportunity to provide input.
Comments on 

onfidentiality of !lcohol and Drug !buse Patient Records Regulations 

42 CFR Part 2 

Page 1 of 5 

 

 

 

 

 

 

 

 

 

 

C

Wisconsin Statewide Health Information Network 

06/24/2014 

This document provides comments on the Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 

CFR Part 2, and responds to questions presented in the meeting notice published in the Federal Register at 79 FR 26929. 

BACKGROUND ON WISHIN 

The Wisconsin Statewide Health Information Network (WISHIN) is a not-for-profit organization dedicated to bringing the 

benefits of widespread, secure, interoperable health information technology to patients and caregivers throughout 

Wisconsin. WISHIN is building a statewide health information network to connect physicians, clinics, hospitals, 

pharmacies, and clinical laboratories across Wisconsin. Our vision is to promote and improve the health of individuals 

and communities in Wisconsin through the development of information-sharing services that facilitate electronic 

delivery of the right health information at the right place and right time, to the right individuals. 

WISHIN is the state-designated entity to govern statewide health information exchange (HIE) in Wisconsin and is 

responsible for building HIE capacity statewide. The HIE capacity supports providers' meaningful use of electronic health 

records and enables efficient, appropriate, and secure flow of information to optimize decisions for health. The 

statewide network will also help improve the quality and efficiency of health care delivery in Wisconsin. 

As the statewide health information network, WISHIN has encountered several challenges related to exchange of 

substance abuse treatment information falling under the 42 CFR Part 2 regulations. Currently, providers participating in 

WISHIN must exclude 42 CFR Part 2 substance abuse treatment data from being exchanged via WISHIN. This is due to 

the difficulty and expense of implementing the functionality and workflow changes necessary to comply with current 

regulations on both the provider side and the HIE side. Because of this, patients are prevented from fully participating in 

integrated care efforts even if they are willing to provide consent. The comments contained in this document are 

submitted from an HIE perspective and we believe they will provide some practical considerations we hope can be 

addressed with revisions to the regulations. 

COMMENTS 

General Comments from WISHIN 

Overall, WISHIN recommends that Congress amend the statute to allow disclosure of substance abuse treatment 

records, like other PHI, to covered entities and business associates for the treatment, payment and health care 

operations (TPO) permitted by HIPAA. Short of amending the statute, WISHIN recommends patients be allowed to sign a 

general consent for the 42 CFR Part 2 provider to disclose the substance abuse treatment infomation to covered entities 

and business associates for TPO as defined by HIPAA. 

Applicability of 42 CFR Part 2 

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. Covered 

information could be defined based on what substance abuse treatment services are provided instead 

of being defined by the type of facility providing the services. (FR Citation: 79 FR 26930) 
 

 

 

 

Comments on 

Confidentiality of !lcohol and Drug !buse Patient Records Regulations 

42 CFR Part 2 

Wisconsin Statewide Health Information Network 

06/24/2014 

Page 2 of 5 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

WISHIN Comments: 

WISHIN would like to see substance abuse information treated like any other PHI under HIPAA by a covered entity or 

business associate. Substance abuse information is critical to patient safety and effective treatment – even if what is 

being treated is not directly associated with substance abuse. 

Having substance abuse information handled like all other PHI means that existing HIPAA-compliant electronic health 

record (EHR) and HIE systems could handle the exchange of this information without costly modifications. It also means 

that the business processes and workflows in place for non-substance abuse treatment, payment and operations (TPO) 

could be leveraged for substance abuse – eliminating the bifurcated processes that exist today. 

Attempting to further define what falls in the category of substance abuse treatment services - or by facility providing 

the services - could cause even further difficulties when it comes to exchange. Current electronic health record (EHR) 

and HIE technologies do not all have the capability to segregate data into these “buckets” or to apply special processing 

logic to handle this data differently. 

If treating substance abuse information like any other PHI is not feasible, WISHIN would recommend that the regulations 

be limited to inpatient treatment at a dedicated substance abuse facility. Since the regulations require extensive special 

processing and procedures around substance abuse data, limiting it to inpatient treatment at a dedicated substance 

abuse facility would be the easiest way to ensure that substance abuse data were excluded cleanly from the data that is 

shared through the exchange unless costly changes can be made to handle the data in accordance with the regulations. 

Consent Requirements 

While technical solutions for managing consent collection are possible, SAMHSA is examining the 

consent requirements in Sec. 2.31 to explore options for facilitating the flow of information within the 

health care context while ensuring the patient is fully informed and the necessary protections are in 

place. Specifically, we are analyzing the current requirements and considering the impact of adapting 

them to: 

1.	 Allow the consent to include a more general description of the individual, organization, or health 

care entity to which disclosure is to be made. 

2.	 Require the patient be provided with a list of providers or organizations that may access their 

information, and be notified regularly of changes to the list. 

3.	 Require the consent to name the individual or health care entity permitted to make the disclosure. 

4.	 Require that if the health care entity permitted to make the disclosure is made up of multiple 

independent units or organizations that the unit, organization, or provider releasing substance 

abuse related information be specifically named. 

5.	 Require that the consent form explicitly describe the substance abuse treatment information that 

may be disclosed.
 

(FR Citation: 79 FR 26931)
 

WISHIN Comments: 

WISHIN recommends that Congress amend the statute to allow disclosure of substance abuse treatment records, like 

other PHI, to covered entities and business associates for the treatment, payment and health care operations permitted 

by HIPAA. Short of amending the statute, WISHIN recommends patients be allowed to sign a general consent for the 42 

CFR Part 2 provider to disclose the substance abuse treatment infomation to covered entities and business associates 
 

 

 

 

Comments on 

Confidentiality of !lcohol and Drug !buse Patient Records Regulations 

42 CFR Part 2 

Wisconsin Statewide Health Information Network 

06/24/2014 

Page 3 of 5 

for treatment, payment and health care operations (TPO) as defined by HIPAA. The consent for TPO should not be
 

required to identify the individual recipients. 

Currently, EHRs and HIEs can handle disclosures related to TPO. Any variance to the HIPAA TPO requirements would, in 

most cases, mean: (1) special workflows and business processes for the provider and technical changes to existing EHR
 

and HIE systems; or (2) important health care information continuing to be excluded from the information exchange. 

Comments on specific adaptations noted by SAMHSA:
 

Comment on #1: WISHIN recommends against requiring the consent to identify, beyond covered entities and business 

associates, to which (at any level) the disclosure can be made. 

EHRs and HIEs typically operate based on industry standards for data format and transactions (HL7, CCDA, etc.). Current 

versions of the standards can provide some support for these purposes, however, the codes are optional and may be 

redefined by each organization, which can be a problem for interoperability between systems. In short, current standards 

used by EHR and HIE systems do not support the granularity needed to support targeted disclosures as proposed by SAMHSA 

in this adaptation. 

Allowing a general consent for TPO by covered entities and business associates, so that substance abuse information 

could be treated the same as other PHI for treatment, payment and health care operations under HIPAA would 

eliminate the need for targeted disclosures and would help eliminate the barriers to exchanging this information. 

Comments on #2: Providing a list of providers or organizations that may access a patient’s information via a querybased HIE is particularly problematic. Within a state or regional HIE, new providers join the HIE regularly – this list can 

change daily. In theory, producing a list of all HIE participants for a particular HIE would be technically feasible; 

however, this becomes incredibly difficult, if not impossible, when HIEs connect to other HIEs and to the eHealth 

Exchange at the national level. The regulations do not stop at the borders of the HIE, which means that somehow the 

patient would need to be given a list of all providers or organizations participating in the state or regional HIE AND any 

other HIE that is connected and for that information to be updated perhaps daily. It is simply not feasible to present a 

list of all potential providers or organizations that may access a patient’s information when those queries could come 

from multiple HIEs and multiple states. In addition, getting the patient updated information as changes are made (e.g. 

when new providers join and HIE), would be impossible. 

Part of the problem with this requirement is that is is prospective – it requires the patient to be given a list of all 

potential providers, even though very few of them will actually access the data. As EHRs and HIEs connect and expand, 

the list will (hopefully) grow to encompass every provider in the nation (at least that is the vision for a truly connected 

health care system). WISHIN recommends that this requirement be eliminated. HIPAA allows patients to obtain 

disclosures after they are made. We believe this is a more relevant list than a list of thousands of 

providers/organizations that could potentially access the information. 

Comments on #3 and #4: To our knowledge, most systems (EHRs or HIEs) do not support an identifier about who has the 

authority to disclose particular health care information. Even if a particular record, encounter, or piece of information 

could be identified within a query-based exchange as being disclosable only by a given provider/organization, how 

would that entity be contacted for that disclosure? How would the technology know that the discloser was 

appropriately contacted and that the HIE could disclose the information? Would an electronic attestation be sufficient? 

Implementing this requirement at a technical level for a query-based exchange would require significant and costly 
 

 

 

 

Comments on 

Confidentiality of !lcohol and Drug !buse Patient Records Regulations 

42 CFR Part 2 

Wisconsin Statewide Health Information Network 

06/24/2014 

Page 4 of 5 

 

 

 

 

 

 

 

 

 

 

 

system changes. From a provider perspective, workflow and processes needed to handle these requests would need to 

be incorporated into existing consent request processes. Unless those processes can be automated, this could add 

significant manual work and expense for providers. Treating the exchange of substance abuse information consistent 

with TPO provisioning under HIPAA would eliminate the need for this requirement since the information would only be 

disclosed for purposes of TPO to covered entities and business associates. 

Comments on #5: WISHIN recommends against any restrictions or special handling that would be driven at the data 

level (i.e., specific data that may or may not be exchanged). See our comments regarding standards in #1 above. 

Some standard health care formats/transactions have the capability to identify/flag if specific data within the data set or 

transaction is considered “confidential” (sometimes called “sensitive”). This is not true for all data formats/transactions 

and, even when there is some capability it is only generally provided for a few specific fields or records. 

In addition, even if an EHR or HIE can support the confidentiality flag, it is often not possible to identify why the data is 

marked confidential – making it impossible to tell if a confidential record is for mental health, AIDS, AODA, etc. This 

means that special processing to comply with regulations cannot be performed because a flag alone is not enough to 

identify which regulation (and, ultimately which process) to apply to the data. Until the standards used by HIEs and 

EHRs can identify which data is Part 2 vs. some other confidential data there is no way to ensure it can be processed 

correctly. 

Requiring the consent form to identify which data can be exchanged will only help if the systems that support the 

exchange of that data can handle the identification and processing needed to support the patient’s wishes. Absent 

standards that can support the designation of data specifically for Part 2 disclosure, changing the consent form would 

require manual effort and would continue to impede the exchange of the data electronically. 

Redisclosure 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on redisclosure 

only applies to information that would identify an individual as a substance abuser, and allows other 

health-related information shared by the Part 2 program to be redisclosed, if legally permissible. This 

would allow HIT systems to more easily identify information that is subject to the prohibition on 

redisclosure enabling them to utilize other technological approaches to manage redisclosure. If data 

are associated with information about where the data were collected (data provenance) which reveals 

that the data were collected by a practice that exclusively treats addiction, the data would still be 

protected under the proposed change. (FR Citation: 79 FR 26931) 

WISHIN Comments: 

WISHIN recommends that redisclosures be permitted to entities that are required to comply with HIPAA – permitting 

redisclosure to covered entities and business associates for the purposes of TPO without any additional restrictions. 

EHRs and HIEs do not currently have the ability to segment information in a way that could support this revision as 

proposed. Current standards for data format and transactions used by EHRs and HIEs do not have the capability to 

support the segmenting that would be needed to identify one part of a record as not redisclosable, while allowing 

another part to be disclosed.The problem here is almost identical to the problem noted above under #5 of the “Consent 
 

 

 

 

Comments on 

Confidentiality of !lcohol and Drug !buse Patient Records Regulations 

42 CFR Part 2 

Wisconsin Statewide Health Information Network 

06/24/2014 

Page 5 of 5 

 

Requirements” – the standard transactions used by EHRs and HIEs do not support this type of data segmentation or the 

exception processing that would be required to go with it in order to support this revision as proposed. 

Medical Emergency 

SAMHSA is considering adapting the medical emergency exception to make it more in-line with the 

statutory language and to give providers more discretion as to when a bona fide emergency exists. 

For example, amending this standard to allow providers to use the medical emergency provision to 

prevent emergencies or to share information with a detoxification center when a patient is unable to 

provide informed consent due to their level of intoxication. (FR Citation: 79 FR 26931) 

WISHIN Comments: 

WISHIN recommends that a general consent be permitted that would allow substance abuse treatment information to 

be disclosed to covered entities and business associates for TPO permitted by HIPAA. This would eliminate the need for 

special handling in the case of an emergency. 

In the event that WISHIN's recommendation is not adopted, we recommend: (1) aligning the regulatory language with 

the statutory language to give providers more flexibility; and (2) removing the record-keeping requirements if the 

disclosure is made through an EHR or HIE since these systems have audit capabilities that make that record-keeping 

redundant. 

Addressing Potential Issues With Electronic Prescribing and Prescription Drug Monitoring Programs (PDMPs) 

Part 2 protections include a prohibition on the redisclosure of information received directly from a Part 

2 program. A pharmacy that receives electronic prescription information directly from a Part 2 

program must obtain patient consent to send that information to a PDMP, and patient consent is also 

required for the PDMP to redisclose that information to those with access to the PDMP. (FR Citation: 

79 FR 26932) 

WISHIN Comments: 

WISHIN recommends that restrictions on redisclosing medication information be removed. Medication interactions and 

allergies are a patient safety concern. All treating providers should have access to medication information at the point 

of care without having to obtain additional consent from the patient. WISHIN recommends that substance abuse 

medication information be treated like any other PHI under HIPAA. 

In addition, some HIEs also integrate with their state PDMPs, which adds another level of complexity to issues around 

redisclosing medication information. 
 

 

 

 

-----Original Message-----

From: Doyle, Kevin [mailto:doyleks@longwood.edu] 

Sent: Wednesday, June 25, 2014 10:28 AM 

To: Privacy Regulations (SAMHSA) 

Subject: Comment on 42CFR Privacy regulations 

Good morning: 

I wanted to take the opportunity to make a comment on the 42 CFR regulations. I support the existing 

exceptions, but would propose that another be added: the ability of a counselor to take appropriate 

action in case of a duty to warn or protect a potential victim (aka the Tarasoff exception). I believe that 

this is a very significant, although unintentional, omission from the current regulations and that it is not 

adequately covered under the Medical Emergencies section. 

Thank you for the opportunity comment. 

Best regards, 

Kevin Doyle 

Kevin Doyle, Ed.D., LPC, LSATP 

Assistant Professor, Counselor Education Hull 222 

(434) 395-2328/(434) 974-0997 

E-Mail: doyleks@longwood.edu 

Twitter: @kevindoylelpc 
 

 

 

 

 

 

 

 

 

 

 

The Substance Abuse and Mental Health Services Administration
 

Public Listening Session Comment Template
 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2 

This document is meant to provide the public with a simple and organized way to submit comments on the 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2, and respond to 

questions presented in meeting notice which is published in the Federal Register at 79 FR 26929. While use of 

this document is entirely voluntary, commenters may find it helpful to organize their comments. 

This document alone is not intended to provide a full and complete opportunity to comment on all of the 

provisions within the regulation. Please keep in mind that it only reflects those topics included in the meeting 

notice and a section for “other” comments. 

To be considered, all comments (including comments provided through this document) must be submitted 

according to the instructions in the meeting 

notice: https://www.federalregister.gov/articles/2014/05/12/2014-10913/confidentiality-of-alcohol-anddrug-abuse-patient-records. 

Applicability of 42 CFR Part 2 

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. Covered information could 

be defined based on what substance abuse treatment services are provided instead of being defined by the type of 

facility providing the services. 

FR Citation: 79 FR 26930 

Questions: 

• How would redefining the applicability of 42 CFR Part 2 impact patients, health care provider organizations, HIEs,

CCOs, HIT vendors, etc.?

• Would this change address stakeholder concerns?

• Would this change raise any new concerns?

Public Comment Field: 

Page 1 of 5 
 

 

 

 

 

 

 

 

 

 

 

 

 

Consent Requirements 

While technical solutions for managing consent collection are possible, SAMHSA is examining the consent requirements 

in § 2.31 to explore options for facilitating the flow of information within the health care context while ensuring the 

patient is fully informed and the necessary protections are in place. Specifically, we are analyzing the current 

requirements and considering the impact of adapting them to: 

1. Allow the consent to include a more general description of the individual, organization, or health care entity to which 

disclosure is to be made. 

2. Require the patient be provided with a list of providers or organizations that may access their information, and be 

notified regularly of changes to the list. 

3. Require the consent to name the individual or health care entity permitted to make the disclosure. 

4. Require that if the health care entity permitted to make the disclosure is made up of multiple independent units or 

organizations that the unit, organization, or provider releasing substance abuse related information be specifically 

named. 

5. Require that the consent form explicitly describe the substance abuse treatment information that may be disclosed. 

FR Citation: 79 FR 26931 

Questions: 

• Would these changes maintain the privacy protections for patients? 

• Would these changes address the concerns of HIEs, health homes, ACOs, and CCOs? 

• Would these changes raise any new concerns? 

Public Comment Field: 

Redisclosure 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on redisclosure only applies to 

information that would identify an individual as a substance abuser, and allows other health-related information shared 

by the Part 2 program to be redisclosed, if legally permissible. This would allow HIT systems to more easily identify 

information that is subject to the prohibition on redisclosure enabling them to utilize other technological approaches to 

manage redisclosure. If data are associated with information about where the data were collected (data provenance) 

which reveals that the data were collected by a practice that exclusively treats addiction, the data would still be 

protected under the proposed change. 

FR Citation: 79 FR 26931 

Questions: 

• Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 in an EHR or HIE 

environment? 

• Would these changes maintain the privacy protections for patients? 

Public Comment Field: 

Page 2 of 5 
 

 

 

 

 

 

 

 

 

 

 

Medical Emergency 

SAMHSA is considering adapting the medical emergency exception to make it more in-line with the statutory language 

and to give providers more discretion as to when a bona fide emergency exists. For example, amending this standard to 

allow providers to use the medical emergency provision to prevent emergencies or to share information with a 

detoxification center when a patient is unable to provide informed consent due to their level of intoxication. 

FR Citation: 79 FR 26931 

Questions: 

• What factors should providers take into consideration in determining whether a medical emergency exists? 

• Are there specific use cases SAMHSA should take into consideration?Show citation box 

• Are there patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

Qualified Service Organization (QSO) 

SAMHSA is analyzing the regulations to identify options for allowing Part 2 data to flow to health care entities for the 

purpose of care coordination and population management while maintaining patient protections. One potential solution 

includes expanding the definition of a qualified service organization (QSO; § 2.11) to explicitly include care coordination 

services and to allow a QSO Agreement (QSOA) to be executed between an entity that stores Part 2 information, such as 

a payer or an ACO that is not itself a Part 2 program, and a service provider. 

FR Citation: 79 FR 26931 

Questions: 

• Are there other use cases we should be taking into consideration? 

• Are there specific patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

Research 

SAMHSA is considering expanding the authority for releasing data to qualified researchers/research organizations to 

health care entities that receive and store Part 2 data, including third-party payers, health management organizations, 

HIEs, and care coordination organizations. 

FR Citation: 79 FR 26932 

Questions: 

• Are there factors that should be considered related to how current health care entities are organized, how they 

function or how legal duties and responsibilities attach to entities that make up an umbrella organization? 

• Would this change address concerns related to research? 

• Are there specific privacy concerns associated with expanding the authority or releasing data to qualified 

researchers/research organizations in this way? 

• Are there additional use cases that should be considered in the research context? 

Public Comment Field: 

Page 3 of 5 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Addressing Potential Issues With Electronic Prescribing and Prescription Drug Monitoring Programs (PDMPs) 

Part 2 protections include a prohibition on the redisclosure of information received directly from a Part 2 program. A 

pharmacy that receives electronic prescription information directly from a Part 2 program must obtain patient consent 

to send that information to a PDMP, and patient consent is also required for the PDMP to redisclose that information to 

those with access to the PDMP. 

Preamble FR Citation: 79 FR 26932 

Questions: 

• How do pharmacy information system vendors anticipate addressing this issue? Are there specific technology 

barriers SAMHSA should take into consideration? 

• Are there other concerns regarding 42 CFR Part 2 and PDMPs? Please describe relevant use cases and provide 

recommendations on how to address the concerns. 

• Are there patient concerns about the impact of e-prescribing and PDMPs on their privacy? 

Public Comment Field: 

Other Comments 

Topic: Separate regulations for Substance Abuse Treatment records and Health Records for Military Personnel. 

Public Comment Field: 

Problem: Continuing to separate regulations governing drug / alcohol records 

and medical records impedes truly integrated multi-disciplinary care and 

perpetuates stigma for those seeking drug / alcohol treatment. The separation 

is an anachronism of past generations' understanding of addiction, and does 

not reflect modern medicine's understanding of addiction as a biopsychosocial 

disease with significant comorbidities. 

Primary care and other medical specialties require unencumbered access to 

their patients' drug and alcohol treatment histories. Likewise, drug and 

alcohol specialists require unencumbered access to their patients' medical 

histories. 

Solution: Rather than revise the applicability of 42 CFR Part 2, strongly 

recommend SAMHSA eliminate 42 CFR Part 2 entirely, and revise 45 CFR Subtitle 

A, Subchapter C, Part 164 to cover alcohol and drug abuse patient record 

confidentiality. In other words, 45 CFR Part 164 should be the consolidated 

section of federal law that guides security and privacy of ALL protected 

health information (PHI), to include alcohol and drug records. 

Acknowledge there will be details to work out, which can be addressed in a 

interdepartmental (DHHS, DoD, etc) working group that would propose suggested 

verbage to sort out any peculiarities associated with drug and alcohol patient 

records under 45 CFR Part 164. 

Primary Risks/Costs of leaving this unresolved, for the Department of Army and 

Army Medical Department: 

1) Continued challenge with having access to drug/alcohol treatment records by 

Page 4 of 5 
 

 

 

 

Other Comments 

fellow medical providers. This in turn impedes truly integrated 

multi-disciplinary care, both horizontally across the various care 

specialties, and vertically through the levels of addiction care, e.g. level 

III inpatient rehabilitation. Disjointed care leads to degraded clinical 

outcomes for Soldiers and families, which in turn negatively impacts unit and 

mission readiness. 

2) Perpetuation of stigma regarding drug / alcohol treatment. A separate set 

of privacy regulations implies there is something different, non-medical, 

about substance use disorders, to include the implication that it is something 

to be ashamed of. This perception reduces utilization of services and access 

to care, which in turn negatively impacts unit and mission readiness. 

Page 5 of 5 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

From: Kim Eugene H LTC 

Sent: Thursday, June 26, 2014 12:04 PM 

To: 'PrivacyRegulations@SAMHSA.hhs.gov' 

Cc: 'Stacey.Kane.ctr@dha.mil'; Leonard, Thomas E CIV USARMY MEDCOM (US); Orman, David T (Dave) 

CIV USARMY MEDCOM HQ (US); Warner, Christopher H LTC USARMY 101 ABN DIV (US); Brown, Millard 

D III LTC USARMY HQDA OTSG (US); Ivany, Christopher G LTC USARMY HQDA OTSG (US); Hoge, 

Charles W CIV USARMY MEDCOM HQ (US); Earles, Jay E COL USARMY (US); Humphries, Jennifer L COL 

USARMY (US); Lewis, Steve J COL USARMY MEDCOM (US) 

Subject: FW: SAMHSA Follow-up to HIPSCC Members -- Comments are due to SAMHSA by 5:00 PM on 

June 25th (UNCLASSIFIED) 

Importance: High 

Agency Name: Army Medical Department (AMEDD), Department of Army

Comments in response to Public Listening Session: Confidentiality of Alcohol

and Drug Abuse Patient Records, June 11, 2014

Discussion Topic: Applicability of 42 CFR Part 2, Scheduled for 9:45 am – 

10:45 am 

Comments: 

Problem: Continuing to separate regulations governing drug / alcohol records 

and medical records impedes truly integrated multi-disciplinary care and 

perpetuates stigma for those seeking drug / alcohol treatment. The 

separation is an anachronism of past generations' understanding of addiction,

and does not reflect modern medicine's understanding of addiction as a

biopsychosocial disease with significant comorbidities. 

Primary care and other medical specialties require unencumbered access to

their patients' drug and alcohol treatment histories. Likewise, drug and

alcohol specialists require unencumbered access to their patients' medical

histories. 

Recommendation: Rather than revise the applicability of 42 CFR Part 2,

strongly recommend SAMHSA eliminate 42 CFR Part 2 entirely, and revise 45 CFR

Subtitle A, Subchapter C, Part 164 to cover alcohol and drug abuse patient

record confidentiality. In other words, 45 CFR Part 164 should be the 

consolidated section of federal law that guides security and privacy of ALL

protected health information (PHI), to include alcohol and drug records. 

Acknowledge there will be details to work out, which can be addressed in an

interagency (DHHS, DoD, etc) working group that would develop verbage to sort

out any peculiarities associated with drug and alcohol patient

records under 45 CFR Part 164. 

Primary Risks/Costs of leaving this unresolved, for the Department of Army

and Army Medical Department:

1) Continued challenge with having access to drug/alcohol treatment records

by fellow medical providers. This in turn impedes truly integrated multidisciplinary care, both horizontally across the various care specialties, and

vertically through the levels of addiction care, e.g. level III inpatient

rehabilitation. Disjointed care leads to degraded clinical outcomes for

Soldiers and families, which in turn negatively impacts unit and mission

readiness. 
 

 

 

 

2) Perpetuation of stigma regarding drug / alcohol treatment. A separate set 

of privacy regulations implies there is something different, non-medical, 

about substance use disorders, to include the implication that it is

something

to be ashamed of. This perception reduces utilization of services and access

to care, which in turn negatively impacts unit and mission readiness. 

Very Respectfully, 

Eugene H. Kim, MD, FAPA

LTC, MC

Command Psychiatrist

U.S. Army Special Operations Command

(910) 432-2491-office

(910) 574-9876-bb

NIPR: eugene.h.kim@ahqb.soc.mil

Addiction Medicine Consultant to the Army Surgeon General 

-----Original Message----­

From: Leonard, Thomas E CIV USARMY MEDCOM (US)

Sent: Thursday, June 19, 2014 3:10 PM

To: Kuehr, Wanda L CIV (US); Orman, David T (Dave) CIV USARMY MEDCOM HQ

(US); Lewis, Steve J COL USARMY MEDCOM (US); Thompson, Mark W COL USARMY

MEDCOM HQ (US)

Cc: Gruber, Gerald J CIV USARMY MEDCOM HQ (US)

Subject: FW: SAMHSA Follow-up to HIPSCC Members -- Comments are due to

SAMHSA by 5:00 PM on June 25th (UNCLASSIFIED) 

Classification: UNCLASSIFIED 

Caveats: NONE 

Information received from the DoD Health Information Privacy and Security

Committee today regarding the confidentiality of drug and alcohol abuse

patient records. SAMHSA is seeking comments. See the information below. 

You may wish to comment. 

Thomas E. Leonard 

Health Systems Specialist

Patient Administration Division 

Patient Care Integration Directorate

U.S. Army Medical Command

2748 Worth Road, Suite 10

JBSA Fort Sam Houston, Texas 78234-6010 

P: (210) 221-7841 DSN 471-7841

F: (210) 221-6630 DSN 471-6630

thomas.e.leonard.civ@mail.mil

Please visit our PAD Knowledge Management Center at:

https://www.us.army.mil/suite/page/419354
 

-----Original Message----­

From: Kane, Stacey [USA] [mailto:kane_stacey@bah.com]

Sent: Thursday, June 19, 2014 2:31 PM

To: Thomas, Linda S CIV (US); Morse, John, CIV, DHA (John.Morse@dha.mil);

Keleta, Rahwa, CIV, OASD(HA)/TMA (Rahwa.Keleta@dha.mil); DeShields, Rita,
 
 

 

 

 

CIV, DHA (Rita.DeShields@dha.mil); Eckert, John, CAPT, DHA

(John.Eckert@dha.mil); Bley, Paul, CIV, DHA (Paul.Bley@dha.mil); Claessen,

Dawnell K CTR USAF AFMSA (US); Harry Doyle (hdoyle@hdhealthcare.com);

'Evans, Thomas, CTR, OASD(HA)/TMA'; Eyink, Jeffrey A CIV DHA HEALTH IT DIR

(US); Folz, Francis, CTR, DHA (Francis.Folz.ctr@DHA.MIL); Foster, Richard,

CIV, DHA (Richard.Foster@dha.mil); Gill, Howard A CTR (US); Gunter, Peter,

CTR, DHA (Peter.Gunter.ctr@dha.mil); Hass, Karen H CIV DHA DHSS (US); Hayes,

John, CIV, DHA (John.Hayes@dha.mil); Johnson, Tiara, CTR, DHA

(Tiara.Johnson.ctr@dha.mil); Kandel, Robin F CTR (US); TSgt Ryan Lawrence

(ryan.lawrence@us.af.mil) (ryan.lawrence@us.af.mil); Luke, Joan R CIV (US);

Miller, Phillip R CTR (US); Neely, Cheryl, DHA (Cheryl.Neely@dha.mil);

Noble, Marilynn, CIV, DHA (Marilynn.Noble@dha.mil);

'clarissa.reberkenny@dha.mil'; Stone, Michael J LTCOL USAF DHA HEALTH IT DIR

(US); Summers, Sara, CTR, DHA (Sara.Summers.ctr@dha.mil); Tovar, John, CTR,

DHA (John.Tovar.ctr@dha.mil); Weed, Lincoln D CTR (US); Beasley, Melissa J

MAJ USAF AFMSA (US); Lambert, Randall C LTCOL USAF (US); Meersman, Mark R

LTCOL USAF AF-SG (US); Morgenstern, Dawn P CTR USAF AFMSA (US);

james.vincent.13@us.af.mil; Dale, Ashley E CIV DHA HEALTH IT DIR (US);

Gruber, Gerald J CIV USARMY MEDCOM HQ (US); Leonard, Thomas E CIV USARMY

MEDCOM (US); Mitchell, Theora L CIV DHA HEALTH IT DIR (US); Orck, Charles E

CIV USARMY MEDCOM HQ (US); Middlekauff, Aaron P CDR USPHS (US); Schwartz,

Erica G CAPT USPHS (US); Alvarez, Maria D CDR USN (US); Archibald, Colin S

CIV (US); Bernstein, Dina L CIV (US); Joe Davidge

(Joe.Davidge@med.navy.mil); Cornell Floyd (Cornell.Floyd@med.navy.mil);

Haines, Marc D LT USN (US); Hale, Lonnie G CIV (US); Hartley, Rosanne I CAPT

USN COMNAVAIRPAC (US); Hazzard, Barbara A CTR (US); Hoffman, Derek B LT USN

(US); Klant, Robert C CIV USN (US); Lowry, Michael A CIV (US);

brian.k.martin@med.navy.mil; Mccullough, Darion LCDR USN (US); Medina,

Servio F CIV (US); Partridge, Heather D CDR USN NETC (US); Al Ray

(elvie.ray@med.navy.mil); Sperner, Noah T LCDR USN (US);

hipaasecurity@dha.mil; McDowell, Angela W CTR DHA DHHQ (US); Kane, Stacey,

CTR, DHA (Stacey.Kane.ctr@dha.mil); Herrold, Russell P IV CTR (US); Michel,

Leon, CTR, OASD(HA)/TMA (Leon.Michel.ctr@dha.mil); Gunter, Peter D CTR (US);

Sellards, Christopher S CIV USARMY MEDCOM SRMC (US); Evans, Thomas C CTR

(US)

Cc: Kane, Stacey C CTR (US)

Subject: SAMHSA Follow-up to HIPSCC Members -- Comments are due to SAMHSA by

5:00 PM on June 25th 

HIPSCC Members, 

As a follow-up to the SAMHSA update provided at our HIPSCC meeting this

afternoon regarding a recent public listening session and considerations for

changes to the Alcohol and Drug Confidentiality Regulations in 42 CFR Part

2, attached pleases find: (1) Summary of the discussion topics and areas

for proposed changes; and (2) a template that can be used to provide

organized comments to SAMHSA. 

Comments can be submitted using any of the following methods. Each 

submission must include the Agency name and the docket number for this

notice. Comments must be received by 5:00 p.m. ET on Wednesday June 25,

2014. 

* Mail: The Substance Abuse and Mental Health Services Administration,

1 Choke Cherry Road, Rockville, MD 20857, Room 5-1011.

* Hand Delivery or Courier: 1 Choke Cherry Road, Rockville, MD 20857,

Room 5-1011 between 9 a.m. and 5 p.m., ET, Monday through Friday, except 
 

 

federal holidays.

* Email: PrivacyRegulations@SAMHSA.hhs.gov

<mailto:PrivacyRegulations@SAMHSA.hhs.gov> 

* Fax: 1-240-276-2900 

v/r, 

Stacey 

Stacey C. Kane 

Defense Health Agency 

Privacy and Civil Liberties Office 

Support Contractor, Booz Allen Hamilton 

Mobile: 571-263-3706 

Stacey.Kane.ctr@dha.mil <mailto:Stacey.Kane.ctr@dha.mil> 

Kane_Stacey@bah.com <mailto:Kane_Stacey@bah.com> 

Let us know how we're doing! 

Please comment on our service at: voiceofthecustomer@dha.mil 

<mailto:voiceofthecustomer@dha.mil> 

This document may contain information covered under the Privacy Act, 5 USC

552a, and/or the Health Insurance Portability and Accountability Act (PL

104-191) and its various implementing regulations and must be protected in

accordance with those provisions. If you have received this correspondence

in error, please notify the sender at once and destroy any copies you have

made. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Ms. Pamela Hyde 

Administrator 

Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Rockville, MD 20857 

RE: Comments on SAMHSA Public Listening Session on Confidentiality of Alcohol and Drug Abuse 

Patient Records (SAMHSA Docket No. 2014-10913) 

Dear Ms. Hyde: 

On behalf of the states’ Medicaid Directors and Mental Health Program Directors, we appreciate the 

opportunity to comment on the privacy requirements for substance use disorder health information 

(42 CFR Part 2). This is a critically important issue that has cross-cutting impacts on the programs 

financed and administered by our respective members. 

As background, NAMD is a bipartisan organization which represents Medicaid Directors in the fifty 

states, the District of Columbia and the territories. This rule is of particular interest to our members 

because state Medicaid programs are increasingly responsible for the financing, delivery and oversight 

of services that are implicated by the privacy regulations. Specifically, Medicaid provided $3.4 billion in 

medical expenditures to treat the substance use disorders of 1.1 million beneficiaries in 2008.1 

NASMHPD is the member organization representing the state executives responsible for the $37 

billion public mental health service delivery system serving 7.2 million people annually in all 50 

states, 4 territories, and the District of Columbia. For NASMHPD’s member officials, the rule has 

proven over time to be a troubling and continuing barrier to holistically addressing the mental 

health and chronic condition co-morbidities that so often co-occur with a patient’s substance use 

disorders. 

Across the country, state Medicaid agencies and providers are rapidly embracing approaches to deliver 

integrated care through models such as health homes, coordinated care entities, and accountable care 

organizations. These efforts, which rely on information sharing and team-based care, are primarily 

focused on improving the delivery of services for Medicaid beneficiaries. However, the fundamental 

tenets of these models have proved infinitely more challenging and in some case impossible to apply 

with respect to populations with substance use disorders. 

1 Bouchery, Ellen, Rick Harwood, Rosalie Malsberger, et al;, “Medicaid Substance !buse Treatment Spending: Findings Report,” 

Mathematica Policy Research, Department of Health and Human Services, Sept. 28, 2012, 

http://aspe.hhs.gov/daltcp/reports/2012/MSAspend.shtml#execsum. 
 

 

2 Druss, G and S! von Esenwein, “Improving General Medical are for Persons with Mental and !ddictive Disorders: 

Systematic Review,” General Hospital Psychiatry, 2006 Mar-Apr, 28(2), 145-53, 

http://www.ncbi.nlm.nih.gov/pubmed/16516065. 

Research studies suggest that integrated care may improve health outcomes and reduce mortality for 

individuals with substance use disorders and comorbid medical problems.2 Meanwhile, our members’ 

experiences indicate that most aspects of the regulations at 42 CFR Part 2 are a major barrier to 

providing high quality, coordinated care for those with substance use disorders covered by Medicaid 

or receiving care through the public mental health delivery system. While other Medicaid beneficiaries 

reap the benefit of advances in care delivery, the stringent language of 42 CFR Part 2 limits the flow of 

vital health information and impedes team-based care for those with substance use disorders. 

Permitting the transfer of this information for the purposes of treatment, care coordination, and case 

management would improve the quality of care for those with substance use disorders and allow 

these individuals to benefit from advances in care delivery. 

Development and adoption of electronic health records (EHRs) and health information exchange (HIE) 

mechanisms have provided new, more efficient and effective tools for coordinating care and realizing 

our shared goals around improved patient health and outcomes. However, 42 CFR Part 2 has been a 

barrier that has kept these tools from benefiting individuals with substance use disorders. We 

appreciate that the Office of the National Coordinator (ONC) for the Department of Health and Human 

Services plans to work to improve standards, technology, and workflow that enable the electronic 

collection and management of consent as well as the electronic exchange of related information 

within existing legal requirements; While we support these goals and the ON’s work, more immediate 

steps are needed to support coordination of care across providers and government programs. 

Our members believe that the underlying policy problems require federal policymakers to address the 

challenges resulting from 42 CFR Part 2. More specifically, we are calling on Congress to advance 

legislative language to repeal the provisions of 42 U.S.C §§ 290dd-2 not aligned with the privacy 

provisions of Health Insurance Portability and Accountability Act (HIPAA) or its underlying regulations, 

with the exception of the existing statutory prohibition against the use of covered drug or alcohol 

abuse treatment records to initiate or substantiate any criminal charges against a patient or to conduct 

any investigation of a patient. 

In the absence of congressional action, we appreciate the Substance Abuse and Mental Health 

!dministration’s (SAMHSA) interim work to mitigate the impediments to improving care for impacted 

populations. We respectfully request that SAMHSA align federal substance use disorder privacy 

regulations, to the greatest extent possible, with those federal requirements, primarily found under 

the HIPAA, that govern the privacy of all other types of health information. 

 

In calling for this change, we recognize there are concerns about the disclosure and use of the 

sensitive information contained in the electronic records of patients with substance use disorders. 

States take these concerns very seriously and place a high priority on protecting the privacy of 

Medicaid enrollees and patients of our public mental health system, including information pertaining 
 

 

to substance use disorder treatment. However, as policymakers have done in all other areas of 

personal health information, including for those with mental health conditions, they must balance 

privacy protections with the health, safety and welfare of patients, their families and their 

communities. 

We also want to be clear that we are not calling for changes to the penalties for individuals or entities 

that would violate the modernized privacy regulations nor to other law that protects these individuals. 

As these individuals receive higher quality care – and ultimately achieve a higher quality of life – 

patient privacy would continue to be robustly protected through the use of the existing financial 

penalties already in place to deter inappropriate use of information. Further, patients would also 

continue to be protected by the Americans with Disabilities Act, which prohibits employment 

termination based on substance abuse treatment and recovery. 

In addition, we recommend that education initiatives be added to the national agenda to help 

consumers understand how their health information is protected, shared, used and disclosed. We 

believe the promise of improvements in care and safety stemming from this regulatory change far 

outweigh concerns about the potential release of sensitive information. Federal and state partners and 

other stakeholders must do more to help promote this change of culture and public sentiment. 

 

The enclosed document contains our responses to S!MHS!’s questions on 42 CFR Part 2 as published 

in the Federal Register’s Notice of Public Listening Session. We appreciate your consideration of the 

state experiences reflected in this document. 

Our associations are committed to working with SAMHSA and your colleagues in other parts of the 

Department of Health and Human Services and we look forward to an ongoing, engaging dialogue with 

you regarding the confidentiality of alcohol and drug abuse records. 

Sincerely, 

Matt Salo 

Executive Director 

National Association of Medicaid Directors 	 

Robert W. Glover, PhD. 

Executive Director 

National Association of State Mental Health 

Program Directors 
 

 Ensuring patient safety; 

 Increasing access to substance use disorder services; 

 Integrating substance use disorder services with the rest of health care ; 

 Providing high-quality medical care to people receiving substance use disorder treatment 

services; and 

 

 

 Reducing the stigma of substance use disorders that acts as a disincentive for individuals to 

seek treatment. 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

RESPONSE TO QUESTIONS 

A. APPLICABILITY OF 42 CFR PART 2 

How would redefining the applicability of 42 CFR Part 2 impact patients, health care provider 

organizations, HIEs, CCOs, HIT vendors, etc.? 

Ideally, the Medicaid Directors and Mental Health Program Directors believe the requirements of 42 

CFR Part 2 should be repealed in their entirety. Alternatively or as an interim step, we recommend that 

SAMHSA redefine its regulations for substance use disorder treatment information to achieve 

operational consistency with the requirements of HIPAA. 

We recommend retaining only the provisions of 42 U.S.C §§290dd-2(c) which prohibit the use of 

covered drug or alcohol abuse treatment records to initiate or substantiate any criminal charges 

against a patient or to conduct any criminal investigation of a patient. The perception that substance 

use records of an individual in treatment can be used to launch or substantiate a criminal 

investigation—whether legally justified or not—often does, in fact, serve to discourage individuals who 

need treatment from seeking that treatment, while sharing the information with criminal justice 

agencies would not further the desired goal of increasing the integration of care for those individuals. 

Any health information privacy requirements related to substance use disorder treatment that differ 

from the privacy requirements related to general medical care and mental health treatment will 

always be a barrier to: 

Separate health information privacy requirements for substance use disorder treatment makes it 

significantly less likely that people with substance use disorders, including Medicaid beneficiaries, will 

receive the attention and time to support continuing remission. It also makes it less likely that these 

individuals will have early recurrence identified, which is routinely provided to those with other 

chronic medical conditions. For example, when providers know a person has had a chronic condition, 

they inquire about it and look more closely for signs that the person remains healthy in that area. For a 

patient with a substance use disorder, keeping the condition secret deprives the individual of the 

additional care and treatment they would receive if they had any other chronic condition. 
 

 

 
 

 

 
 


 

3 Zwicker D, Fulmer T, “Reducing Adverse Drug Events,” In: Boltz M, Capezuti E, Fulmer T, Zwicker D, eds. Evidence-Based
 

Geriatric Nursing Protocols for Best Practice; 2012. (4): 324-62, http://www.guideline.gov/content.aspx?id=43938; 

FitzGerald RJ, “Medication Errors: the Importance of an Accurate Drug History,” Br J Clin Pharmacol. June 2009; 67(6):
 

671–75, http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2723207/pdf/bcp0067-0671.pdf.
 

 
	

 
 

 


 

4 Centers for Disease Control and Prevention, “Medication Safety Basics,” !ug. 14, 2012,
	

http://www.cdc.gov/medicationsafety/basics.html#ref; New England Healthcare Institute, “A System-wide Approach to
 

Improving Patient Medication Adherence for Chronic Disease,” Aug. 2009, http://adhereforhealth.org/wpcontent/uploads/pdf/ThinkingOutsidethePillbox_Report.pdf.
 

 
	

 
 

5 Silva DCB, Araujo OR, Arduini RG, et al., “Adverse Drug Events in a Paediatric Intensive Care Unit: a Prospective Cohort,”
	

BMJ Open. 2013, 3:e001868, http://bmjopen.bmj.com/content/3/2/ e001868.full.pdf+html.
 

 

 
	

6 Institute for Safe Medication Practices and Maryland Patient Safety Center, “Taking Charge of Your Medication Safety 

Challenges,” Nov. 3, 2011,
	


 

 
 


 

http://www.marylandpatientsafety.org/html/education/medsafe/2011/documents/SCarson.pdf; New England
 

Healthcare Institute, “Improving Medication Adherence and Reducing Readmissions,” October 2012,
 

http://www.nacds.org/pdfs/pr/2012/nehi-readmissions.pdf.
 

In addition, the risk of an adverse drug event (ADE) increases if access to medication history is 

restricted, threatening patient safety and increasing Medicaid costs.3 According to the Centers for 

Disease Control and Prevention, the health care system spends an amount equal to the cost of the 

medications themselves due to the associated ADEs.4 If access to information about certain prescribed 

medications is restricted, patients face increased likelihood of ADEs because providers cannot fully 

assess the risk of prescribing a new medication. ADEs have also been found to increase linearly with 

the increase in the number of unique medications in the patient’s drug regimen.5 Further, studies also 

show that one of the largest drivers of hospital readmissions is inappropriate or unreconciled drug 

regimens.

6 

Another consequence of the special requirements of 42 CFR Part 2 is that it imposes significant 

administrative burdens and costs on the providers least able to bear them. Specialty substance use 

disorder individual treatment providers and organizations are arguably the most underfunded and 

undercapitalized providers in the health care system. 

In addition, 42 CFR Part 2 was implemented well before health information and related 

technologies were even contemplated, and has not been meaningfully updated to reflect modern 

technology. As a result, 42 CFR Part 2 adds a financial burden and enormous complexity to health IT 

initiatives. The added complexity and cost make it likely that substance use disorder information 

will be omitted altogether from HIEs. Further, the requirements associated with 42 CFR Part 2 

necessitate expensive customization of EHRs and requires service providers to commit additional 

funds and resources to manage EHR integration into their practice workflow. Finally, attempting to 

segregate substance use disorder information from the EHR is also exceptionally costly and may 

result in changes that threaten federal certification status of an EHR. 

Our members also continue to believe that having separate health information privacy requirements 

for substance use disorder treatment is discriminatory and perpetuates stigma. The requirements keep 

persons with substance use disorders and the providers who treat them marginalized and 

disadvantaged compared to other patients and providers in the health care system. Addressing 

substance use disorder information in the same manner as other health information would help to 
 

break down the barriers of stigma and normalize substance use disorders. It would also help to 

acknowledge that these disorders are chronic diseases, making patients more likely to have 

conversations with their providers about their concerns and seek treatment. 

If SAMHSA determines it does not have the authority to amend regulations in a way that generally 

aligns the use of substance use treatment information with the use of all other health information 

under HIPAA privacy protections as described above, at a minimum, Medicaid Directors and Mental 

Health Program Directors believe the following regulatory changes would be a positive step forward: 

 

 

 

 

 

 

 

	 The regulation should be limited to substance use disorder specialty treatment services. 

The regulation should not cover screening, diagnosis, or referral to specialty treatment. 

Including screening, diagnosis and referral discourages providers who are not specialty 

substance use disorder treatment providers from inquiring about substance use concerns 

and discourages organizations from implementing substance use screening. Further, 

including health information derived from screening, diagnosis, and referrals under these 

special rules adds significant analytic complications and costs for integration with health 

information exchanges. 

 

 

 

 

 

 

 

 

	 With respect to providers, the regulation should only apply to substance use disorder 

specialty treatment programs and providers specifically licensed, credentialed, or 

accredited by generally recognized state and national bodies. We believe it should not 

apply to programs and individual treatment providers who have no specialty license, 

credential, or accreditation specific to specialty substance use disorder treatment. This 

would more clearly define which providers can be considered covered entities and assure 

that protected status is only attached to programs and providers that have met a minimum 

quality standard. 

 

 

 

 

 

 

 

 

 

 

 

 

Further, designating substance use disorder specialty providers would also make it easier 

to connect these providers to the covered health information they generate. This 

information could be tracked with their provider billing and NPI numbers. 

If a credentialing requirement is not applied, at a minimum, the regulation should continue 

to limit covered entity status only to organizations and individuals that hold themselves out 

to the public as being substance use disorder specialty treatment providers (as discussed in 

the previous bullet). This provision gives providers and organizations some control over 

whether they are considered a covered entity. It also allows them to offer specialty 

substance use disorder treatment internally to their patients without having to bear the 

decreased quality of clinical care and increased administrative costs and burdens of 42 CFR 

Part 2. 

In addition, it is important to consider whether and how new rules should apply to 

specialty substance use disorder treatment providers’ information on a retroactive basis; 
 

 

 

We encourage SAMHSA to work with our associations to dialogue with Medicaid Directors 

and Mental Health Program Directors on the best timing and approach to implementation. 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

	 

	 

	 The regulation should not apply to individually certified or licensed specialty substance 

use disorder treatment providers practicing within a larger organization unless the larger 

organization is also accredited, certified, or licensed as a specialty treatment provider. 

Requiring any health care organization that hires an employee with specialty substance use 

disorder treatment credentials to be considered a covered entity would be a substantial 

disincentive for general health care organizations to integrate substance use disorder 

treatment services into their predominant treatment operations. It would significantly 

restrict integration of substance use disorder treatment with general health care, which 

Medicaid Directors and Mental Health Program Directors believe is foundational to 

improving care. 

	 State Medicaid agencies and other third party payers/health care entities, including 

public behavioral health programs, should be permitted to disclose substance use 

disorder data in the course of an audit or evaluation of the state’s Medicaid program or 

of the payers/entities’ activities. State Medicaid programs, as federal and state-funded 

health insurers, are subject to extensive audit and evaluation requirements at both the 

state and federal level. Explicitly including third party payers within 42 CFR §2.53 would 

help state Medicaid agencies comply with the legal requirements applicable to Medicaid 

programs. This change would be consistent with the rationale for amending Part 2 to 

explicitly allow third party payers to disclose Part 2 data to qualified service organizations 

(QSOs) and qualified researchers/research organizations. 

B. CONSENT REQUIREMENTS 

Specifically, we [SAMHSA] are analyzing the current requirements and considering the impact of 

adapting them to: 1. Allow the consent to include a more general description of the individual, 

organization, or health care entity to which disclosure is to be made. 

Our members believe that consent requirements should be streamlined and standardized to 

support consumers in making informed decisions about the sharing of their health information. The 

difference in physical health, mental health and substance use disorder treatment consent 

requirements adds to the complexity of this process for consumers and providers. 

As a result, Medicaid Directors and Mental Health Program Directors agree that S!MHS!’s 

proposed change would be helpful, particularly if the patient could consent to a template 

statement that he or she is consenting to the health care information covered by the regulation 

being handled in a manner consistent with the privacy protections of HIPAA. This approach should 

help to ensure that treatment, payment, and operations as defined by HIPAA are covered by the 

consent, or at a minimum, treatment, case management, and coordination of care should be 

covered. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

In addition, SAMHSA should consider the benefits and challenges of allowing the statewide HIE to 

be identified as the organization to which disclosure is made rather than individual HIE participants. 

We believe this approach could prove useful in some states and warrants further examination. 

2. Require the patient be provided with a list of providers or organizations that may access their 

information, and be notified regularly of changes to the list. 

We do not believe this recommendation reflects current HIT capabilities. However, even if it becomes 

feasible, there are still concerns that this would be unworkable and would assure that substance use 

disorder treatment information covered by the regulation would almost never be shared on HIEs, 

shared in urban regions where there are many providers, or shared when persons have multiple 

medical conditions and see multiple providers. Lists of specified providers would be lengthy and 

change frequently, so the lists would require ongoing updates and notification of changes provided. 

One possible approach SAMHSA may wish to consider to improve the feasibility of such a policy, is that 

patients could be referred to websites that are regularly updated with the list of HIE participants and 

providers. In this scenario, an oversight entity may be appropriate and this entity would need 

resources to maintain these updated lists. 

3. Require the consent to name the individual or health care entity permitted to make the disclosure. 

This would not be workable for an HIE and as a result would not address Medicaid Directors’ and 

Mental Health Program Directors’ concern about the ability to provide integrated care. The consent 

would be captured by the entity currently providing treatment, but that entity would need to request 

substance use disorder and treatment data from other HIE participants that have treated the patient 

in the past. Those other entities could only disclose information if they had previously captured 

consent from the patient with their entity named to make the disclosure. 

Even outside of an HIE, this change would result in substance use disorder treatment information 

being shared significantly less often than it is now. If an individual provider must be named in the 

disclosure, the medical records department of an organization would constantly have to crosscheck 

whether that provider is still employed by the organization. If the consent names the organization, any 

merger or acquisition of that organization would void all prior consent. 

4. Require that if the health care entity permitted to make the disclosure is made up of multiple 

independent units or organizations that the unit, organization, or provider releasing substance 

abuse related information be specifically named. 

We do not believe this recommendation reflects current technological capabilities or the realities of 

how organizations function. Imposing such a requirement would ensure that information about 

specialized substance use disorder treatment is never shared in organizations with multiple 

independent units. 

The reality is that such organizations often use the same EHR and most, if not all, EHRs lack the 

functionality to segregate information that can and cannot be shared within the EHR. Where 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

5. Require that the consent form explicitly describe the substance abuse treatment information that 

may be disclosed. 

organizations with multiple units have separate EHRs, they still extensively exchange and aggregate 

data for purposes of treatment, payment, and operations. 

This requirement would create a substantial disincentive for those organizations to offer specialized 

substance use disorder treatment, which would threaten access to these services for Medicaid and 

public mental health program beneficiaries. Any change to the regulation that creates additional 

standards that differ from HIPPA simply creates more obstacles that disadvantage specialized 

substance use disorder treatment patients and providers. This would add complexities in the HIE 

systems if the consent forms used by various health care entities do not include the same substance 

use disorder treatment data. It would also create confusion for users of data obtained through the HIE 

when the included information varies by health care entity. 

In addition, the development of standards for the exchange of substance use disorder or behavioral 

health information should be designed to facilitate the exchange of all health information. These 

standards should allow all substance use disorder and behavioral health facilities and clinics to use one 

common continuity of care document (CCD) standard that meets their unique needs. 

We believe this requirement would result in even lower rates of information sharing about specialized 

substance use disorder treatment than is experienced today. Since many patients continue to receive 

treatment over time, the consent would have to be continuously updated to reflect the treatment 

received. There would be confusion about how detailed and specific the descriptions of treatment 

would have to be. Further, the technical capacity does not currently exist to segment the data that 

may or may not be disclosed. 

Would these changes maintain the privacy protections for patients? 

Our members recognize and stand behind the importance of patient privacy. We believe privacy will 

continue to be protected through the alignment of general health information privacy requirements 

with substance use disorder information privacy requirements. Specifically, penalties and 

consequences for breaches of information will remain in place, deterring those with malicious intent 

from misusing information. 

Further, we recommend that the national agenda around substance use disorder issues include a 

consumer education component to address how health information is protected, shared, used, and 

disclosed. This will help to ensure consumers understand the legal protections that govern all of their 

health information, including information related to substance use disorders. 

Would these changes address the concerns of HIEs, health homes, ACOs, and CCOs? 

Aligning the privacy regulations for alcohol and drug abuse records with privacy requirements for 

medical and mental health information would allow entities to provide all Medicaid beneficiaries and 

public mental health program patients with the same IT and data analytic supports and benefits. If 

alignment is not possible, our recommendations in response to Part A above would be a positive step 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

forward to address the concerns of HIEs, health homes, ACOs, and CCOs, and ensure those entities can 

deliver quality care to Medicaid beneficiaries and public mental health program patients with 

substance use disorders. 

Further, we encourage SAMHSA to work with its sister operating agencies, states and other 

stakeholders to explore whether standards should be established for information sharing within health 

homes, ACOs, and CCOs. 

Would these changes raise any new concerns? 

Revising the current regulation so that it is operationally identical to the privacy provisions of HIPAA 

would require provider education and clarifications. 

C. REDISCLOSURE 

Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 in an EHR or 

HIE environment? 

We believe this change would have very limited benefit due to the significant resource demands 

involved in the technology required to manage redisclosure of selected portions of each patient’s 

private health information. EHRs would only be able to filter out the substance use disorder treatment 

information that falls within defined data elements and does not include free text. Providers having 

free text fields in their EHRs, such as progress notes, could still run the risk of releasing a progress note 

containing information that would identify a patient as a recipient of substance use disorder 

treatment. 

D. MEDICAL EMERGENCY 

What factors should providers take into consideration in determining whether a medical emergency 

exists? 

Our members agree that the current regulation should be amended to allow the release of 

specialized substance use disorder treatment information in an emergency using the same methods 

and standards applied under the privacy provisions of HIPAA. In addition, a consistent definition of 

a “medical emergency” should be developed to facilitate the appropriate sharing of substance use 

treatment information in a medical emergency. Specifically, a “medical emergency” should be 

defined as any treatment provided in an emergency department. The exigencies of a medical 

emergency permit no time or opportunity to apply specialized, complicated requirements for 

handling information or to consider nuanced descriptions of what does and does not constitute an 

emergency. reating different versions of the “break the glass” functionality would also create 

additional complexity within HIE systems with additional costs to create and maintain this 

functionality. It would also add steps in the workflow for emergency departments to determine 

which version of “break the glass” is warranted and to make the proper request of the system; 

E. QUALIFIED SERVICE ORGANIZATION (QSO) 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

[...\ One potential solution includes expanding the definition of a qualified service organization 

(QSO; § 2.11) to explicitly include care coordination services and to allow a QSO Agreement (QSOA) 

to be executed between an entity that stores Part 2 information, such as a payer or an ACO that is 

not itself a Part 2 program, and a service provider. 

If 42 CFR Part 2 cannot be aligned with the requirements of HIPAA, this would be a helpful change. 

State Medicaid agencies receive and deal with data that might be characterized as falling within Part 2 

on a routine basis. Such information is primarily received from Part 2 programs and managed care 

entities in the form of claims and encounter data. As with all claims and encounter data, such 

information is integral to the agency’s core function as a government-funded health insurer and to 

supporting and administrative activities (e.g., third-party liability, outcome evaluation, cost 

containment and data processing activities). 

If a third party payer is not able to disclose Part 2 data to a QSO under Part 2, state Medicaid programs 

could effectively be prohibited from contracting any functions, or obtaining any services from outside 

vendors, if the function or service involved the use of Part 2 data. This could undermine the 

operational efficiency of state Medicaid programs, which also serve as a major source of funding for 

substance abuse treatment services provided by Part 2 programs. 

Are there other use cases we should be taking into consideration? 

The expansion of QSO agreements should also include subcontractors that health care entities employ, 

contract with, or otherwise engage to perform the same services. We encourage SAMHSA to consider 

other allowable uses of Part 2 data by QSOs including: case management; clinical professional support 

services (e.g., quality improvement initiatives, utilization review and management services); third party 

liability and coordination of benefit support services; activities related to preventing fraud, waste and 

abuse; and other activities and functions typically performed by contractors for or on behalf of third 

party payers and other health care entities. 

F. RESEARCH 

SAMHSA is considering expanding the authority for releasing data to qualified researchers/research 

organizations to health care entities that receive and store Part 2 data, including third-party payers, 

health management organizations, HIEs, and care coordination organizations. 

If 42 CFR Part 2 cannot be aligned with the requirements of HIPAA, this would be a helpful change. 

Are there specific privacy concerns associated with expanding the authority or releasing data to 

qualified researchers/research organizations in this way? 

No. 

G. ADDRESSING POTENTIAL ISSUES WITH ELECTRONIC PRESCRIBING AND PRESCRIPTION DRUG 

MONITORING PROGRAMS (PDMPs) 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

How do pharmacy information system vendors anticipate addressing this issue? Are there specific 

technology barriers SAMHSA should take into consideration? 

We do not believe there is a technically, financially, or administratively feasible way to bring PDMPs 

into compliance with the current regulation. Older PDMPs aggregate the data from weekly or monthly 

disk dumps from the pharmacy systems. As a result, maintaining the drug list and the patient list 

would be daunting. In addition, it would be difficult and in some situations impossible in context of 

date of service and original prescriptions versus refills for the pharmacy to maintain and segregate the 

opt-ins versus opt-outs for patients who want to withhold access but later choose to allow access. 

Pharmacy data systems simply do not have mechanisms for managing patient consent and lack the 

ability to identify which providers are subject to Part 2 in order to prevent the data from reaching the 

PDMP. 

In order to selectively screen out prescriptions received from covered entities under 42 CFR Part 2, 

either the individual pharmacies or the switch companies would need to have a digital list uniquely 

identifying all covered entities cross-walked to their NPI numbers. It is unlikely they would be able or 

willing to compile such a list. It is also unlikely they would be willing to accept such a list from an 

outside entity unless the entity accepted liability for any errors on the list. Any entity compiling and 

maintaining this list would have to update it, on almost a daily basis, to account for provider changes. 

It is unclear who would bear the extensive costs involved in such frequent updates. 

The other alternative would be to mandate that switch companies screen out all medications deemed 

indicative of specialty substance use disorder treatment from data they transmit to PDMPs. However, 

this too would create additional administrative costs. The list of drugs they would screen out as 

indicative of specialty substance use disorder treatment would need to be nationally standardized, 

government endorsed, and continuously updated as new manufacturers enter and leave the market 

and as new formulations are marketed or dropped. This would require a substantial ongoing 

regulatory assessment and updating of the drugs to be screened out. 

We are also concerned that the provisions of 42 CFR Part 2 restrict the effectiveness of PDMPs and 

present a major threat to patient safety by limiting the reporting of certain controlled substances to 

PDMPs. Many drug overdoses occurring today could otherwise be prevented by addressing some of 

the restrictive language in 42 CFR Part 2 which applies to PDMPs. For example, at least two 

medications used in specialized substance use disorder treatment are commonly abused controlled 

substances: methadone and buprenorphine. Methadone is reported by the Centers for Disease Control 

and Prevention (CDC) to be involved in 30 percent of prescription overdose deaths. CDC also reports 

that the death rate from methadone overdoses was nearly 6 times higher in 2009 than in 1999 While 

buprenorphine abuse and overdose deaths are much rarer, they are rapidly increasing in number. 

Methadone and buprenorphine dispensed by opioid treatment programs (OTPs) should also be 

reported to PDMPs. 

.

7 

7 enters for Disease ontrol and Prevention, “Vital Signs: Risk for Overdose from Methadone Used for Pain Relief – United 

States 1999-2010,” July 6, 2012, http://www.cdc.gov/mmwr/preview/mmwrhtml/mm6126a5.htm?s_cid=mm6126a5_w. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Finally, we recognize that PDMPs in some states are accessible by law enforcement. To ensure those 

with substance use disorders receive the safety benefit of PDMPs and are not discouraged from 

seeking treatment, SAMHSA should further explore whether legal changes are necessary to prevent 

health care information in the PDMP from being used in initiating or substantiating any criminal 

charges against a patient or to conduct a criminal investigation of a patient. 

Are there other concerns regarding 42 CFR Part 2 and PDMPs? Please describe relevant use cases and 

provide recommendations on how to address the concerns. 

To fully address concerns with this regulation and PDMPs, we strongly believe the regulations at 42 

CFR Part 2 should be repealed in their entirety, with the exception of the statutory prohibition against 

the release of health care information for use in initiating or substantiating any criminal charges 

against a patient or to conduct a criminal investigation of a patient. Recognizing this would require a 

statutory change, we urge SAMHSA to not apply 42 CFR Part 2 to the transmission of pharmacy data to 

PDMPs, or at the very least not apply the requirements to the transmission of pharmacy data about 

the prescription opiates methadone and buprenorphine to PDMPs. 

Attempting to apply 42 CFR Part 2 generally to PDMPs would further complicate the transfer, use, and 

interpretation of data by PDMPs, which ultimately affects the ability of Medicaid programs to ensure 

beneficiaries receive quality care. In the unfortunate event that the regulations are applied to PDMPs, 

we recommend the requirements only apply to medications used solely for specialized substance use 

disorder treatment. 
. . 

Janice K. Brewer, Governor

Thomas J. Betlach, Director 

... AHCCCS 

Arizona Health Care Cost Containment System 

. 

June 24, 2014 

Ms. Pamela Hyde 

Administrator 

The Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road, room 5-1011 

Rockville, MD 20857 

Re: FR Doc 2014-10913; Confidentiality of Alcohol and Drug Abuse Patient Records 

Regulations, 42 CFR Part 2 

Dear Ms. Hyde: 

On behalf of the Arizona Health Care Cost Containment System (AHCCCS), Arizona's 

Medicaid Program, I thank you for the opportunity to submit comments concerning potential 

changes to the federal regulations at 42 CFR Part 2 which govern the confidentiality of alcohol 

and substance abuse treatment information. The AHCCCS Program currently serves in excess of 

one and one half million members, providing extensive behavioral health services to residents of 

Arizona, including substance abuse services. During the past several years, AHCCCS has 

championed efforts to integrate health care delivery by Contractors and sister agencies, 

collaborating in a wide range of initiatives that mandate integration of both behavioral and 

physical health care services by these entities. Not only does such integration simplify the 

delivery of health care from the member perspective, these efforts also maximize care 

coordination, enhance accessibility and quality of services for improved care and member health 

outcomes, and increase patient safety. 

The regulations in Part 2 were adopted many years prior to both the Health Insurance Portability 

and Accountability Act (HIPAA) privacy and security regulations and the accelerated 

transformation of the health care delivery system throughout the country. As pointed out by The 

Substance Abuse and Mental Health Services Administration (SAMHSA) in its background 

information, dramatic changes have taken place in the health care delivery system during the past 

twenty-five years that were not contemplated when the Part 2 regulations were updated in 1987. 

SAMHSA describes these changes to include "new models of integrated care that are built on a 

foundation of information sharing to support coordination of patient care, the development of an 

electronic infrastructure for managing and exchanging patient data, the development of 

prescription drug monitoring programs and a new focus on performance measurement within the 

health care system." 

Despite the AHCCCS Program's prominent role in broadening health care access and quality, we 

continue to be challenged by significant barriers to providing appropriate health care as a result 

of the onerous confidentiality provisions in Part 2. Without vigorous standards for ensuring the 

801 East Jefferson, Phoenix, AZ 85034 • PO Box 25520, Phoenix, AZ 85002 • 602-417-4000 • www.azahcccs.gov 
Ms. Pamela Hyde 

June 24, 2014 

Page 2 

protection of confidential information for this population, AHCCCS recognizes that individuals 

will not feel comfortable seeking treatment. However, absent substantial modification to the Part 

2 consent requirements, the goals of integrated care will never be realized, and the stigmas and 

discrimination associated with receiving such treatment will not diminish. 

As examples, unavailability of substance abuse treatment records may result in the improper 

prescription of opiates to patients enrolled in methadone clinics seeking primary care or visiting 

an emergency department. Serious adverse patient outcomes may occur when patients with 

comorbid conditions such as asthma, pregnancy, diabetes, or cardiac problems, receive care from 

providers who lack access to the patient's health care records and treatment history. Over 

prescription of medications to persons with drug seeking behaviors is more likely when the 

individual's pharmacy data and medical records are unavailable. 

Indispensable to effective and high quality treatment of persons receiving care for alcohol or 

substance abuse is sharing of vital health care information. However, the federal regulations 

governing disclosure of alcohol and substance abuse treatment records impose unnecessary 

impediments in sharing critical health information necessary to ensure appropriate patient care 

and treatment. AHCCCS fully supports the detailed comments submitted by NAMD and the 

Mental Health Program Directors to SAMHSA regarding 42 CFR Part 2. We urge SAMHSA to 

align the privacy requirements for alcohol and drug abuse records with HIP AA requirements for 

medical and mental health information. We also support strengthening penalties for improper 

disclosure of alcohol and substance abuse treatment records. 

Sincerely, 

Thomas J. Betlach 

Director 

cc: Cheryl Young, CMS 

Wakina Scott, CMS 
 

 

 

 

 

 

 

 

 

 

 

COMMONWEALTH of VIRGINIA 

DEBRA FERGUSON, Ph.D. 

COMMISSIONER DEPARTMENT OF 

BEHAVIORAL HEALTH AND DEVELOPMENTAL SERVICES 

Post Office Box 1797 

Richmond, Virginia 23218-1797 

June 25, 2014 

Telephone (804) 786-3921 

Fax (804) 371-6638 

www.dbhds.virginia.gov 

TO: Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Rockville, Maryland 20857 

FROM: Debra Ferguson, Ph.D. 

RE: Docket #2014-10913 

Substance Abuse and Mental Health Services Administration 

42 CFR Part 2 

Confidentiality of Alcohol and Drug Abuse Patient Records 

Thank you for the opportunity to comment on the changes SAMHSA is considering to 42 CFR 

Part 2. As the Single State Agency (SSA) responsible for administering the Substance Abuse 

Prevention and Treatment Block Grant (SAPT-BG) for Virginia, this regulation is of particular 

significance to the Department of Behavioral Health and Developmental Services (DBHDS) as 

we work with our service system to provide behavioral health care to some of our 

commonwealth’s most vulnerable residents in the 21st century. Several DBHDS staff participated 

in the Listening Session sponsored by SAMHSA on June 11 and found it to be informative. We 

are, therefore, offering the following comments for your consideration, following the guidance 

provided in the May 12, 2014 Federal Register (pp.26929-26932). 

We propose that the SSA for each state and territory and the District of Columbia be considered 

a Qualified Service Organization for the purposes of collecting client-level data to comply with 

data collection requirements of the SAPT-BG and to allow the SSA to use this data to measure 

quality, efficiency and outcomes of services. In as much as the SAPT-BG funds are only part of 

the funding that supports these services, we would not make a distinction about whether the 

individual had participated in services funded by the SAPT-BG, state general funds, or other 

public dollars. 

DBHDS allocates SAPT BG funds and state general funds to 40 community services 

boards/behavioral health authorities (CSBs/BHAs) that are entities of local government 

established to provide mental health, substance abuse, and developmental services to individuals 

in their service areas. These CSBs/BHAs are governed by policy boards appointed by local 

governments. DBHDS allocates funding to CSBs/BHAs through a performance contract and 

grant process. They report data about services, individuals served, and revenues and expenditures 
 

 

Docket #2014-10913, SAMHSA 

June 25, 2014 

Page 2 

to DBHDS. Although we are required by the Treatment Episode Data Set (TEDS) implemented 

by SAMHSA to report client-level data that identifies individuals such as date-of-birth, 42 CFR 

Part 2 prohibits these providers, which we fund with federal SAPT BG dollars, to redisclose this 

information to us without specific, time limited permission from individuals receiving services, a 

process that is cumbersome if not impossible to implement for all clients. and may, in fact, act as 

a barrier to treatment. To remedy this situation, we suggest that 42 CFR Part 2 be amended to 

make the SSA an automatic Qualified Service Organization (QSO). We could easily integrate the 

necessary agreement language into our performance contracts with the 40 CSBs/BHAs. 

DBHDS has, in fact, referenced HIPAA into the performance contract so that the CSBs/BHAs 

may disclose client-level information concerning individuals who receive mental health or 

developmental services to DBHDS by the following HIPAA regulations: §164.506 (c) (1) and 

(3) and §164.512(a) (1) and (d). 

As the recipient of the Community Mental Health Services Block Grant, DBHDS also allocates 

these funds to the 40 CSBs/BHAs that provide mental health services in the community. The 

inclusion of the above cited HIPAA language in the performance contract allows DBHDS to 

track individual progress in these local community programs and to track continuity of care 

should individuals need to be admitted to a state mental health hospital. Programmatically, 

SAMHSA has been promoting integrated services to individuals with co-occurring mental illness 

and substance use disorders, and we have been working towards this objective. However, the 

current provisions of 42 CFR Part 2 prevent these providers from accurately reporting to us 

about the substance abuse treatment services provided to these individuals, rendering an 

incomplete picture from our perspective as funder. 

As mentioned, the Virginia public behavioral health system is comprised of 40 CSBs/BHAs and 

nine state mental health facilities. From time to time, an individual who has been receiving 

substance abuse treatment at a CSB/BHA will be admitted to a state mental health facility, which 

is directly owned and operated by DBHDS, an agency of the Commonwealth of Virginia. As the 

individual might be under the influence of alcohol or other drugs at the time of admission and 

might be exhibiting other symptoms of mental illness such as paranoia, he might not be willing 

to provide permission to share information about his community substance abuse treatment, and 

42 CFR Part Two prohibits the community provider from sharing this information without such 

permission. The admission might not qualify as a medical emergency, but this restriction 

prevents sharing information that could be vital to the individual’s health and safety, not to 

mention a successful treatment outcome. For instance, the state hospital might not know that the 

individual was being treated with methadone that needed to be continued; or the state hospital 

might not know that the individual needed to detoxify from alcohol and might be prone to lifethreatening seizures. The individual then might be discharged to a different CSB/BHA for 

treatment after the hospitalization, but that subsequent CSB would not have access to the 

substance abuse treatment history from the first CSB/BHA or the state hospital. We believe that 

allowing the SSA to be included in the definition of the QSO would resolve these issues, would 

promote improved continuity and quality of care, and would improve our ability as the SSA to 

assure that federal resources were being used effectively and efficiently. 
 

 

 

 

 

Docket #2014-10913, SAMHSA 

June 25, 2014 

Page 3 

In closing, we would urge SAMHSA to consider an approach that would promote increased 

integration between the general health care system and substance abuse treatment. Specifically, 

we recommend that SAMHSA preserve the criminal justice protections provided by 42 CFR Part 

2 but conform other provisions of this regulation concerning receiving and disclosing 

information that would otherwise be considered Protected Health Information, such as diagnosis 

and treatment history, with the applicable provisions of HIPAA as cited above. This change 

would promote integration of mental health services with substance abuse treatment services, as 

well as integration of substance abuse identification and treatment with primary health care. 

We appreciate the opportunity to provide these comments on 42 CFR Part 2. Developed prior to 

the development of health information exchanges and electronic health record systems, the 

regulation now presents roadblocks to efficiencies and best care practices and should be revised 

to allow for the technological advances of the past 40 years. We hope that you find these 

comments helpful. 

c:		 Karen Taylor, Assistant Attorney General, Office of the Attorney General of Virginia 

Mellie Randall, Director, Office of Substance Abuse Services, Virginia Department of 

Behavioral Health and Developmental Services 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

From: Bud Ziolkowski [mailto:bud@behaviorhealthnet.org]
 

Sent: Wednesday, June 25, 2014 12:21 PM
 

To: Privacy Regulations (SAMHSA)
 

Subject: 42 CFR Part 2 Comments
 

Comments: Substance Abuse Confidentiality Regulations and Guidance: 

North Country Behavioral Healthcare Network (NCBHN) is comprised of twenty-three nonprofit 

member agencies providing mental health (MH) and substance use disorder (SUD) services in New 

York’s seven northernmost counties, the “North Country.” 

NCBHN appreciates the opportunity to provide comments in conjunction with SAMHSA’s 6/11/14 

listening session regarding the Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 

42 CFR Part 2. 

It is our belief that the explicit inclusion of care coordination in the routine and regular use of the 

Qualified Service Organization Agreement (QSOA) would be the most important step that can be taken 

in order to meet the challenge of the integration of substance use disorder (SUD) services with the rest 

of the healthcare system. 42 CFR already provides only limited confidentiality to SUD clients/patients, 

and the limitations are delineated for prospective clients before they sign a treatment agreement. The 

QSOA and its purpose could be added to the limits to confidentiality that are explained at the beginning 

of any treatment episode. The agreement could possibly be expanded beyond care coordination based 

on a decision as to the scope of entities with a need to know information contained in patient records 

(e.g. payers, researchers). 

We agree with some of the presenters during the webinar who indicated their belief that the separation 

fostered by 42 CFR protection for individuals engaged in SUD services may actually contribute to the 

continuation of the stigma associated with the clinical diagnosis and engagement in those services. 

Ideally, the long-term solution is for patient confidentiality to be protected in the same way across all 

healthcare services, so we could foresee the elimination of the perceived need for 42 CFR, and the 

application of the Health Insurance Portability and Accountability Act (HIPAA) to SUD patient records. 

We understand that patient concerns continue to exist with regard to the sharing of the information 

contained in their records. However, we believe that there is a strong correlation between patient 

resistance to changing a destructive lifestyle by discontinuing the use of addictive chemicals and 

resistance to the appropriate sharing of information contained in their clinical records. Having clinicians 

normalizing that sharing of information and explaining the benefits to the patient up front could go a 

long way toward shifting the existing paradigm of strict confidentiality. 

Once again, thank you for the opportunity to contribute to this discussion. We look forward to working 

with a revised, updated and more integration-friendly version of 42 CFR Part 2. 

Bud Ziolkowski 

Sr. Project Specialist 

North Country Behavioral Healthcare Network 

PO Box 891, Saranac Lake, NY 12983 

Ph: 518-891-9460 

Email: bud@behaviorhealthnet.org 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

2800 Rockcreek Parkway 

Kansas City, MO 64117 

816.201.1024 Tel 

816.474.1742 Fax 

June 25, 2014 

Pamela S. Hyde, JD, Administrator 

Substance Abuse and Mental Health Services Administration 

Choke Cherry Rd. 

Rockville, MD 20857 

Document Number: 2014-10913 

Dear Ms. Hyde: 

On behalf of Cerner, I am writing to support SAMHSA in its efforts to revise Title 42 of the Code of 

Federal Regulations Part 2 (“Part 2”) regarding the confidentiality of alcohol and drug abuse patient 

records. Attached you will find Cerner’s comments to several questions posed in SAMHSA’s Notice of 

Public Listening Session published May 12, 2014, in the Federal Register. 

By way of background, Cerner is the largest standalone health IT company in the world. With more 

than 14,000 client facilities worldwide and a presence in 24 countries, we remain at the forefront of 

health IT innovation on a global scale. Our solution offerings span all hospital departments, 

ambulatory practices, psychiatric hospitals, correctional facilities, behavioral health, rehabilitation 

and extended care facilities, employer sites and retail pharmacies. In 2011, we adopted the tagline 

“health care is too important to stay the same.”TM This exemplifies our belief that the status quo in 

health care must change in order to truly improve health outcomes and save lives. Also in 2011, 

Cerner began strategically investing in development specific to behavioral health venues of care and 

has furthered its investment more recently with the acquisition of a community behavioral health 

EMR. We believe that behavioral health is integral to overall wellness and are eager to help the lead 

the change toward holistic care of all individuals served by the health care system. 

We can only achieve improved outcomes and safer care when a consumer’s information can 

appropriately be used across venues for the good of the consumer. Substance abuse treatment is 

delivered increasingly in general health care and integrated care settings. People with substance 

abuse disorders are more likely to have other medical health disorders and are frequent users of 

Emergency Departments. To receive the quality care they deserve, people need their providers to 

have access to any and all pertinent health information when necessary, particularly when it impacts 

patient safety and/or quality of care. The current regulations introduce barriers that ultimately keep 

alcohol and drug abuse information or any information, including medical information, collected 

while in a substance abuse center separate from other health records, prohibiting providers from 

being able to see the complete picture of what is happening with their patients and preventing them 

from providing the most effective and safe treatment. The integration of behavioral health data, 

including substance abuse information, is imperative to providing holistic, patient-centered care. 

However, Cerner understands the importance of protecting the privacy and confidentiality of 

substance abuse information due to the consequences and discrimination patients can face if such 

information is disclosed beyond the health care setting. For this reason, Cerner encourages SAMHSA 

to facilitate the development of a nationwide privacy framework under which all personal health 

information, including behavioral health and substance abuse information, is protected. 

Our commitment to behavioral health integration with medical care is evident in our involvement in 
 

 

 

 

 

 

 

 

 

 

Page 2 

the Software and Technology Vendors Association (SATVA) Pilot project for the Data Segmentation for 

Privacy (DS4P) initiative. Leveraging our experience and leadership in integrating electronic health 

records with Health Information Exchanges through the Direct Project, we created an ultra-sensitive 

email exchange compliant with 42 CFR Part 2 that flagged any data element for sensitivity based on 

HL7's DS4P Obligation and Refrain Policy Vocabulary sets. While this is not the final solution for 

exchanging ultra-sensitive health information, it is a step toward exchanging ultra-sensitive 

information and achieving interoperability for behavioral health. 

Cerner commends SAMHSA for recognizing the need to revisit, discuss and debate the current status 

quo regarding substance abuse information by seeking input from industry stakeholders. Cerner 

appreciates the opportunity to respond to SAMHSA’s questions and your consideration of our input. 

Please contact me if clarification or additional information is needed on any response, as I would be 

glad to discuss in more detail. 

Sincerely, 

John Travis 

Vice President, Regulatory & Compliance Strategy 

816-201-1465 

jtravis@cerner.com 

Cerner Response: FR Citation 79 FR 26930 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Page 3
	

Applicability of 42 CFR Part 2 

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. 

Covered information could be defined based on what substance abuse treatment services are 

provided instead of being defined by the type of facility providing the services. 

FR Citation: 79 FR 26930 

Comments: By its mention of the options for defining what information is covered under 42 CFR Part 

2, SAMHSA mentions the options could include defining applicability of the regulation in terms of the 

substance abuse treatment services provided rather than the facility providing the services. 

SAMHSA further stated this could include services provided by any federally assisted health care 

provider. Cerner welcomes a definition of what treatment services and treatment records would be 

considered covered by 42 CFR Part 2 if it can be done in a manner that allows for the information to 

be consistently and reliably understood semantically between providers sending and receiving the 

treatment records considered within scope of the regulation, To date, the applicability of the 

regulation encompasses all such records that are disclosed by a provider covered by the regulation 

as a treatment facility. If SAMHSA changes the applicability of the regulation to services that may be 

provided by any given provider participating in federal health programs, that could encompass many 

additional types of providers who are of a more general nature in terms of their services and 

serviced patient population. Cerner believes that if such a change in the applicability of the 

regulation is adopted, it requires a much more through definition of what the services are so that 

they can be semantically understood by providers involved in health information exchange so both 

can know and understand in common how the services are identified. This would serve to enable 

both parties to know what data privacy protections and consent permissions apply in what is 

exchanged so that the receiver can know what is subject to limitations on re-disclosure beyond their 

own treatment related use of the information they receive. We believe this includes identifying the 

conditions, medications, procedures, interventions and related clinical information that can be 

attributed to behavioral health treatment related services so that an applicability approach based on 

the types of services provided can be supported by assuring the information that accrues to those 

services can be accurately identified as ultra-sensitive in exchange. 

Questions:
 

How would redefining the applicability of 42 CFR Part 2 impact patients, health care provider
 

organizations, HIEs, CCOs, HIT vendors, etc.?
 

	 Changing the applicability of 42 CFR Part 2 would require health IT vendors to develop the 

capability to develop capabilities to either "sequester documents” or develop the ability to 

understand the sensitive nature of data at a finer grained level, so that data requiring a 

higher level of protection would be restricted to only those who need to access it. While this 

may change how the regulations are applied to broader classes of providers, it also provides 

the opportunity to standardize data that requires greater protections so it can be 

identified/segmented quickly and easily for purposes of supporting interoperability and 

health information exchange. 

	 If the applicability of the regulation changes from the treatment facility as the defining 

element to an approach more based on the nature of the treatment records being the 

defining element for how the regulation is applied, it does serve to open up much more the 

need to define in substance what kinds of records are in scope of the regulation so that 

providers who are not strictly speaking substance abuse treatment providers but general 

medical/surgical providers of a broad range of services may be able to clearly understand 

the applicability of the regulation to them. Such providers will either have to define for 

themselves what kinds of records they hold fall within scope of the regulation or look to 

some form of semantic standard to define it for them on a normative basis. Either way, 

Cerner Response: FR Citation 79 FR 26930 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Page 4 

guidance will be needed to help them reach the determination they need to reach as to the 

information they hold, and that may be better served by a normative semantic definition that 

both the disclosing provider and the receiving provider can reference in common. 

Would this change address stakeholder concerns? 

	 This change could make the definition of covered information more granular in nature, which 

will introduce confusion among providers if examples are not provided. If the regulations 

change so that covered information is defined based on the type of treatment services 

provided vs. type of treatment facility, SAMHSA will need to provide clear guidance as to 

exactly which treatment records are covered under the regulations and which are not. Lack 

of clarity in this regard would cause confusion and frustration among providers who treat 

comorbidities involving substance abuse but are not exclusively substance abuse/behavioral 

health providers. Providers who both send and receive substance abuse information for their 

patients need to understand the applicability of any revisions made to 42 CFR Part 2 to them 

specifically. 

Would this change raise any new concerns? 

	 Because the definition of covered information could become more granular if the 

applicability of 42 CFR Part 2 is revised, protections for covered information could also 

become more granular as may how consent permissions are defined in terms of what data 

they may apply to, and how receiving systems and providers must honor them to prevent redisclosure. We believe SAMHSA needs to provide clear guidance and examples of covered 

information if the regulations are revised. A finer grained definition of what is covered could 

create more difficulty in determining appropriate consent requirements and identifying 

records covered by this change. 

Consent Requirements 

While technical solutions for managing consent collection are possible, SAMHSA is examining 

the consent requirements in § 2.31 to explore options for facilitating the flow of information 

within the health care context while ensuring the patient is fully informed and the necessary 

protections are in place. Specifically, we are analyzing the current requirements and considering 

the impact of adapting them to: 

1.	 Allow the consent to include a more general description of the individual, organization, or 

health care entity to which disclosure is to be made. 

	 Cerner agrees with this suggestion, but we believe the that consent collection should 

require the organization or health care entity to which the disclosure is to be made be 

required. However, specification of an individual should be left as an optional element if 

it applies to the disclosure at hand. 

2.	 Require the patient be provided with a list of providers or organizations that may access 

their information, and be notified regularly of changes to the list. 

	 If the applicability of 42 CFR Part 2 continues to be based on treatment facility, this 

requirement is more feasible. However, if the applicability of the regulations changes to 

be based on the type of treatment services, maintaining such lists could be a significant 

challenge for care providers. A general medical surgical hospital or tertiary care facility 

can have extensive referral networks and may leverage many facilities and individuals in 

consulting capacities for patient care. It may be more effective for consent requirements 

Cerner Response: FR Citation 79 FR 26930 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Page 5 

to focus on specifying to whom disclosures will be made and require that organization to 

have a privacy policy in place identifying the types of entities to which further disclosures 

may be made and what information could be disclosed. It would be important to 

reinforce the patient’s ability to consent to such disclosures as well. 

3.	 Require the consent to name the individual or health care entity permitted to make the 

disclosure. 

	 This may sound good in theory but be difficult to put into practice. Cerner believes it is 

sufficient for the consent form at a minimum to reference the entity making the 

disclosure. This could be done via a header on the form that includes the facility name 

and address information, for example. It could also be accomplished by addressing the 

contact person for the entity’s privacy office or function. 

4.	 Require that if the health care entity permitted to make the disclosure is made up of multiple 

independent units or organizations that the unit, organization, or provider releasing 

substance abuse related information be specifically named. 

	 Making disclosure rules more granular makes any regulation more challenging from an 

implementation and compliance perspective. If the applicability of 42 CFR Part 2 

continues to be based on treatment facility, Cerner agrees that all entities to which the 

regulations apply should be specifically named in the consent process in the case of a 

multi-organization setting. If the regulations are changed to apply to the types of 

treatment services provided, however, and that information is contained in a record 

maintained within the a broader medical record, we encourage consent and disclosure 

activity to be managed consistently with other privacy related consents. Typical consent 

forms are maintained at the entity level and classify treating providers as entities rather 

than individuals as well. Requiring individual units to be named (if the applicability of 42 

CFR Part 2 does not apply specifically to treatment facilities) would add an unnecessary 

level of complexity and granularity while creating a burden for the unit, organization or 

individual to manage highly sensitive information through processes and oversight on 

their own vs. sharing that responsibly in an integrated care environment. 

5.	 Require that the consent form explicitly describe the substance abuse treatment information 

that may be disclosed. 

	 We believe that this should be an optional element of consent but that a more 

appropriate approach would be to use an approach similar to that used for 

authorizations under HIPAA which allows for a more flexible approach to provide for 

general description of the records to be disclosed or a specific description of that 

disclosure is to be more limited. This should be determined by the situation at hand and 

not mandated for all circumstances of disclosure. 

Re-disclosure 

SAMHSA is considering revising the re-disclosure provision to clarify that the prohibition on redisclosure only applies to information that would identify an individual as a substance abuser, 

and allows other health-related information shared by the Part 2 program to be re-disclosed, if 

legally permissible. This would allow HIT systems to more easily identify information that is 

Cerner Response: FR Citation 79 FR 26930 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Page 6
	

subject to the prohibition on re-disclosure enabling them to utilize other technological 

approaches to manage re-disclosure. If data are associated with information about where the 

data were collected (data provenance) which reveals that the data were collected by a practice 

that exclusively treats addiction, the data would still be protected under the proposed change. 

Comments: More clarification is needed regarding how SAMHSA expects a substance 

abuser would be identified. We are dubious that such an approach would serve to limit 

the re-disclosure provision in an appreciable way as many different types of records 

could potentially divulge that fact when disclosed in particular contexts with 

demographic data, conditions, or as paired with other information. We do believe it 

would be helpful to allow for re-disclosure of information such as medications, laboratory 

testing, allergies, immunizations, and family history conditions and other information 

that on their own as discrete data would not serve to identify the individual as a 

substance abuser or that are not in isolation things that would be considered subject to 

heightened privacy protections. For example, it would be useful to be able to have 

medications, allergies, problems, diagnostic laboratory tests and immunization records 

able to be “re-discovered” through a process of incorporation into a recipient’s medical 

record so they may be included in information re-disclosed by the recipient as part of 

medication lists, problem lists and similar kinds of information in their own summaries of 

care if such information can be used in a form that does not identify an individual as a 

substance abuser. This also may require that the information that is initially received by 

such a provider in a summary of care or similar form from the provider involved in 

treating a substance abuser for their behavioral health condition be able to be 

“sequestered” in its original form from re-disclosure by the receiving provider. It also may 

still require any information that does serve to identify the substance abuser still be 

limited from being able to be re-disclosed absent appropriate patient consent. But if 

those concerns can be addressed, other information reduced to a more discrete form 

absent the context of identifying the patient as a substance abuser should be able to be 

used on par with other medical record information and normal HIPAA treatment related 

disclosure requirements able to be applied. 

Questions: 

Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 in an 

EHR or HIE environment? 

	 This may require several abilities to be adopted in an EHR or an HIE environment: 

o	 The ability to sequester the original form of the disclosure as received by the 

recipient provider in an exchange 

o	 The ability to identify and segment any information received so that it may be 

regarded as protected from re-disclosure if it still serves to identify the patient as 

a substance abuser 

o	 The ability to incorporate or “re-discover” patient data from what is received by a 

provider from another provider who is treating the patient as a substance abuser 

such that it can be used at a normal level of sensitivity on par with other medical 

record information that is of a more general treatment nature not specific to 

behavioral health 

o	 The ability to maintain privacy protections and be able to receive and apply 

privacy protections and consent permissions to information that must remain 

considered as ultra-sensitive so it is not inappropriately redisclosed 

Cerner Response: FR Citation 79 FR 26930 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Page 7
	

Would these changes maintain the privacy protections for patients? 

	 As mentioned in the previous comments, Cerner encourages SAMHSA to consider how 

information may be reasonably abstracted from a covered treatment record so that 

information may be able to be generally used without ultrasensitive privacy protections 

following the data if it is not necessary. For example, a medication or a diagnostic test 

result on its own may be able to be used for general patient care related purposes, and 

on its own may reveal nothing in particular about the substance abuser or substance 

abuse condition of a patient. We suggest that the regulations and guidance regarding 

their applicability encourage defining a process of abstraction that would suffice without 

creating undue risk in the event of inadvertent disclosure or discovery of substance 

abuse conditions. We also encourage SAMHSA to consider how the sanctions and 

penalties for unauthorized re-disclosure may be strengthened so that the sharing and 

appropriate use of the patients’ medical records and elements of them can be promoted. 

The requirements for consent and re-disclosure could be eased in the manner described 

above without compromising the ultrasensitive nature of the substance abuse 

information. 

Medical Emergency
 

SAMHSA has heard concerns regarding the medical emergency exception of 42 CFR Part 2 (§
 

2.51). The current regulations state that information may be disclosed without consent “for the 

purpose of treating a condition which poses an immediate threat to the health of any individual 

and which requires immediate medical intervention.” The statute, however, states that records 

may be disclosed to medical personnel to the extent necessary to meet a bona fide medical 

emergency. SAMHSA is considering adapting the medical emergency exception to make it more 

in-line with the statutory language and to give providers more discretion as to when a bona fide 

emergency exists. For example, amending this standard to allow providers to use the medical 

emergency provision to prevent emergencies or to share information with a detoxification center 

when a patient is unable to provide informed consent due to their level of intoxication. 

Questions: 

What factors should providers take into consideration in determining whether a medical 

emergency exists? 

	 Healthcare providers are the only ones that may correctly label a situation as a medical 

emergency. 

Are there specific use cases SAMHSA should take into consideration? 

 Cerner agrees that emergency situations trump or bypass the need for explicit patient 

consent for substance abuse information, but that information should not be redisclosed following the emergency without obtaining patient consent or as otherwise 

authorized by HIPAA and by the applicability of 42 CFR Part 2 to the data that may be stored 

in the recipient’s medical record disclosed as a result of the emergency situation. 

Addressing Potential Issues with Electronic Prescribing and Prescription Drug Monitoring 

Programs (PDMPS) 

Questions: 

Cerner Response: FR Citation 79 FR 26930 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Page 8
	

Are there specific concerns regarding 42 CFR Part 2 and PDMPs? 

	 Prescription Drug Monitoring Programs have been working extensively to exchange 

information across state lines and integrate with electronic health records. However, 

even though disclosure of patient-identifying information by federally-assisted programs 

is permitted with written patient consent, because re-disclosure of information from 

Opioid Treatment Programs (OTPs) and Drug Addiction Treatment Act-waived (DATAwaived) physicians by PDMPs is prohibited, their integration into electronic health 

records is not as valuable as it could be from a coordinated care standpoint. 

Rediscovery of Information 

In addition to our responses to the specific questions, Cerner would like to provide input 

regarding rediscovery. The ability for healthcare providers to leverage automated systems to 

know where particular data comes from is becoming an increasingly valuable tool in weighing 

the significance of that data against data from other sources. To put it simply, provenance is an 

aspect of data that should not be undervalued. If a discrete element of information is gathered 

from two independent sources, one with 42 CFR Part 2 obligations and one with no special 

obligations, then that element should be able to be re-disclosed without special obligations 

(unless the patient specifically requests further special handling as is his or her right under 

HIPAA). This type of “restrictive filtering” may accomplish the goal of reducing the reach of 42 

CFR Part 2 over data that is not considered ultra-sensitive in its own context without creating 

additional technical burdens. 

Cerner Response: FR Citation 79 FR 26930 
DEPARTMENT OF HUMAN SERVICES 

ANN SILVERBERG WILLIAMSON 

Execuli\'e Director 

State of Utah 

DSAMH 

DIVISION OF SUBSTANCE ABUSE AND MENTAL HEALTH 

DOUG THOMAS 

GARY R. HERBERT Director 

Governor 

SPENCER J. COX 

Lieutenant Go\'ernor 

Director Hyde, 

After discussion and a review of the points made on the SAMHSA 42 CFR Pait 2 Listening 

session on June 11, 2014, the Utah Department of Human Services Division of Substance Abuse 

and Mental Health makes the following recommendations: 

•	ñ We agree with Ron Manderscheid's recommendation that 42 CFR Pait 2 protections be 

replaced with the protections and privileges offered under the Health Insurance 

Portability and Accountability Act (HIP AA). 

•	ñ We recommend that instead ofrelying on 42 CFR Pait 2's provisions to protect clients, 

that the protections provided by the Americans with Disabilities Act be reinforced and 

used to prohibit discrimination against individuals receiving SUD services. 

•	ñ We also recommend that SAMHSA remain focused on protecting and providing for 

patient's health, rather than on concealing patient's health condition, and that integration 

of Health Care Services, including MH and SUD services, be the priority. 

These recommendations are based on the following: 

1. We agree with Mr. Manderscheid's statement that 42 CFR Part 2 stigmatizes SUD clients. 

2. Having different protections for health care records and status between patients with MH and 

SU disorders impedes integration and ignores the extensive overlap of co-occun-ing conditions. 

3. Most of the incidents cited by the Legal Action Center alleging discrimination and stigma 

regarding SUD treatment are not precluded by the existence of 42 CFR Part 2. Examples 

include: • Police parking outside of Methadone Clinics. • Arrests of clients for impaired driving outside of Methadone clinics. • Clients being refused treatment by physicians because of their use of methadone • Clients being discriminated against in housing or employment because of their use of 

methadone. • Clients being bairnd from drug courts as medically disqualified due to their use of 

methadone. • Clients losing custody of their children due to being in SUD and or Medication 

Assisted Treatment. • Clients being ordered to cease using an addiction medication by law enforcement 

representatives. 

In none of the above cases does 42 CFR Part 2 protect the client. When these 

types of cases are successfully challenged it is not because they represent 

violations of 42 CFR Pait 2, but because they violate provisions of the 

Americans with Disabilities Act and the Rehabilitation Act of 1973. 

telephone 

DSAt-.1H

(801) 538-3939 

, 195 North 

• facsimile 

1950 West, Salt Lake City, Utah 

(801) 538-9892 • www.dsamh.utah.gov 

84116 JITAH LIFE ELEVATED' 
4. The confidentiality provided by 42 CFR Part 2 can increase consequences and stigma in the

following ways: • Often organizations' official policies prohibit the use of Medication Assisted 

Treatment (MAT) despite the research showing its effectiveness. When individuals

who attempt to conceal their use of MAT through the protections of 42 CFR Pait 2 

are forced to admit their enrollment, they are either denied the services or ordered to 

cease taking the medication. The rationale often used is that the client was lying to

them and that was the cause of their punishment. Examples include: 

o	� Removal from Drug Court or Jail and forced withdrawal as a sanction. 

o	� Employers refusing to hire individuals using MAT. 

o Probation and Parole officers "ordering" individuals to cease using MAT. 

When individuals then relapse into illicit drug use, as often happens, it is used

to demonstrate that they were "just using anyway." • Individuals who attempt to hide their use of MAT reinforce the perception that it is an

illicit or illegal activity rather than a treatment for a health problem. • Continuing to provide "Special Protections" outside ofHIPAA will perpetuate the

idea that SUD clients are "somehow different" than "normal" health care clients,

which in itself, creates a stigma. 

5. Under the provisions of HIP AA, clients have more control of their health information. For

example, an individual can decide whether they want their infonnation entered into Health 

Information Exchanges, whereas under 42 CFR Patt 2, they do not have the ability to choose. •	� Putting Treatment information into Health Information Exchanges (H!Es) is virtually

impossible, as releases of infonnation have to be specific as to the information 

revealed, who to, and for how long, and rerelease of the information is prohibited

without a second equally specific release. • Therefore, individuals have no ability to rely on the protections to their health in

emergency situations that H!Es provide. •	� In effect, 42 CFR Part 2 restricts the ability of SUD clients to make choices about

their own information. 

6. Unlike HIP AA, 42 CFR Part 2 does not have any consequences for improper use of 

information, only on the improper release of info1mation. Therefore clients have no protection

under 42 CFR Part 2 outside of the treatment center. 

In summary, the DSAMH recommends that the focus should be on integrating SUD services into

the mainstream ofhealth care services, instead of separating them in the name of protections that

the provisions of 42 CFR Part 2 don't provide. 

Thank you for your consideration, 

Doug Thomas

Director 
 

 

 

 

 

I am commenting on the substance abuse confidentiality regulations:
 

It is important that therapists care and have compassion for their clients. Truly caring about someone 

builds trust. A trusting relationship will ensure that the clients wishes on confidentiality are respected.
 

People should understand the causes and trauma that resulted in drug and alcohol abuse. They would 

then have empathy and compassion for the person, and would be less likely to judge them.
 

Another way is for people who have recovered from drug and alcohol abuse to speak out about their
 

success. This also reduces stigma and negative attitudes.
 

Therapists need to be accountable for keeping information confidential.
 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

www.NAACOS.com 

Washington, DC – Bradenton, FL 

The National Association of ACOs (NAACOS) genuinely appreciates the opportunity 

to comment on S!MHS!'s consideration of revising the “Confidentiality of !lcohol 

and Drug !buse Patient Records” regulation (42 CFR Part 2). 

NAACOS is an organization of over 100 Pioneer and MSSP (Medicare Shared Savings 

Program) ACOs, including the most experienced ACOS, or those from the original 

April and July 2012 classes. NAACOS is member led and member driven. In principle, 

NAACOS believes easier and more streamlined access of their physicians to patient 

alcohol and drug abuse claims and data will benefit the patient with little risk of 

improper disclosure. If the patient does not approve of this disclosure then making 

available de-identified but service specific claims and records should be 

implemented so that ACOs can properly account for these expenditures and use the 

dataset to develop and improve clinical management programs. 

Concerning 42 CFR Part 2 we should note first our members we well recognize and 

respect the importance and necessity of patient privacy particularly related to 

alcohol and drug abuse diagnoses. As stated in the regulation's introduction we 

understand why “records of the identity, diagnosis, prognosis, treatment of any 

patient which are maintained in connection with the performance of any drug abuse 

prevention function . . . be confidential” (Section 290eee-3 (a)) and that “the 

content of any record . . . be disclosed in accordance with the prior written consent 

of the patient” ((b) (1)). 

As the Federal Register announcement for the June 11th public listening session 

noted confidentiality of alcohol and drug abuse patient records however “make it 

difficult for . . . new organizations including health information exchange 

organizations (HIEs), Accountable Care Organizations (ACOs), and others to share 

substance abuse treatment records” due to the difficulty and expense of 

implementing the functionality and work flow changes necessary to comply with 

current regulations” and as a result “patients are prevented from fully participating 

in integrated care efforts even if they are willing to provide consent.” 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

With respect to affording patients with an alcohol or drug abuse diagnoses full 

participation in an ACO and enabling an ACO to fully coordinate that patient's care 

please allow us to comment on patient consent and provide a brief note regarding 

re-disclosure. 

First, it's our belief that alcohol and drug abuse issues do not carry the stigma that 

they once did. Second, since patients were assigned or attributed to an ACO 

because a preponderance of their past care was provided by an ACO physician, the 

ACO likely already has related treatment data in their electronic medical records. 

Regardless, ACO program rules allow patients to opt out of (CMS) sharing claims 

data with their assigned ACO. That is a patient with an alcohol or drug abuse 

diagnosis (or for that matter any other diagnosis) already has the ability to keep its 

claims data private or unavailable to their ACO provider. (An ACO patient can also 

keep alcohol or drug abuse treatment data private since they are not obligated to 

seek treatment from their assigned ACO provider.) 

These points aside, the current confidentiality regulation presents several problems. 

First, as the Federal Register notes the regulation has not been undated since 1987, 

that is it takes no account for, provides no guidance on, electronic medical records. 

It's our understanding for a patient to provide an ACO consent it must identify every 

member of the ACO and any and all ancillary providers in the ACO's network 

including HIEs. This is impractical if not unrealistic as well as burdensome and has 

the effect of neither allowing the patient with an alcohol or drug abuse diagnosis to 

participate fully in an ACO nor allowing the ACO to fully coordinate the patient's 

care. For these reasons we believe the patient be given the option to electronically 

consent to have its alcohol or drug abuse records shared with any or all those in an 

ACO network that has a treatment relationship with the patient. In order for this 

option to be allowed we recognize the regulation would likely have to provide a 

definition of an ACO, HIE and others in the care coordination network, for example, 

post-acute services including home health. 

If the federal government is unwilling to reform patient consent for the purposes of 

an ACO's ability to provide adequate care coordination we would recommend 

related claims data be provided ACOs as de-identified. This would at least allow 

ACOs to create better patient population profiles, enable ACOs to develop more 

effective programming and allow them to better manage costs or increase their 

accountability for costs. 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

The Federal Register's discussion of “re-disclosure” (c) first notes “currently most 

notes EHRs don't support data segmentation” and then states S!MHS! is 

considering a “prohibition on re-disclosure [that] only applies to information that 

would identify an individual as a substance abuser, and allows other health-related 

information shared by the Part 2 program to be re-disclosed, if legally permissible.” 

Our first read of this text (c) is these statements are conflicted, i.e., how is patient 

participation and/or ACO care coordination improved if re-disclosure prohibits 

making known the patient's alcohol or drug abuse diagnoses. Our second read is 

SAMHSA is proposing the patient be de-identified but that their “related 

information”, i.e., information related to their alcohol or drug abuse, be conveyed or 

re-disclosed. If the latter interpretation is correct, we would be supportive. 

Thank you again for allowing NAACOS to make comment on 42 CFR Part 2. We 

would welcome any additional or subsequent opportunity to discuss possible 

revisions after SAMHSA reviews all public comments provided. 

Warm regards, 

Clifton Gaus 

President and CEO 

National Association of ACOs 
 

 

 

 

 

 

 

 

From: Rachel Post [mailto:Rachel.Post@ccconcern.org] 

Sent: Wednesday, June 25, 2014 1:06 PM 

To: Privacy Regulations (SAMHSA) 

Cc: Rebecca Birenbaum 

Subject: 42 CFR Part 2 Comments Central City Concern-Portland Oregon 

The Substance Abuse and Mental Health Services Administration
 

Public Listening Session Comment Template
 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 

CFR Part 2
 This document is meant to provide the public with a simple and organized way to submit 

comments on the Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 

CFR Part 2, and respond to questions presented in meeting notice which is published in the 

Federal Register at 79 FR 26929. While use of this document is entirely voluntary, commenters 

may find it helpful to organize their comments. 

This document alone is not intended to provide a full and complete opportunity to comment on 

all of the provisions within the regulation. Please keep in mind that it only reflects those topics 

included in the meeting notice and a section for “other” comments. 

To be considered, all comments (including comments provided through this document) must be 

submitted according to the instructions in the meeting 

notice: https://www.federalregister.gov/articles/2014/05/12/2014-10913/confidentiality-ofalcohol-and-drug-abuse-patient-records. 

Applicability of 42 CFR Part 2 

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. 

Covered information could be defined based on what substance abuse treatment services are 

provided instead of being defined by the type of facility providing the services. 

FR Citation: 79 FR 26930 

Questions: 

• How would redefining the applicability of 42 CFR Part 2 impact patients, health care provider 

organizations, HIEs, CCOs, HIT vendors, etc.? 

• Would this change address stakeholder concerns? 

• Would this change raise any new concerns? 

Public Comment Field: 

The type of facility providing substance abuse services should continue to define what 

information is covered under 42 CFR Part 2. Covered information should not be defined based 

on what substance abuse services are provided. That said, the current definition of “program” in 

42 CFR Part 2.11 should be clarified. There has been confusion about the term “general medical 

facility” where entities, like Central City Concern, operate both health programs that are 

substance abuse “Programs” as that term is defined currently under 42 CFR Part 2.11, and some 

of which are not. But under the current definition of “Program” in 42 CFR Part 2.11 it is not 

clear whether an entity which operates several facilities is included in the exception in 42 CFR 

1
 
 

 

 

Part 2.11(b) as it pertains to “general medical care facilities”. Thus we propose amending the 

definition of “general medical facility” as follows (the italics are the clarifying words): 

(a) An individual or entity (other than a general medical 

care facility, including an FQHC or other entity with 

individually identifiable units) who holds itself out as 

providing, and provides, alcohol or drug abuse diagnosis, 

treatment or referral for treatment; or 

(b) An identified unit within a general medical facility, an 

FQHC, or other entity with individually identifiable units 

which holds itself out as providing, and provides, alcohol 

or drug abuse diagnosis, treatment or referral for treatment; 

or... 

Further, covered information should not be defined based on what substance abuse services are 

provided because currently all 42 CFR Part 2 designated data saved to date has been designated 

as such based on the type of facility that has provided the substance abuse treatment service, not 

by what type of service has been provided. Should covered information now instead be defined 

based on what substance abuse services are provided, all substance abuse services that had been 

provided in a primary care setting as incidental to primary care (i.e., not as part of 42 CFR Part 2 

program), would need to be re-evaluated to determine if the records would now be governed by 

42 CFR Part 2, which would be an administrative burden since those records are not currently 

governed by 42 CFR Part 2, and have only been governed by HIPAA. 

Ultimately, it would be very difficult for providers to sort through patient files each time a record 

is requested or coordinated care is needed to weed out information pertaining to specific 

substance abuse treatment services. Currently, providers know that if their substance abuse 

treatment services meet the definition of entity definition of “Program”, all of their records are 

governed by 42 CFR Part 2, not just a portion of them. 

As a health care provider of primary, mental and behavioral, and substance abuse health care, we 

strongly support amending 42 CFR Part 2 to be more supportive of coordinated care. Changes 

are needed in order to fully coordinate patient care and reduce preventable emergencies resulting 

from the current restrictions under 42 CFR Part 2 that do not allow for coordinated 

care. Redefining what information is covered by 42 CFR Part 2 as suggested in this section 

would make navigating the regulations even more complicated than they currently are to 

navigate, particularly with HIPAA limitations that are inapposite to 42 CFR Part 2. 

Consent Requirements 

While technical solutions for managing consent collection are possible, SAMHSA is examining 

the consent requirements in § 2.31 to explore options for facilitating the flow of information 

within the health care context while ensuring the patient is fully informed and the necessary 

protections are in place. Specifically, we are analyzing the current requirements and considering 

the impact of adapting them to: 

1. Allow the consent to include a more general description of the individual, organization, or 

2
 
 

 

 

 

health care entity to which disclosure is to be made. 

2. Require the patient be provided with a list of providers or organizations that may access their 

information, and be notified regularly of changes to the list. 

3. Require the consent to name the individual or health care entity permitted to make the 

disclosure. 

4. Require that if the health care entity permitted to make the disclosure is made up of multiple 

independent units or organizations that the unit, organization, or provider releasing substance 

abuse related information be specifically named. 

5. Require that the consent form explicitly describe the substance abuse treatment information 

that may be disclosed. 

FR Citation: 79 FR 26931 

Questions: 

• Would these changes maintain the privacy protections for patients? 

• Would these changes address the concerns of HIEs, health homes, ACOs, and CCOs? 

• Would these changes raise any new concerns? 

Public Comment Field: 

Allowing consent to include a more general description of the individual, organization or health 

care entity to which disclosures are made would be very useful for our medical providers 

because it would allow for fewer restrictions when trying to coordinate care. However the items 

numbered 2.-5 would all result in interference with coordinated care as they are too stringent for 

the practicalities of coordinated care, resulting in challenges associated with monitoring patients’ 

health status, and thereby endangering patient’s lives. 

Specifically, regarding #2, nonprofit community providers such as Central City Concern, treat a 

largely transient/homeless population.. It would be impractical for providers to continually 

notify all patients of new providers in the CCO under these conditions. Though not preferable, if 

included in the amended version of 42 CFR Part 2, #2 should be amended to say that it is not the 

obligation of the provider to regularly update the patient, but the patient’s responsibility to check 

the provider list at a publicly available place (on the internet or posted in the office of the 

program) for an updated list of CCO members who may receive the information. It would be an 

incredible administrative burden and not further the ends of coordinate care to require providers, 

particularly FQHCs, to reach a largely homeless population for timely updated informed consent 

documents. 

Regarding #3 and #4, to enable coordinated care with health organizations made of many units, 

neither the individual entity permitted to make the disclosure nor the unit within the entity should 

need to be named. The umbrella entity’s legal name should be sufficient. 

Regarding #5, the regulations should be clarified to say that a general statement of “all substance 

abuse treatment information” is acceptable rather than a description of the scope of information 

to be released. Substance abusers are medically fragile, so more general statements are best to 

ensure adequate care from providers. Regulations that allow patients to choose which substance 

abuse disorders they disclose to their providers, and which they do not could endanger them and 

3
 
 

 

 

 

 

interfere with coordination of care should their provider unknowingly prescribe something that 

interacts with the patient. 

Currently, the failure of 42 CFR Part 2 to allow coordinated care makes it impossible for 

multiple care providers to know, with certainty, that they are providing services and medicine 

that won’t actually harm an individual, should that individual choose not to disclose their alcohol 

or drug dependence. The options suggested in items #2 through #5 above will hamper 

coordinated care efforts and endanger patient lives. Additionally, requiring providers to 

regularly update patients of changes is difficult and impractical in practice. We feel strongly 

that the provisions in #2 through #5 above will endanger the lives of our most fragile patients – 

those addicted to alcohol and drugs who are most in need of coordinated care to recover. 

Redisclosure 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on 

redisclosure only applies to information that would identify an individual as a substance abuser, 

and allows other health-related information shared by the Part 2 program to be redisclosed, if 

legally permissible. This would allow HIT systems to more easily identify information that is 

subject to the prohibition on redisclosure enabling them to utilize other technological approaches 

to manage redisclosure. If data are associated with information about where the data were 

collected (data provenance) which reveals that the data were collected by a practice that 

exclusively treats addiction, the data would still be protected under the proposed change. 

FR Citation: 79 FR 26931 

Questions: 

• Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 in an 

EHR or HIE environment? 

• Would these changes maintain the privacy protections for patients? 

Public Comment Field: 

It would be impossible to release information from a treatment facility without identifying the 

patient as a substance abuser. As a facility that holds itself out as providing, and provides 

alcohol or drug abuse diagnosis, treatment or treatment referral disclosing patient information 

automatically identifies that patient as an individual seeking substance abuse treatment. 

Additionally, in our primary care settings, we do not segregate health information from that 

being primary care and substance abuse related. Thus, we do not believe the changes mentioned 

above would facilitate technical solutions for complying with 42 CR Part 2 in an EHR 

environment because data segmentation is not currently supported in most EHR systems. 

Therefore, this proposed clarification to the rule would not facilitate any solutions if the 

information is still protected. Keeping relevant patient information separate and protected does 

not enable providers to have a full understanding of the patient’s needs. As a result, the changes 

mentioned above would continue to endanger patient’s lives and compromise the coordination of 

their care. 

Medical Emergency 

SAMHSA is considering adapting the medical emergency exception to make it more in-line with 

the statutory language and to give providers more discretion as to when a bona fide emergency 

4
 
 

 

exists. For example, amending this standard to allow providers to use the medical emergency 

provision to prevent emergencies or to share information with a detoxification center when a 

patient is unable to provide informed consent due to their level of intoxication. 

FR Citation: 79 FR 26931 

Questions: 

• What factors should providers take into consideration in determining whether a medical 

emergency exists? 

• Are there specific use cases SAMHSA should take into consideration? Show citation box 

• Are there patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

We believe that sharing all substance abuse disorder and treatment information with healt

providers is necessary to prevent medical emergencies, thus this provision would, in our 

hcare 

provider’s mind, indicate that all substance abuse information is shareable with other 

providers. We support that allowance. 

Qualified Service Organization (QSO) 

SAMHSA is analyzing the regulations to identify options for allowing Part 2 data to flow to 

health care entities for the purpose of care coordination and population management while 

maintaining patient protections. One potential solution includes expanding the definition of a 

qualified service organization (QSO; § 2.11) to explicitly include care coordination services and 

to allow a QSO Agreement (QSOA) to be executed between an entity that stores Part 2 

information, such as a payer or an ACO that is not itself a Part 2 program, and a service provider. 

FR Citation: 79 FR 26931 

Questions: 

• Are there other use cases we should be taking into consideration? 

• Are there specific patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

Central City Concern, as a member of a Coordinated Care Organization, strongly supports edits 

to 42 CFR Part 2 that support integrated care. That said, we argue that the proposed amendment 

should not just apply to CCOs, but the regulation should also specify that a provider can sign a 

QSOA with any organization that commonly provides treatment or payment on behalf of patients 

of the program including other entities that share common ownership with the program. Central 

City Concern, for example, has many programs in its FQHC, and we want to ensure that 

programs within Central City Concern can share information with each other, even though only 

one may be an “Program” as that term is defined in 42 CFR Part 2.11. Currently, Central City 

Concern’s treatment programs cannot communicate with Central City Concern’s non-treatment 

health programs without a release, even though the two programs are owned by the same 

company and share the same patient. 

5
 
 

 

 

Ultimately, the key here is that there must be a balance between ensuring that patient privacy is 

protected while still being able to coordinate care that promotes patient safety. We believe 

HIPAA alone provides adequate protections for patient privacy, particularly as recently 

amended. That said, should 42 CFR Part 2 continue to remain isolated from HIPAA, it is 

essential that the QSOA provisions not conflict with HIPAA’s “Business Associate” rules 

because those who meet the definition of QSO as proposed, will also meet the definition of 

“Business Associate” under HIPAA and the two privacy rules are already extremely difficult to 

reconcile. 

Research 

SAMHSA is considering expanding the authority for releasing data to qualified 

researchers/research organizations to health care entities that receive and store Part 2 data, 

including third-party payers, health management organizations, HIEs, and care coordination 

organizations. 

FR Citation: 79 FR 26932 

Questions: 

• Are there factors that should be considered related to how current health care entities are 

organized, how they function or how legal duties and responsibilities attach to entities that make 

up an umbrella organization? 

• Would this change address concerns related to research? 

• Are there specific privacy concerns associated with expanding the authority or releasing data to 

qualified researchers/research organizations in this way? 

• Are there additional use cases that should be considered in the research context? 

Public Comment Field: 

We support data analytics which is used to further the advancement of quality patient care and 

improved clinical outcomes. CCC partners with qualified researchers and research organizations 

to engage in research that enables us to better understand the needs of the people we serve and to 

respond to those needs in a way that is effective and evidence-based. Research has indicated that 

the prevalence of substance use disorders among homeless individuals is significantly higher 

than among the general population: SAMHSA estimates a prevalence of chronic substance use 

disorders to be approximately 35% among the adult homeless population. 

Given this, barriers to comprehensive data collection about substance use disorders in clinical 

research significantly reduces the effectiveness of our research partnerships. 

Addressing Potential Issues With Electronic Prescribing and Prescription Drug Monitoring 

Programs (PDMPs) 

Part 2 protections include a prohibition on the redisclosure of information received directly from 

a Part 2 program. A pharmacy that receives electronic prescription information directly from a 

Part 2 program must obtain patient consent to send that information to a PDMP, and patient 

consent is also required for the PDMP to redisclose that information to those with access to the 

PDMP. 

6
 
 

 

 

 

Preamble FR Citation: 79 FR 26932 

Questions: 

• How do pharmacy information system vendors anticipate addressing this issue? Are there 

specific technology barriers SAMHSA should take into consideration? 

• Are there other concerns regarding 42 CFR Part 2 and PDMPs? Please describe relevant use 

cases and provide recommendations on how to address the concerns. 

• Are there patient concerns about the impact of e-prescribing and PDMPs on their privacy? 

Public Comment Field: 

Central City Concern has no experience with this as an issue. As a 340b pharmacy, our pharmacy 

can only dispense prescriptions for CCC outpatient programs, so we don’t dispense for substance 

abuse programs; our office-based Suboxone prescription at our health clinic doesn’t fall under 42 

CFR Part 2 because it’s part of CCC’s primary care rather than its substance abuse. 

Other Comments 

Topic: 42 CFR endangers safety of patients. 

Public Comment Field: 

Current 42 CFR Part 2 protections related to inability for communications between medical 

providers regularly endanger patients’ lives. For example, one of Central City Concern’s FQHC 

patients seeking chronic opiate therapy for multiple fractures in her neck was also being treated 

for alcoholism at an outpatient treatment facility. Had this patient not consented to release 

information, our Physician might have prescribed opiates for pain management. Patients 

experiencing untreated chronic pain are at higher risk of suicide. However, prescribing opiates 

to a patient actively using alcohol could result in death due to the interaction between those two 

substances. Many medications used to treat addictions have multiple interactions and need to be 

monitored for life threatening side-effects. 

In another instance, 42 CFR Part 2 restrictions placed our patient in danger; our Physician was 

notified by a lab that her patient’s thyroid level was dangerously high. While the doctor knew 

that this patient was in a residential inpatient setting, she could not speak to the patient to inform 

her of the thyroid information. Our Physician was informed by the residential treatment facility 

that they could neither acknowledge nor deny the patient’s presence in the facility, but agreed to 

post a note on a white board in the community room so that if the patient was there, she might 

see the note. The note would state only that she should contact her doctor. 

Moreover, in order to effectively care for patients in both acute and chronic care settings, it is 

critical for clinicians to be aware of all of their patients' medical issues so that patients can be 

accurately diagnosed and appropriately treated. For instance, it is not possible to accurately 

diagnose someone with a mental health disorder if that patient is also abusing, or in withdrawal 

from, drugs or alcohol. If an incorrect diagnosis is made, patients may be erroneously placed on 

potent medications with significant side effects, and will generally carry that diagnosis for the 

rest of their lives. Similarly, if a primary care physician is unaware that a patient is being treated 

7
 
 

 

 

 

Rachel Post, L.C.S.W. 

Public Policy Director 

232 NW 6th Ave. 

Portland, OR 97209 

Rachel.Post@ccconcern.org 

Work (971)244-5020 

Cell (503)789-7359 

www.ccconcern.org 

 

 

 

 

for mental illness, he/she will not monitor for medication side effects and may not recognize 

them when they occur. These side effects can cause significant morbidity and mortality. 

Finally, for doctors working in a detoxification facility, patients don’t always have the capacity 

for timely releases of information due to their somnolence or agitation resulting from 

detoxification protocol, thereby rendering it impossible for doctors in those settings to obtain a 

clear health history of the patient before rendering detoxification treatment. Additionally, if a 

patient is hospitalized and hospital care team is unaware that the patient is being treated for 

opioid or alcohol use disorders, then the physician will be much less likely to monitor or treat for 

symptoms of withdrawal, which can lead to poorer outcomes and even death. 

Consequently, there must be a balance between protecting patients’ privacy and their lives. 

Substance abusers are extremely medically fragile, and it is imperative for their safety that their 

entire medical record be accessible between their various medical providers. 42 CFR Part 2 was 

established to protect the privacy of substance abusers, so more people would be willing to seek 

treatment. However, 42 CFR Part 2 was written before the protections of HIPAA were in 

place. CCC argues that HIPAA provisions adequately protect the health information of people 

while still allowing coordination of care among various providers. We therefore support 1) 

incorporating 42 CFR Part 2 into HIPAA, so there is one privacy rule from which to comply; or 

2) Repeal 42 CFR Part 2 in whole and rely solely on the privacy protections afforded to 

individuals under HIPAA. 

Comments submitted by Central City Concern in Portland, Oregon www.ccconcern.org 

www.centralcityconcern.org 

Visit our blog 

Like us on Facebook 

Follow us on Twitter 

View new videos on our YouTube channel. 

To sign up for the CCC e-newsletter, click here 

The information contained in this message may be legally privileged and confidential and is intended only for the 

use of the designated recipient. Any review, dissemination, distribution, or copying of this message by anyone other 

than the intended recipient is prohibited. If the reader has received this communication in error, please notify the 

8
 
 

sender of this message and destroy the original message. Central City Concern recognizes that encrypted e-mail is 

insecure and does not guarantee confidentiality. The confidentiality of replies to this message cannot be guaranteed 

unless the replies are encrypted. 

If this email contains information related to the diagnosis, referral, and/or treatment of substance dependence or 

abuse: This information has been disclosed to you from records protected by Federal confidentiality rules (42 CFR 

part 2). The Federal rules prohibit you from making any further disclosure of this information unless further 

disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted 

by 42 CFR part 2. A general authorization for the release of medical or other information is NOT sufficient for this 

purpose. The Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or 

drug abuse patient. 

9
 
 

 

 

 

The Substance Abuse and Mental Health Services Administration
 

Public Listening Session Comment Template
 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2 

This document is meant to provide the public with a simple and organized way to submit comments on the 

Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2, and respond to 

questions presented in meeting notice which is published in the Federal Register at 79 FR 26929. While use of 

this document is entirely voluntary, commenters may find it helpful to organize their comments. 

This document alone is not intended to provide a full and complete opportunity to comment on all of the 

provisions within the regulation. Please keep in mind that it only reflects those topics included in the meeting 

notice and a section for “other” comments. 

 

To be considered, all comments (including comments provided through this document) must be submitted 

according to the instructions in the meeting 

notice: https://www.federalregister.gov/articles/2014/05/12/2014-10913/confidentiality-of-alcohol-anddrug-abuse-patient-records. 

Applicability of 42 CFR Part 2 

SAMHSA is considering options for defining what information is covered under 42 CFR Part 2. Covered information could 

be defined based on what substance abuse treatment services are provided instead of being defined by the type of 

facility providing the services. 

FR Citation: 79 FR 26930 

Questions: 

• How would redefining the applicability of 42 CFR Part 2 impact patients, health care provider organizations, HIEs, 

CCOs, HIT vendors, etc.? 

• Would this change address stakeholder concerns? 

• Would this change raise any new concerns? 

Public Comment Field: 

Page 1 of 6 
 

 

 

 

 

 

 

Consent Requirements 

While technical solutions for managing consent collection are possible, SAMHSA is examining the consent requirements 

in § 2.31 to explore options for facilitating the flow of information within the health care context while ensuring the 

patient is fully informed and the necessary protections are in place. Specifically, we are analyzing the current 

requirements and considering the impact of adapting them to: 

1. Allow the consent to include a more general description of the individual, organization, or health care entity to which 

disclosure is to be made. 

2. Require the patient be provided with a list of providers or organizations that may access their information, and be 

notified regularly of changes to the list. 

3. Require the consent to name the individual or health care entity permitted to make the disclosure. 

4. Require that if the health care entity permitted to make the disclosure is made up of multiple independent units or 

organizations that the unit, organization, or provider releasing substance abuse related information be specifically 

named. 

5. Require that the consent form explicitly describe the substance abuse treatment information that may be disclosed. 

FR Citation: 79 FR 26931 

Questions: 

• Would these changes maintain the privacy protections for patients? 

• Would these changes address the concerns of HIEs, health homes, ACOs, and CCOs? 

• Would these changes raise any new concerns? 

Page 2 of 6 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Public Comment Field: The Kentucky Health Information Exchange (KHIE) developed consent and accompanying training materials 

for healthcare providers that provided substance abuse services. These providers needed an authorization form that complied with 

42 CFR Part 2.31. To comply with the regulation’s “To Whom” requirement that a patient know, at the moment the consent is 

signed, everyone who will receive the information, KHIE participants are currently presenting their behavioral health patients with a 

list of Kentucky healthcare providers that now totals 800 separate names. The list is sort to present the providers in the patient’s 

region first, but in reality the list has little relevance to the patient except as a tool for the patient to search for any providers they 

may be currently using or to search for any providers they may want to exclude. 

The adaption of §2.31 to allow language that describes the health care entity that will receive the patient’s information to be 

described as “any current and future health care provider or organization that is treating me or is involved in the coordination of my 

health care to access any and all of my health information through the Health Information Exchange,” would assist the flow of the 

patient’s information to their care providers. This description would also appear to be much more meaningful to the patient and to 

the healthcare provider that would be using a HIE. 

The HIE will be still be able to provide their participant healthcare providers with a listing of the other healthcare providers or 

organizations that may access the patient’s information. The providers will make this information available to their patients in a 

reasonable manner, either by a HIE updated website or by alerts to the patient. The burden of this provision would be greatly 

lessened if the patient could be directed to the HIE website for a current and accurate of listing of all providers and organizations 

that are members of the HIE. However, this proposed language will recognize the reality of the treatment of the patient. Healthcare 

providers do not seek and are not authorized to seek, according to the existing HIPAA regulations, and their contracting with the 

HIEs that they are members of, access to a patient’s information unless they have a treatment relationship with the patient. The 

patient, by choosing their treating healthcare providers, always controls who accesses their medical information in the HIE. The 

patient will know the healthcare provider and will have chosen that provider to treat them before the provider would ever query the 

records of KHIE for the patient. The list of providers will only alert the patient to the providers that can possibly access their records 

in this manner, after the patient has chosen the provider for their treatment. 

Additionally health information exchange technology is currently unable to modify operations to adjust to the requirement that all 

providers must be known at the moment the patient signs the authorization for disclosure for their information. KHIE has been able 

to move ahead with the development of a consent form and behavioral health providers agreed to change their consent term 

periods to six months as opposed to the one year term they used before the HIE requirements. KHIE is able to use a 6 month term 

because it requires six months for KHIE to onboard new providers. This insures that a substance abuse or alcohol abuse patient that 

releases their records reviewed the complete list of KHIE providers each six months. However, this is a solution that is only 

applicable for KHIE. Without a lag time in the onboarding process, KHIE would not be able to accommodate the current “To Whom” 

requirement of the regulation. If the language is changes as proposed above KHIE will not need to depend upon the delay in the 

onboarding process. Upon review with our stakeholders we will also propose that the consent form term be expanded to one year. 

The listed adaptions include a requirement that the consent form explicitly describe the substance abuse treatment information that 

may be disclosed. KHIE conducted focus groups concerning the consent form the health information exchange adopted. The 

patients and advocates interviewed did not express any concerns with their records being described as alcohol and substance abuse 

and mental or behavioral health information. If a requirement such as an explicitly describing substance abuse treatment 

information should state each item that is required to be described for the consent. 

Redisclosure 

SAMHSA is considering revising the redisclosure provision to clarify that the prohibition on redisclosure only applies to 

information that would identify an individual as a substance abuser, and allows other health-related information shared 

by the Part 2 program to be redisclosed, if legally permissible. This would allow HIT systems to more easily identify 

information that is subject to the prohibition on redisclosure enabling them to utilize other technological approaches to 

manage redisclosure. If data are associated with information about where the data were collected (data provenance) 

which reveals that the data were collected by a practice that exclusively treats addiction, the data would still be 

protected under the proposed change. 

Page 3 of 6 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

FR Citation: 79 FR 26931 

Questions: 

• Would this type of change facilitate technical solutions for complying with 42 CFR Part 2 in an EHR or HIE 

environment? 

• Would these changes maintain the privacy protections for patients? 

Public Comment Field: 

The proposed change will have no effect on KHIE. Current HIE technology cannot perform true data segmentation. Only one of the 

EMR systems connected to KHIE is known to have the capacity to support data segmentation. 

KHIE’s primary concern was complying with the requirements of the redisclosure language and delivering the substance abuse 

records to the patient’s health care provider. The only way the Kentucky Health Information Exchange is able to comply with the 

redisclosure requirement is to apply the redisclosure language to all information according to data provenance. This recognizes the 

data according to the National Provider Number assigned to the data and attaches the redisclosure language to the data so the 

language is viewed when the patient’s medical record is displayed. The proposed changes will not affect the manner that KHIE 

exchanges data because the vendors in the field do not have the capacity to send the data nor will the HIE be able to accept part of 

the data with substance abuse information and data without substance abuse data from the same provider location. The National 

Provider Number indicates the origin of the data location. There is not one number for substance abuse and one number for the 

same location with no substance abuse. 

The regulatory change that would provide the greatest relief from the redisclosure language would be if the language was not 

required to be delivered at the same time the record was delivered. This regulation change could require the HIE, as the deliverer 

of the records, to require all participants of the HIE system comply with 42 CFR Part 2.31 as part of their contracting. This would be 

a requirement of HIE contracting and policy just as HIEs require their participants to comply with HIPAA. The participants in the HIE 

would then not be able to disclosure the substance and alcohol abuse records of the patients, but the HIE would not have the 

technology barrier of displaying the language on the patient record. 

Medical Emergency 

SAMHSA is considering adapting the medical emergency exception to make it more in-line with the statutory language 

and to give providers more discretion as to when a bona fide emergency exists. For example, amending this standard to 

allow providers to use the medical emergency provision to prevent emergencies or to share information with a 

detoxification center when a patient is unable to provide informed consent due to their level of intoxication. 

FR Citation: 79 FR 26931 

Questions: 

• What factors should providers take into consideration in determining whether a medical emergency exists? 

• Are there specific use cases SAMHSA should take into consideration?Show citation box 

• Are there patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

Qualified Service Organization (QSO) 

SAMHSA is analyzing the regulations to identify options for allowing Part 2 data to flow to health care entities for the 

purpose of care coordination and population management while maintaining patient protections. One potential solution 

Page 4 of 6 
 

 

 

 

 

 

 

 

 

 

 

 

 

Qualified Service Organization (QSO) 

includes expanding the definition of a qualified service organization (QSO; § 2.11) to explicitly include care coordination 

services and to allow a QSO Agreement (QSOA) to be executed between an entity that stores Part 2 information, such as 

a payer or an ACO that is not itself a Part 2 program, and a service provider. 

FR Citation: 79 FR 26931 

Questions: 

• Are there other use cases we should be taking into consideration? 

• Are there specific patient concerns about the impact of this change on their privacy? 

Public Comment Field: 

Research 

SAMHSA is considering expanding the authority for releasing data to qualified researchers/research organizations to 

health care entities that receive and store Part 2 data, including third-party payers, health management organizations, 

HIEs, and care coordination organizations. 

FR Citation: 79 FR 26932 

Questions: 

• Are there factors that should be considered related to how current health care entities are organized, how they 

function or how legal duties and responsibilities attach to entities that make up an umbrella organization? 

• Would this change address concerns related to research? 

• Are there specific privacy concerns associated with expanding the authority or releasing data to qualified 

researchers/research organizations in this way? 

• Are there additional use cases that should be considered in the research context? 

Public Comment Field: 

Addressing Potential Issues With Electronic Prescribing and Prescription Drug Monitoring Programs (PDMPs) 

Part 2 protections include a prohibition on the redisclosure of information received directly from a Part 2 program. A 

pharmacy that receives electronic prescription information directly from a Part 2 program must obtain patient consent 

to send that information to a PDMP, and patient consent is also required for the PDMP to redisclose that information to 

those with access to the PDMP. 

Preamble FR Citation: 79 FR 26932 

Questions: 

• How do pharmacy information system vendors anticipate addressing this issue? Are there specific technology 

barriers SAMHSA should take into consideration? 

• Are there other concerns regarding 42 CFR Part 2 and PDMPs? Please describe relevant use cases and provide 

recommendations on how to address the concerns. 

• Are there patient concerns about the impact of e-prescribing and PDMPs on their privacy? 

Public Comment Field: 

Page 5 of 6 
 

Other Comments 

Topic: 

Public Comment Field: 

Page 6 of 6 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

June 25, 2014 

Ms. Pamela Hyde 

Administrator 

Substance Abuse and Mental Health Services Administration (SAMHSA) 

U.S. Department of Health and Human Services 

1 Choke Cherry Road 

Rockville, MD 20857 

RE: Response to 42 CRF Part 2 Listening Session 

Dear Administrator Hyde: 

Thank you for inviting Health IT Now to participate in the Public Listening Session on the 

Confidentiality of Alcohol and Drug Abuse Patient on June 11, 2014. The following are our responses to 

the 42 CFR Part 2 Discussions Topics posted in the Federal Register on May 12, 2014 (4162-20-P). 

Health IT Now is a broad based coalition of patient groups, provider organizations, employers and payers 

that supports incentives to deploy heath information technology to improve quality, outcomes, and patient 

safety and to lower costs. The coalition works to promote interoperability standards to lower costs and 

improve health by establishing workable interoperability standards across providers and within facilities. 

According to uncontested testimony provided at the June 11, 2104 Listening Session, virtually every 

Health Information Exchange (HIE) in the United States – with the exception of Current Care in Rhode 

Island – refuse to accept substance abuse and associated menthal health Electronic Health Records due to 

stringent Part 2 consent requirements. As currently interpreted by SAMHSA and the HHS Office of Civil 

Rights (OCR), a patient with addiction disorders must execute a new consent every time a new health care 

provider joins a statewide, regional, or metropolitan HIE; resulting in multiple new consent forms daily, 

weekly, or monthly. The administrative burden and risk associated with this requirement are so great that 

HIEs have broadly opted out. 

The Accountable Care Workgroup of the Office of the National Coordinator for Health Information 

Technology (ONC) noted the Medicare Accountable Care Organizations (ACOs) have the same inability 

to share addiction and mental health EHRs because of HHS privacy interpretations. The CMS Center for 

Medicare and Medicaid Innovation (CMMI) acknowledges that sharing Medicare claims data with 

Pioneer ACOs nationwide require it redact all addiction medical records due to Part 2 consent 

requirements. 

When the Drug Abuse Prevention, Treatment and Rehabilitation was enacted in 1972, the goal of 

stringent consent standards regarding substance abuse medical records was to encourage persons with 

major addiction disorders to seek outpatient and inpatient treatment. In the era of technology-enabled 

care, the unintended consequence of Part 2 is inhibiting coordinated care in treating the whole person – 

mentally and physically - with substance use disorders across the behavioral health system, primary care, 

and specialty medicine. 

Health IT Now | 1101 14 St NW, Suite 700 | Washington, DC 20005 | 866.388.2008 | healthitnow.org | @healthitnow 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Three key subjects highlighted in the SAMHSA Discussion Topics Document: 

Consent Requirements: Health IT Now strongly urges a new 42 CFR Part 2 regulation to allow consent 

forms to include more general descriptions of the individual, organization or health care entity to which 

disclosure is to be made. This important change would ease the multiple consent requirements discussed 

earlier thereby facilitating the interchange of substance abuse treatment information across HIEs, 

Medicare ACOs, Medicaid Health Homes, and state-based Coordinated Care Organizations (CCOs). In 

conjunction with this proposal, it is important to note that substance use EHRs would be covered under 

existing HIPAA privacy standards, which protect the confidentiality of sensitive medical information 

associated with stigmatized medical conditions including HIV/AIDS and Sexually Transmitted Disease 

(STDs). 

Re-disclosure: Promulgate a new Part 2 rule revising the re-disclosure provision to clarify that the 

prohibition on re-disclosure only applies to information that would identify an individual as a substance 

abuser, and allows other health-related information shared by the Part 2 program to be re-disclosed. This 

rule is required because almost 30% of people with an active substance abuse disorder have often life 

threatening comorbid chronic medical and surgical diseases including emphysema, COPD, cirrhosis, and 

heart disease. Coordinated clinical management of these conditions with addiction treatment results in 

improved medical and surgical outcomes and better overall behavioral health. Further, we see no conflict 

between this proposed re-disclosure rule and the DS4P data segmentation projects currently being 

pursued under the auspices of SAMHSA. 

Qualified Service Organization: Issue a Part 2 regulation that expands the definition of qualified service 

organization (QSO) to explicitly include care coordination services and to allow a QSO Agreement 

(QSOA) to be executed between an entity that stores Part 2 information, such as a payer or an ACO that is 

not itself a Part 2 program, and a service provider. In fact, the Coalition would go further by simply 

proposing that care coordination and population health management be made exempt from Part 2 

requirements analogous to similar exemptions in current HIPAA law. 

Over the past decade, on a bipartisan basis, Congress has authorized an array of Medicare and Medicaid 

initiatives with the goal of improving care coordination for persons with multiple chronic medical 

conditions. While Medicare Special Need Plans (SNPs), ACOs, and Medicaid Health Homes serve 

different patient populations, they are all designed to achieve two interrelated goals: reduce costs and 

enhance health care outcomes via improved care coordination. In turn, the foundation of all these efforts 

is the interoperability of medical records and the rapid, vigorous exchange of clinical information in the 

context of secure digital systems. 

We urge that information be available across the care continuum that allows physical and mental care 

providers to treat the whole patient. Segmenting data was originally designed to protect patient 

confidentially, now it inhibits care by cloaking essential care and medication information from providers 

and potentially harming the patient. If you ask patients, they will say combine the information and make 

it available for care. If used illegally, enforce the rules rather than restrict access. 

Thank you for the opportunity to comment on this important issue of treating the whole person. 

Regards, 

 

Joel C. White
 

Executive Director

Health IT Now | 1101 14 St NW, Suite 700 | Washington, DC 20005 | 866.388.2008 | healthitnow.org | @healthitnow 
 

Please do not let people/ Dr.'so office's have access to our medical records. It's hard enough to 

explain to the medical field of your situation and the MMT. 

Please, keep this information privately held at the clinic's & don't let anyone else have this info
 

without our knowledge. 
RICK SCOTT 

GOVERNOR 

ELIZABETH DUDEK 

SECRETARY 

June 24, 2014 

The Substance Abuse and Mental Health 

Services Administration 

Room 5-1011 

I Choke Cherry Road 

Rockville, MD 20857 

Dear Sir/Madam: 

Thank you for the opponunity to comment on proposed changes to the Confidentiality of Alcohol and 

Drug Abuse Records Regulation, 42 CFR Part 2. Many substance use disorder treatment providers do not 

participate in organized systems for electronic health information exchange (HIE) such as the Florida HIE 

due to the requirements of 42 CFR Part 2. The confidentiality regulations in 42 CFR were written prior to 

the Health Insurance Portability and Accountability Act (HIP AA) Privacy rule which establishes national 

standards to protect individual's medical records and other personal health information. 

To the extent possible, we request that 42 CFR Part 2 align with HIP AA. Please consider removing the 

prohibition ofre-disclosure requirements of 42 CFR Part 2 entirely for information disclosure to HIPAA 

covered entities. The Quality Service Organization agreement should mirror the Business Associate 

Agreement and related provisions of HIP AA. HIP AA does not require consent for "treatment, payment, 

and operations." Man) states, including Florida (s. 397.501 (7), F.S., have passed legislation requiring 

explicit consent for various conditions such as mental health, substance abuse, sexually transmitted 

disease, genetic tests, and other conditions. There have been efforts to develop uniform patient 

authorization forms that enable patients to use a general consent that encompasses the release of listed 

types of sensitive conditions. The regulations should be changed to permit use of a general consent as 

applicable to treatment purposes, payment and operations as defined in HIPAA. 

The provisions regarding medical emergencies should be revised to encourage good faith exchange of 

health information when the patient or their family is unable or unavailable to give consent in a medical 

emergency where the lack of medical intervention might be detrimental to the patient. The 

documentation requirements placed on substance use disorder treatment providers should be limited to 

notifying patients that their records will be released in a medical emergency. 

Barriers to participating in health record exchange may isolate substance abuse patients the coordination 

opportunities of HIE including the access to their health information in a medical emergency, or sharing 

of medical encounters to improve coordination of care. Please consider these two suggestions that help 

minimize these barriers. Thank you for considering our comments. 

Hayden J. Mathieson Molly McKinstry Director, Substance Abuse and Mental Health State HIE Coordinator and Deputy Secretary Florida Department of Children and Families Division of Health Quality Assurance 

Agency for Health Care Administration 

2727 Mahan Drive• Mail Stop #i6 Face book.com/ AH CA FI orid a 

Tallahassee, FL 32308 Youtu be.com/AHCAFlorida 

Twitter. com I AH CA_F L 

Slide5hare net/AHCAFlor,da 

AHCA MyFlorida com 
June 25, 2014 

SAMHSA 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

Re: Confidentiality of Alcohol and Drug Abuse Patient Records Regulations, 42 CFR Part 2 

To Whom It May Concern: 

Johns Hopkins Medicine (Johns Hopkins) is writing in follow up to the Substance Abuse and Mental 

Health Services Administration (SAMHSA) public listening session held on June 11, 2014, at which 

information and opinions regarding the Confidentiality of Alcohol and Drug Abuse Patient Records 

Regulations (42 CFR Part 2 – the “Confidentiality Regulations”) was solicited. We appreciate this 

opportunity to provide comments on these regulations. Our comments are offered from both the 

clinical and the managed care perspective. We believe the current system no longer reflects the 

contemporary state of care or management of patients, and would prefer issues of confidentiality be 

part of the broader general medical care confidentiality regulations. In that light, we would advocate 

the retiring of these regulations and legislation, but realize that this may require a longer-term 

legislative solution. In the meantime, we will propose shorter-term compromises here (with the longerterm desire to see these special regulations folded in to the broader medical care confidentiality 

regulations). The comments presented in this letter reflect the need for comprehensive reform to the 

confidentiality of substance abuse treatment data but also suggest solutions that can be implemented 

within the confines of the existing laws. 

Clinical Perspective on How Current Substance Abuse Laws and Regulations Impact Patient Care 

Johns Hopkins has a sustained and substantial commitment to providing care to persons who suffer 

from substance use disorders (SUDs), as well as studying the nature, prevention and treatment of these 

conditions. In addition, we conduct extensive educational programs related to addictive disorders, and 

these programs target a wide variety of professionals across the spectrum of their career. Our clinical 

and clinical research operations are associated with three of the Johns Hopkins hospitals, and include 

work on both an outpatient and inpatient basis. As we have started to institute a common electronic 

medical record (EMR) throughout our health system, as well as launched a Medicare Shared Saving 

Program accountable care organization (ACO) and a preliminary ACO-type operation (the Johns 

1 
 

Hopkins Community Health Partnership [J-CHiP] program, supported by a major CMMI grant), we 

have needed to address the Confidentiality Regulations from the patient and provider perspectives, and 

have grappled with the current issues of compromising between the requirements of the regulations 

and the needs to provide optimal, effective, and coordinated patient care. Our recommendations are 

based upon extensive discussions and considerations, and our guiding principle has been to do what we 

believe is in the best interests of patient care. We believe that substance abuse disorders are medical 

conditions, that they are treatable, that the medical field has made great strides in identifying effective 

treatments for these disorders, and patients with these conditions should be (and can be) assisted by 

caring providers. We also believe that optimal patient care occurs in a comprehensive manner, and that 

systems and regulations that dissect and localize a particular treatment or illness are ultimately flawed 

systems that fail to appreciate and care for the whole person. 

In this context, we are writing to advocate that a complete overhaul of the Confidentiality Regulations 

is necessary to bring them in-line with modern health care delivery models designed to treat patients in 

a holistic and effectively coordinated manner. We elaborate on these points in this letter, and provide 

further comments about how we have come to this position. 

Substance abuse treatment is being mainstreamed into general medical care 

The current Confidentiality Regulations tend to focus upon the “program” as the level of service 

delivery unit. However, there has been a steady effort (and success) in having substance abuse 

treatment integrated into general medical care. This creates delivery models that are not solely devoted 

to substance abuse treatment, but which are an important part of the continuum of care for patients 

with SUDs. The development and approval of a variety of pharmacotherapies for SUDs (e.g., 

acamprosate, buprenorphine, naltrexone) has resulted in treatment occurring in primary care provider 

offices, as well as other general clinical settings. If revised regulations expand the definition of a 

program to include these providers, the overall health care system runs the risk of simply driving these 

professionals away from providing substance abuse treatment. Regulations should encourage and 

facilitate the continued inclusion and expansion of all health care providers into the identification and 

treatment of SUDs. We strongly advocate the continued mainstreaming and expansion of substance 

abuse treatment, as exemplified by initiatives such as office based opioid treatment (OBOT), and 

screening, brief intervention, and referral to treatment (SBIRT). Regulations that could lead to 

discouraging these efforts could significantly set back treatment expansion and care. Regulatory 

changes should reflect the principle that treatment should represent caring for the whole person, and 

seek to not segregate care and disorders. 

Electronic medical records (EMRs) 

The development of EMRs holds promise to assist in the coordination of health care. At its core, 

coordination of care means that information is readily available to providers with minimal efforts to 

access that information. Coordination of care also is critical in the treatment of the whole patient. 

In our work with EMRs, we have grappled with the current regulations and the handling of patient 

level information. We believe we can, for example, create a wall between the records of a substance 

abuse treatment program and other providers (as required under the current Confidentiality 

Regulations). The wall seems like it could even be unbreachable. However, there are aspects of the 

2 
 

 

 

 

 

wall that turn out to have holes in it. For example, a medication prescribed (such as buprenorphine) 

will appear on a medication list that crosses over that wall. A lab test (such as a urine drug screen) 

could also potentially cross the wall. At times, this information could be of value to providers – for 

example, having lab tests from a substance abuse treatment program (which could include urine testing 

as well as other routine tests, such as chemistries) available to other providers could be of great value 

to those other providers. Work arounds to these become exceeding complicated (one type of lab test 

stays behind the wall [the urine test], but another type does not [the chemistries]). In addition, not 

allowing access to information that stays behind the wall runs the risk of creating harmful scenarios for 

patients – for example, not allowing providers to see medication lists when a patient is in an 

emergency department. While the current regulations permit the sharing of substance abuse 

information for emergency treatment, the current restrictions often preclude providers from even 

knowing there is information that could be accessed and used. The current regulations create a 

multitude of difficulties when instituting an EMR, and so long as there are barriers between substance 

abuse records and other medical records, the care of the patient as a whole person will be 

compromised. 

Data 

In our experience in the J-CHiP program, which we view as the forerunner to our ACO, we have been 

unable to obtain substance abuse data. For example, obtaining Medicare data from CMS has been 

severely compromised by CMS’s decision that it cannot release data that may be related in some way 

to substance abuse diagnoses (even if a care episode is for a non-substance abuse condition, and the 

substance abuse diagnosis is not related to substance abuse treatment at a substance abuse treatment 

program). We asked whether Johns Hopkins could seek to obtain a release of information from some 

of the thousands of patients in the J-CHiP program. (Note that all patients in certain aspects of the 

program would need to sign the release, as we cannot identify them beforehand as having a SUD.) 

However, CMS did not support this option, and even if they had, it would have been very challenging 

to implement. CMS is making these decisions based upon the Confidentiality Regulations, and this line 

of reasoning by CMS has severely compromised our ability to project needs and plan treatments for all 

patients – not simply those with a SUD. As our health care system looks to the development of 

population health initiatives, there is a critical need to have access to data for planning those needs, and 

the current ruling from CMS (which is critically dependent upon the Confidentiality Regulations) is 

significantly compromising progress in this area. 

Stigma 

The current system of confidentiality regulations effectively serves to segregate patients who suffer 

from these disorders. While we appreciate that there are concerns with the stigmatization of people 

who have a substance use disorder, we believe the approach used over 20 years ago by the AIDS 

community (to advocate that HIV be viewed as another medical illness, and not to be viewed as a 

condition that needed to be addressed in its own separate medical system) has been highly effective in 

decreasing stigma and integrating HIV care into the medical system. Similar efforts by the mental 

health community have also been successful in markedly decreasing the stigma of mental illnesses. 

Substance abuse treatment should learn from these experiences, and embrace and advocate its 

inclusion as a medical disorder. Special confidentiality laws and regulations that inadvertently 

3 
 

 

 

 

segregate and marginalize the treatment of persons who suffer from substance use disorders should be 

abolished. 

Managed Care Organization Perspective 

In addition to the clinical experience and expertise that Johns Hopkins offers, we are also positioned to 

offer the perspective of how the current substance abuse regulations impact a Managed Care 

Organization’s (MCO) ability to adequately treat patients. Priority Partners is an MCO that operates 

solely in Maryland and is owned jointly by Johns Hopkins Health Care LLC and Maryland 

Community Health System (a non-profit organization comprised of eight Federally Qualified Health 

Centers). 

Currently in Maryland’s Medicaid program, somatic care and substance abuse services are delivered 

together and mental health is carved out. Specialty mental health services are delivered separately from 

the state’s HealthChoice managed care program and are administered by an administrative services 

organization (ASO), Value Options. All specialty mental health services are financed on a fee-forservice basis. The MCOs are responsible for somatic and substance abuse services. Maryland’s 

Department of Health and Mental Hygiene (DHMH) has made the decision that as of January 1, 2015 

substance abuse services will be carved out of the managed care program and will instead be 

“coordinated” with mental health services and administered by the ASO on a fee-for-service basis. A 

request for proposals for the ASO contract that includes substance abuse was released in February 

2014 and the state is expected to award the contract in late summer or early fall. 

While Johns Hopkins and Priority Partners have advocated against the carve-out on the basis that we 

believe segregated systems of care are not in the best interest of patients, we must now prepare for the 

carve out and determine how to bridge the divide between somatic care and substance abuse in light of 

the disintegration into two separate systems. As an MCO, our primary concern under the carve out is 

access to substance abuse data that enables us to better serve our members. As the payor of all the 

substance abuse and somatic services of our members we have access to a wealth of data that we 

currently use to coordinate and improve care for the substance abuse population that we serve. For 

example, if a Priority Partners member has repeatedly visited the emergency department or had 

inpatient hospitalizations related to substance abuse, and we know the patient is in a substance abuse 

treatment program, we can reach out to the program provider making them aware that the member may 

need additional supports to adhere to his or her treatment program. Additionally, DHMH requires that 

all substance abuse providers submit a treatment plan form to the MCOs in order have claims 

reimbursed. The treatment plan form also requires information about a member’s somatic issues. The 

information included on this form allows Priority Partners to identify and access patients who are in 

need of additional care coordination. 

Priority Partners has recently developed an innovative plan to engage substance abuse providers in the 

identification and referral of somatic needs of our members. The members with substance abuse issues 

are typically difficult to contact due to incorrect contact information or reluctance to engage in their 

somatic care. However, these members often have a trusted relationship with their substance abuse 

treatment provider and have daily or weekly appointments. We know that the substance abuse 

population typically has multiple chronic conditions, with about 80% of health care costs being 

4 
 

 

 

attributed to somatic care. The goal of our substance abuse work plan is to improve the overall health 

of our members while reducing the total health care costs. The plan includes education and training to 

substance abuse clinic workers so that they are positioned to identify somatic conditions and social 

issues that are negatively impacting a member’s health. The clinic workers are also trained to make 

referrals to Priority Partners case managers, so that Priority Partners can engage the member in care 

coordination. 

Once the carve out occurs in January 2015 Priority Partners and all Maryland MCOs will lose access to 

substance abuse data as well as our long standing relationship with substance abuse providers. We fear 

that without adequate access to substance abuse treatment data for our members, our ability to manage 

the somatic care of our members will deteriorate along with the health of our members. We have met 

with Maryland’s DHMH staff, requesting guidance on how DHMH will ensure that MCOs have 

continued access to substance abuse treatment data, however at this meeting, DHMH indicated that 

they have yet to develop a plan for the exchange of substance abuse data between the MCOs and the 

ASO under the carve out. In fact, DHMH stated in their response to a question regarding the sharing of 

substance abuse data from a potential bidder for the ASO contract, “Exact details of required data 

exchanges, and any necessary agreements, will be determined during implementation [of the ASO 

contract]”. 

We raise these state issues regarding the changes in the finance stream for Medicaid financing of 

substance abuse care, as the federal Confidentiality Regulations are confounding and complicating 

these changes. The federal restrictions around the sharing of substance abuse data allow limited 

circumstances and agreements for the sharing of data. Implementation of the contract will likely be too 

late to ensure that an appropriate data sharing plan is both legal and operational. 

Suggested Changes to Substance Abuse Regulations that Would Improve Care for Substance Abuse 

Patients 

As stated above, we believe that the Confidentiality Regulations should be completely overhauled or 

eliminated in their entirety to accommodate modern health care delivery models designed to 

effectively treat patients holistically, and we continue to advocate for changes to existing laws to 

eliminate the segregation of medical information based on diagnosis or where one receives care, so that 

our patients may receive the best care. We recognize, however, that such a position may be outside the 

scope of the recent request for comments from SAMHSA. Therefore, supplemental to the overarching 

concerns we have with respect to the restrictions contained in the current Confidentiality Regulations, 

below are more specific responses and comments tailored to the specific items for which the SAMHSA 

has requested comment. We would like to emphasize that adoption of the suggestions and 

recommendations outlined below would not resolve all of our concerns noted above, however, we 

believe they will at least alleviate some of the current barriers associated with sharing critical 

substance abuse information among health care professionals. 

Specifically, we believe the following changes to the current regulations would greatly benefit 

substance abuse patients, take some incremental steps to accommodate the new realities of health care, 

provide patients with more control and autonomy over their information, all the while still adequately 

providing critical privacy protections to such information: 

5 
 

 

 

•		 Permit health care entities that receive and store Part 2 data to utilize the current exceptions 

available to substance abuse providers 

•		 Amend the current consent requirement and redisclosure restriction to permit patients more 

control over their information and ability to consent to broader categories of disclosures 

•		 Expand the definition of Qualified Services Organization (QSO) to include care coordination 

services and to allow a QSO Agreement to be executed between an entity that stores Part 2 

information and a service provider. 

Applicability of 42 CFR Part 2/Research 

We strongly oppose the proposal to expand the applicability of 42 CFR Part 2 to any federally assisted 

health care provider that provides a patient with specialty substance abuse treatment services. We 

believe this type of expansion of an already overly burdensome set of regulations would not only be 

detrimental to the health and safety of patients receiving treatment of this type, but it would make 

administering the restrictions on such information virtually impossible. As the regulations stand, 

organizations can apply the current heightened restrictions based on where the patient receives care in 

a brick and mortar approach. Any proposed expansion would make it significantly more difficult to 

identify those records and information that must be kept separate from the patient’s other medical 

record information, to identify and train staff on understanding and applying different standards in an 

already complex environment, and to develop adequate software “fixes” in EMRs to recognize the 

need for different treatment. We do not believe such an expansion would provide any identifiable 

benefit to substance abuse patients, but we do believe it would place an additional unnecessary burden 

on substance abuse providers and further restrict the ability for providers to coordinate critical care. 

To the extent SAMHSA expands the applicability of 42 CFR Part 2, we believe it would be most 

beneficial for those health care entities that receive and store Part 2 data, including third-party payors, 

to become directly subject to Part 2 to afford them the opportunity to take advantage of some of the 

limited flexibility within the Confidentiality Regulations. These health care entities that receive and 

store Part 2 data are required to keep such information strictly confidential due to the current 

redisclosure restrictions. Therefore, any disclosure by these health care entities can be made only with 

consent from the patient. These health care entities may not have any direct relationship with the 

patient, so obtaining consent from each patient is administratively burdensome and operationally 

infeasible. These organizations, however, play a vital role in the implementation of care for substance 

abuse patients. Additionally, as discussed in more detail below, many of these organizations need to 

engage other entities to assist them in providing services, so they need to be able to enter into QSO 

arrangements with consultants, third-party administrators, and other industry experts. 

Many of these health care entities that receive and store Part 2 data engage in important and critical 

research activities. These entities are in a unique position for research advancements given that they 

have received Part 2 data from multiple different providers. Permitting these health care entities the 

ability to engage in research activities in the same manner the current regulations permit substance 

abuse providers, would provide a greater opportunity for improvement in the treatment of substance 

abuse patients without exposing patients to additional significant privacy risks. 

Additionally, auditing and evaluating federal and state payors are critical to combating fraud and abuse 

in Medicare and Medicaid. Rather than auditing the substance abuse providers directly, government 

6 
 

 

agencies often request claims data from payors to determine whether payment for substance abuse care 

was appropriate or to identify substance abuse providers who might be fraudulently billing for 

substance abuse services. Without enabling the third-party payor to provide substance abuse claims 

data to governmental authorities tasked with auditing federal and state payors, millions of dollars may 

be fraudulently spent by these programs, ultimately costing the government substantial dollars. 

The current Confidentiality Regulations already proscribe a detailed and limited opportunity for 

research, auditing and evaluation to take place, and those protections could easily be made applicable 

to these other health care entities that receive and store Part 2 data without imposing any additional 

privacy risks on patients. 

Consent and Redisclosure Requirements 

The current consent requirements and prohibition on redisclosure are particularly problematic. It is our 

understanding that the original statutory authority for the substance abuse regulations did not include 

this type of redisclosure restriction, so this is one of the areas where SAMHSA has the greatest 

flexibility to eliminate some of the barriers that currently restrict effective communication among 

providers and that create patient care and safety concerns. 

While the origin of the redisclosure prohibition stems from the desire for patients to have control over 

their information, the result of such prohibition under the current regulations has had somewhat of an 

opposite effect. Patients who seek substance abuse treatment are not able to consent to the wide-range 

of disclosures they may desire because the consent requirements are required to be precise, indicating a 

specific provider/organization and a specific recipient/organization, rather than broader categories. 

Below are three examples of situations in which substance abuse patients may wish to participate, but 

in order for the flow of information to work effectively in each of these situations, there would have to 

be multiple authorizations obtained at each step of the way, unnecessarily and administratively 

hindering the success of these programs that are designed to assist this particularly high-risk 

population. 

	 Many third-party payors provide care management services, and may need to have access to 

substance abuse information in order to effectively and holistically treat substance abuse 

patients. Additionally, many patients wish to receive these types of services and benefit greatly 

from the resources care managers offer. However, the care managers are entitled to the 

substance abuse information only if a patient signs a specific authorization permitting such 

access. Moreover, even if the patient signs an authorization permitting the care management 

organization the right to have their substance abuse information, the care manager is unable to 

engage other care providers or specialists, community experts and services for the individual 

without obtaining a new, distinct authorization for each of the disclosures the care manager 

would make. The administrative burden associated with such activities cannot be overstated 

and is often contrary to the patient’s wishes. 

	 A patient may have an interest in participating in an HIE/HIO for purposes of permitting other 

providers to have access to his or her medical information for treatment purposes. While the 

substance abuse provider can explain the process to the patient and have the patient sign a 

7 
 

consent form having been informed of the implications, under the current regulations, such 

consent does not afford the patient full participation in the HIE/HIO, even if that is the patient’s 

wishes. In order for any of the other treating providers of such patient to have access to any of 

the patient’s information from the HIE/HIO, the HIE/HIO will have to obtain written consent 

from the patient prior to releasing any of the information to other providers. This secondary 

consent requirement defeats the purpose of an HIE/HIO, which is designed to easily and 

somewhat spontaneously share information with other providers in order to provide the best 

care to patients and ensure medications prescribed are consistent with other medications and 

treatment plans. Even if a patient WANTS to have this type of comprehensive treatment, he is 

not currently able to consent to such. HIEs/HIOs typically function automatically and in realtime, which mean that they cannot effectively accommodate requests for consent forms or 

obtain consent forms. Additionally, other providers may not even be aware that their patients 

have substance abuse information for which a consent would be needed, since any inquiry to 

the HIE/HIO regarding a patient would not result in any information about the substance abuse 

treatment, since no authorization would have been obtained in advance for that provider. All of 

this, again, may be counter to the patient’s wishes. Most HIEs/HIOs currently operate under an 

opt-out model, which means patients participate in the HIE/HIO unless they indicate otherwise. 

Requiring an opt-in model for substance abuse information would provide the extra layer of 

protection appropriate for substance abuse information. 

	 A patient seeking substance abuse treatment may participate in an ACO and may be willing to 

consent to the release of his or her substance abuse information to such organization in order to 

take full advantage of all of the services provided by the ACO. However, under the current 

Confidentiality Regulations, the ACO would, first, need to be made aware that the patient even 

has substance abuse information to which it may want access. Since an ACO is entitled to a 

patient’s other records (through claims data from CMS) after providing the patient with an 

opportunity to opt-out of participating in such data sharing, the patient himself or herself, may 

not know that he or she needs to provide something additional for the ACO to receive his or her 

substance abuse information. Secondly, assuming the ACO is able to overcome such barrier 

and obtain the patient’s substance abuse information through a signed consent of the patient, 

the ACO may then need to be able to share such information with multiple different people and 

organizations to effectively provide the types of services for which ACOs were established. 

This sharing may include with the patient’s primary care provider, specialists the ACO 

identifies, and the organization responsible for providing care management services. Once 

those individuals and organizations have the relevant information, they will have an interest in 

combining that information along with the patient’s somatic care issues to provide services to 

the patient holistically. It is very possible that the patient wants this type of comprehensive, 

holistic treatment, and wants to consent to this type of treatment, but unless the patient provides 

written consent for each of the individual disclosures along the way, and unless the recipients 

of this information invest in expensive electronic systems that enable them to wall off the 

substance abuse information from the somatic care information, they cannot effectively provide 

accountable care to the patient, regardless of the patient’s wishes. In the context of ACOs, in 

particular, we believe the opt-out model that currently exists at the federal level to protect the 

privacy of patients and provide them with an opportunity to control the disclosure of their 

health information is sufficient for both general medical information and substance abuse 

8 
 

 

information. Substance abuse information should not be treated differently than other medical 

information. 

We believe there is a reasonable balance that can be struck between ensuring substance abuse 

information is not redisclosed inappropriately, and empowering substance abuse patients to have a 

greater say in how their information is shared without requiring them to participate in the 

administratively burdensome process of signing multiple authorizations. One suggestion would be to 

eliminate the redisclosure restriction altogether and permit the patient the autonomy to consent to the 

release of their information to whomever the recipient believes is appropriate. It is our experience that 

many of our patients have full trust in their substance abuse providers and would want such providers 

to have the independence to identify those other parties to whom disclosure of substance abuse 

information would be most beneficial to the care of patient. 

Alternatively, we suggest amending the current regulations to permit the patient to consent to broader 

categories of disclosures, such as treatment, payment, care coordination, and quality improvement. 

This approach would enable those health care entities and providers that are closest to providing these 

types of services to determine which parties need to be involved in those activities and would be able 

to redisclose the information as necessary to achieve the patient’s desired purpose, while still limiting 

the purposes for which substance abuse information may be redisclosed. The recipients of the 

information in such situations would almost always be covered entities or business associates under 

HIPAA and would therefore already be legally bound to protect the confidentiality of such 

information. Moreover, the definition for such purposes could be cross-walked to HIPAA to ensure 

consistency and understanding among these types of organizations of what is permitted and what is 

not. Permitting patients to consent to disclosure of their information for treatment would also include 

permitting the patient the right to consent to include their information in an electronic health record, 

understanding that such record could and would be shared with other providers to provide integrated 

care to the patient. 

An alternative approach would be to amend the redisclosure restriction to enumerate specific purposes 

for which redisclosure would be permitted under the regulations. Under HIPAA, once a patient has 

consented to the disclosure of their information, redisclosure is permitted for any purpose. While some 

may argue that such an approach is too broad for substance abuse information, we believe redisclosure 

should be permitted for certain purposes as necessary for the initial recipient of the information to 

carry-out the full wishes of the patient. For example, the regulations could be amended to specify that 

redisclosure of substance abuse information is not permitted except for purposes of (i) treatment, (ii) 

care coordination, (iii) payment, or (iv) quality improvement activities. This would strike a balance 

between HIPAA and the current substance abuse regulations, which would still permit patients to 

control the disclosure of their information, yet would allow for a greater sharing of information once 

the patient has consented. 

Qualified Service Organization 

We fully support SAMHSA’s proposal to allow a QSO Agreement to be executed between an entity 

that stores Part 2 information, such as payor or an ACO that is not itself a Part 2 program, and a service 

provider. As discussed above, many health care entities that receive Part 2 information play an integral 

role in the coordination, treatment and care of substance abuse patients. Additionally, operationally, 

9 
 

these organizations need the assistance of other third parties much like providers, such as attorneys, 

consultants, billing collectors, etc. It is imperative that these types of organizations be included in the 

category of organizations that can enter into QSO Agreements to utilize other experts in carrying out 

these activities. One benefit of such expansion would be to permit critical claims data related to 

substance abuse to be shared with ACOs and other population health programs, so that they can 

effectively identify high-risk patients and provide the necessary intensive outreach and care 

coordination for these patients. Requiring consent for these types of activities is currently 

administratively impractical. 

We also strongly support the proposed expansion of the types of services a QSO can provide to clarify 

that such organizations can be used to provide any type of services on behalf of the substance abuse 

provider or recipient of Part 2 data, such as for care coordination and care management services and 

treatment services. We believe the protections currently built into the regulations around entering into 

QSO agreements adequately protect a patient’s privacy rights, and an expansion in its applicability 

would enable these types of organizations to more appropriately engage the experts they need to 

effectively treat this patient population. 

Conclusion 

As outlined above, Johns Hopkins believes that comprehensive reform of substance abuse 

confidentiality laws and regulations is necessary to reflect the emerging health care delivery models 

that embrace patient centered care. We believe any reform efforts should focus on the guiding 

principles that all medical records be held to the same standards of confidentiality, that systems and 

regulations should optimize the coordination of all care on behalf of the patient and that substance 

abuse treatment should be mainstreamed into all levels of the healthcare system and general medical 

care should be mainstreamed into the substance abuse treatment systems. 

To address some of the concerns privacy advocates may have with amending the regulations as 

indicated above, we would support additional protections in the regulations that more appropriately 

focus the restrictions on the types of concerns commonly articulated. For example, we would support 

new regulations that make it a violation to discriminate against patients for health coverage or the 

provision of health care services based on the patient’s receipt of substance abuse treatment. 

Additionally, the regulations could be augmented to bar employers from making employment 

decisions based on substance abuse treatment information. 

We acknowledge that finding the right balance between ensuring a patient’s privacy and livelihood is 

protected and effectively treating a particularly vulnerable population is a challenge. We believe, 

however, that the current restrictions in the Confidentiality Regulations are misaimed. Avoiding 

stigma and discrimination against people who have received substance abuse treatment is critical to 

ensure that those who need services feel comfortable seeking those services. The health care delivery 

system has changed, however, and many of the advancements made in the delivery of health care 

cannot be taken advantage of by substance abuse patients due to the overly restrictive and burdensome 

consent requirement. As stated above, we believe that in the long term, changes to existing law need 

to be made to address all of the concerns identified in this letter, however, the above recommendations 

would alleviate some of the concerns currently articulated by industry experts in the short term, while 

still adequately protecting the essential privacy rights of patients. 

10 
Thank you, 

Patricia M.C. Brown, Esq. 

SVP, Managed Care and Population Health, Johns Hopkins Medicine 

President, Johns Hopkins HealthCare LLC 

Senior Counsel, Johns Hopkins Health System 

Eric C. Strain, M.D. 

Professor 

Director, Johns Hopkins Center for Substance Abuse Treatment and Research 

Medical Director, Behavioral Pharmacology Research Unit 

Johns Hopkins University School of Medicine 

11 
Group Health Cooperative
 

Group Health Headquarters 

Public Policy & Government Relations 

320 Westlake Avenue N. 

Suite 100 

Seattle, WA 98109 

June 25, 2014 

www.ghc.org 

Department of Health and Human Services 

Substance Abuse and Mental Health Services Administration 

1 Choke Cherry Road 

Room 5-1011 

Rockville, MD 20857 

Submitted electronically to PrivacyRegulations@SAMHSA.hhs.gov 

RE: Confidentiality of Alcohol and Drug Abuse Patient Records; 42 CFR Part 2 [Docket 2014-

10913] 

Dear Sir or Madam: 

Group Health Cooperative (Group Health) appreciates the opportunity to provide comments in 

response to the Substance Abuse and Mental Health Services Administration (SAMHSA) notice 

on confidentiality of alcohol and drug abuse patient records under 42 CFR Part 2 (Part 2), as 

published in the Federal Register on May 12, 2014. 

Group Health is a not-for-profit, tax-exempt integrated health system providing coverage and 

care to more than 650,000 people across Washington State and Northern Idaho. Our mission is 

to design, finance, and deliver affordable, high-quality care. Approximately two-thirds of our 

members receive care in one of twenty-five medical centers owned and operated by Group 

Health. Additionally, our exclusive multi-specialty physician group practice boasts over 1,000 

physicians. We also contract with over 11,000 physicians and 51 hospitals. We were a leader in 

implementing primary care medical homes throughout our system and are about to embark on 

implementation of an innovative program of integrated behavioral health that will include alcohol 

screening, brief intervention and shared decision-making for primary care patients, as described 

in a recent JAMA editorial. 

Group Health has been a leader and innovator in the use of health information technology to 

improve and enhance quality and access to care. We began converting to basic electronic 

medical records in 2000, and today have a full suite of tools to help ensure that our patients get 

1 
the right care at the right time. More than half of our patients are online with us, and a past 

study of our electronic records technology showed that patients who use secure e-mail are 10 

percent less likely to need an office visit and make 14 percent fewer phone calls to Group 

Health. 

We commend the SAMSHA for taking an opportunity to think through the application of current 

regulations as they pertain to new integrated care arrangements and the quickly developing 

technology in the health care industry, along with soliciting solutions to encourage better 

coordinated care for patients. However, based on our extensive experience with integrated care 

and health information technology we have concerns with the proposed approach that SAMHSA 

outlines in the Notice. In general, we have concerns that the continued segregation of health 

data into Part 2 and non-Part 2 has an impact on the quality of patient care at the individual and 

population level, thereby restricting health systems from truly integrating care and treating the 

whole patient. 

Applicability of 42 CFR Part 2 

We are very concerned that SAMHSA’s proposal to define what information is covered by 42 

CFR Part 2 based on the substance abuse treatment services provided instead of by facility 

type would vastly expand the scope of the existing regulations. Without revising the Part 2 

Regulations to permit access for all treatment purposes, this significant change could prevent 

providers from accessing information essential for effective, coordinated patient care. Group 

Health believes that full integration of substance abuse treatment, medical and mental health 

care is critical to patient safety and quality care. We also believe that defining information 

protected by the Part 2 Regulations based on type of service will perpetuate the artificial division 

that currently exists between substance abuse and mental and physical health to the detriment 

of patient care and safety. As a result of these concerns, Group Health recommends that 

SAMHSA retain the current definition of covered Part 2 information based on facility type. 

We believe that high quality patient-centered care for patients with substance abuse disorders 

requires that we incorporate our patients substance use disorder treatment in separate 

treatment facilities protected by 42 CFR Part 2, along with other medical care protected by 

HIPAA, which causes segregation of data that impacts treating the whole patient. Our system is 

committed to engaging patients with substance use disorders in shared decision-making about 

evidence based treatment options, just as we do for other medical conditions. Shared decisionmaking is a patient-centered process that often takes repeated visits with different members of a 

patients’ medical team. It is necessary that this important medical care be documented as usual 

in the Electronic Medical Record. 

Many patients who require alcohol and drug abuse treatment also require mental health and 

medical care. Services related to substance abuse are often provided during the same visit as 

medical and mental health services by the same provider in settings like primary care, urgent 

care, emergency department and other locations. Segregating a certain portion of a single 

2 
encounter note from the rest of the encounter by type of service is not possible using current 

electronic health record (EHR) technology, and would create a misleading, inaccurate record of 

these types of complex visits. Moreover, this would lead to poorer quality care. Segregating 

substance abuse information from the rest of the record would be deceptive to future treating 

providers who will be forced to make medical decisions based on incomplete information and 

would perpetuate the current challenges that providers face under the existing Part 2 rules in 

providing treatment to patients based on incomplete medical information. 

Moreover, defining covered substance abuse information by type of service instead of by facility 

type would increase the complexity and cost of disclosing medical records for other reasons 

permitted by law even if SAMHSA modified the Part 2 Regulations to permit disclosure of 

substance abuse treatment information for treatment purposes beyond emergency care,. We 

believe that it is impossible using current EHR technology to accurately identify which records 

contain substance abuse treatment information based on the service provided, particularly in an 

integrated care record. It would also be a significant additional burden to redact protected 

information in a chart note with other information that is not subject to Part 2 protections in order 

to protect that information from improper disclosure. Our current EHR software is unable to 

perform this function, so considerable staff time would be needed to review and redact records 

before disclosure. Given the potential for human error in this type of review, we believe that 

there is significant risk that information meeting the proposed definition of Part 2 information 

would be inadvertently disclosed. 

Consent Requirements 

Group Health believes that requiring patient consent before disclosing substance abuse 

information for treatment and quality improvement purposes is detrimental to effective patient 

care and creates real safety risks for patients. As above, in our experience, patients who receive 

health care in an integrated care setting expect all of their care providers to have access to, and 

be familiar with, the care they receive from other providers that are part of their care team. To 

this end, Group Health would support an effort to amend 42 U.S.C. § 290dd-2 to permit 

disclosure of Part 2 records without consent for treatment and quality improvement purposes, as 

we recognize that effectuating this type of change may not be possible through regulatory 

revisions. 

Disclosing Substance use disorder treatment information to all members of the care team is 

critical for high quality care. The National Council on Quality Assurance (NCQA) has two 

HEDIS measures of the quality of care for substance use disorders that require monitoring if a 

patient initiates and engages in care. Group Health is in the process of integrating care for 

substance use disorders into medical care settings. For example, social workers would follow up 

with patients who have not initiated and engaged in substance use disorders treatment in order 

to provide high quality substance use disorders care, consistent with NCQA standards. Sharing 

of such substance use disorders treatment information is critical to high-quality team-based 

care. 

3 
As an alternative to modifying the statute, Group Health proposes that the regulation permit 

patients to consent to a broad disclosure for a particular type of use, for example, for treatment 

and quality improvement purposes, instead of requiring the consent to describe the individual, 

organization, or health care entity to which disclosure is to be made. We believe this change 

could be accomplished through regulatory revisions pursuant to the authority granted under 42 

U.S.C. § 290dd-2(g). Specifically, 42 U.S.C. § 290dd-2(g) provides that regulations promulgated 

under the authority of the statute “may contain such definitions, and may provide for such 

safeguards and procedures... as... are necessary or proper to effectuate the purposes” of the 

law, “to prevent circumvention or evasion” of the law, and “to facilitate compliance” with the law. 

A change to the regulatory consent provisions would be consistent with this grant of authority. 

As a second, less preferred alternative, Group Health would support allowing the option of 

consent to include a more general description of the organization or health care entity to which 

disclosure is to be made. Requiring the consent to list individual provider names or individual 

units of a larger organization would be difficult if not impossible to implement using current EHR 

technology. Using current technology, we do not believe we would be able to shield portions of 

the medical record from certain individual providers (as opposed to shielding access by 

category/credential of provider such as MD, RN, MA, etc.), and permit access to the entire 

record to others. Even if this were possible, as a large, integrated care system, it would be 

administratively burdensome to send updated provider lists to all patients who receive 

substance abuse services to notify them of new providers and collect updated consent forms 

reflecting their decision to expand the consent to one or more of those new providers. 

Group Health does not support any proposal that would require the patient to be provided a list 

of specific and/or individual providers because of the administrative burden this would impose 

on large health care systems where a number of providers may be part of a patient’s care team. 

Using current technology, we do not believe we would be able to shield portions of the medical 

record from certain individual providers and perm

Health also does not support any proposal that w

describe the substance abuse treatment informat

not in a position to determine, in advance, what i

require for purposes of treatment. 

it access to the entire record to others. Group 

ould require that the consent form explicitly 

ion that may be disclosed, because a patient is 

nformation his or her medical provider might 

Finally, as an alternative to the restriction of 42 U.S.C. § 290dd-2 to specific treatment facilities, 

whereas medical treatment would be covered by HIPAA, Group Health requests that SAMHSA 

consider revising the Part 2 Regulations to permit consent for disclosures for treatment and 

quality improvement to be an “opt out” consent procedure in order to facilitate these types of 

disclosures while retaining the significant safeguards in place for other types of disclosures. We 

believe that an “opt out” consent for treatment and quality improvement would not be 

inconsistent with 42 U.S.C. § 290dd-2, which does not define the term “consent,” and could be 

accomplished through regulatory revisions. 

4 
 

Redisclosure 

Group Health believes any restriction on the disclosure of substance abuse treatment 

information, including redisclosure of this information, for purposes of treatment and quality 

improvement are detrimental to patient care. We do not believe that revising the redisclosure 

provision to clarify that the prohibition on redisclosure only applies to information that would 

identify an individual as a “substance abuser” would facilitate technical solutions for complying 

with the Part 2 Regulations. As we understand them, current EHRs are no more capable of 

identifying and segregating data indicating an individual is a “substance abuser” than 

segregating data by the type of service provided. For example, we are unaware of a way to 

“flag” this information within an integrated care record and obscure only limited “substance 

abuser” identifying data from view. 

The importance of access to critical information regarding substance abuse treatment for 

treating providers significantly outweighs the potential for provider bias. Unfortunately, there is 

a possibility that providers may be biased against a variety of patient types and conditions, 

including STIs, mental health conditions, lifestyle, weight, age, and gender. However, 

segregating information identifying a patient as a “substance abuser” for concern of provider 

bias perpetuates medical decision making based on incomplete information. For example, if a 

patient is prescribed naltrexone for alcohol use disorders, it is critical that that information be 

available to any member of the patient’s team who might prescribe an opioid (e.g. 

anesthesiologists, surgeons). We do not believe that the concern expressed during the June 11, 

2014 Listening Session that some providers harbor bias against individuals who have sought 

treatment for substance abuse outweighs the potential patient harms in keeping medically 

significant information a secret from a patient’s treating provider. 

Medical Emergency 

Group Health is supportive of SAMHSA’s proposal to modify the medical emergency exception 

so that it is more closely aligned with the statutory language. We agree that the statutory 

language, permitting disclosure of substance abuse program records “to medical personnel to 

the extent necessary to meet a bona fide medical emergency” does not limit disclosure under 

this exception to circumstances where an “immediate threat to the health of any individual” 

exists requiring “immediate medical intervention,” as stated in the current Part 2 Regulations at 

§2.51. 

We believe that the statutory phrase “to the extent necessary to meet a bona fide medical 

emergency”1

 may reasonably be interpreted to include preventing emergencies, treating 

patients whose condition could result in a medical emergency without appropriate intervention, 

and treating patients when there is an immediate threat to the health of any individual that 

requires immediate medical intervention. It is critical for treating providers to have access to all 

1 42 U.S.C. § 290dd-2(b)(2)(A). 

5 
clinical information in order to provide effective care and to reduce undue – and preventable – 

risk from medical services and prescribed medications that may be contraindicated for patients 

who are current or former recipients of substance abuse treatment. To this end, the Part 2 

Regulations should allow a treating provider to use his or her professional judgment to 

determine whether substance abuse treatment information is relevant to medical decision 

making for a particular patient. For example, if a patient is in treatment for an opioid use 

disorder, and seeks care for a chronic pain condition, it would adversely impact the quality of 

care if the treating provider was not informed of the opioid use disorder. 

Qualified Service Organization (QSO) 

Group Health agrees with the proposal to expand the definition of a qualified service 

organization (QSO) to include care coordination services and population health management, 

and to allow a QSO Agreement (QSOA) to be executed between an entity that stores Part 2 

information (including payers and ACOs that are not themselves Part 2 programs) and a service 

provider. However, we believe the proposed expansion should also permit multiparty QSOAs in 

order to facilitate sharing of Part 2 information by a care-coordination or population health 

management entity or other QSO with the patient’s medical team for treatment purposes. 

Group Health’s integrated care model focuses on providing appropriate, comprehensive and 

coordinated care in collaboration with our members and patients. Our care model depends on 

Group Health providers and care managers being fully informed about all aspects of our 

patients’ care, so that we can deliver the right care in the right place at the right time with the 

right outcome. Expressly permitting the QSO to provide this critical clinical information to a 

patient’s providers will promote patient-centered continuity of care and quality outcomes. 

Health care providers and care coordination and population health management organizations 

may not have QSOA experience, but are familiar with the similar HIPAA business associate 

agreement model. Therefore, if SAMHSA were to allow multiparty QSOAs to permit disclosure 

of Part 2 information from the QSO to a treating provider, providers and QSOs would be wellpositioned for rapid compliance with the new requirements. 

Research 

Group Health strongly supports the proposal to expand authority to health care entities that 

receive and store Part 2 data (including third party payors, health management organizations, 

HIEs, and care coordination organizations) to release data to qualified researchers and 

research organizations for research purposes. Group Health recommends that SAMHSA adopt 

the HIPAA confidentiality protections for research to protect the confidentiality of substance 

abuse treatment information. A single confidentiality standard for all research involving clinical 

information would provide consistent standards for researchers and would continue the strong 

protections already afforded to all medical information (including sensitive STI and mental health 

data) under HIPAA. 

HIPAA, and to a certain extent, the Common Rule contain robust confidentiality provisions that 

protect the confidentiality of research participants’ health information, including extensive 

6 
 

requirements for authorization and informed consent, documented IRB or privacy board review 

and approval, and use of limited data sets excluding specific direct identifiers. Further, 

investigators and others who have access to sensitive, identifiable research data may request a 

Certificate of Confidentiality by the National Institutes of Health (NIH) or other federal agency to 

permanently protect this data from being released in any civil, criminal, administrative, 

legislative or other proceeding at the federal, state or local level, regardless of whether the 

research is federally funded. See 42 U.S.C § 241(d). 

We have found that the current Part 2 Regulations’ requirements related to program director 

approval and prohibition on redisclosure to be overly burdensome. These requirements add little 

protection beyond the existing safeguards provided by HIPAA privacy combined with 

Certificates of Confidentiality, at the cost of discouraging researchers from conducting critically 

important population-based research related to substance abuse treatment or involving 

substance abuse treatment program data. As a practical effect, these requirements hinder the 

development of evidence-based clinical standards for substance abuse treatment. Our Group 

Health Research Institute investigators have been funded to conduct innovative and important 

research on implementation of population-based patient-centered care for alcohol use 

disorders. Evaluating the success of our program which will offer patients shared decisionmaking about treatment options for alcohol use disorder will be critically hampered if we are 

unable to obtain data on substance abuse disorder treatment received by patients from our 

contracted community substance use disorder treatment programs. We believe that lagging 

standards of care contribute to stigma associated with substance abuse as a result of the 

perception that substance abuse is a “personal weakness” rather than a medical condition that 

can be treated through effective, established courses of medical treatment. 

Addressing Potential Issues With Electronic Prescribing and Prescription Drug 

Monitoring Programs (PDMPs) 

Electronic Prescribing 

Group Health agrees with comments made during the June 11, 2014, Listening Session that 

current e-prescribing technology is unable to distinguish between claims related to Part 2 

services and claims that are not related to protected services. To our knowledge, e-prescribing 

vendors are also unable to implement the sophisticated data segmentation that would be 

necessary to limit disclosure of only Part 2 data while disclosing other medical information as 

permitted by HIPAA. As a result, e-prescribing vendors that accept Part 2 data must either 

choose to ignore the Part 2 Regulations entirely to facilitate permitted disclosures of other health 

information under HIPAA, or avoid disclosing any information in a record containing some Part 2 

data in order to protect that information under the stricter Part 2 disclosure standard. 

Prescription Drug Monitoring Programs 

Group Health is an industry leader in opioid prescription safety. In our experience, PDMPs are a 

critical patient safety tool for providers to track their patients’ medications to avoid unsafe doses 

and drug interactions. Because of the consent requirements under the current Part 2 

7 
Regulations, in our experience, pharmacies typically do not send Part 2 data to PDMPs, so this 

important information is unavailable to support treatment decisions. 

Group Health also recognizes the concern that states often permit law enforcement to access 

state PDMPs, with potential criminal or other legal consequences, and we agree there is a need 

to protect Part 2 data held by a PDMP from disclosure to law enforcement. We believe that 

regulating proper and improper use of PDMP data by law enforcement is within the scope of 42 

U.S.C. § 290dd-2. Given the critical role that PDMPs play in preventing adverse drug 

interactions and overdoses, Group Health supports regulatory changes that would facilitate the 

inclusion of Part 2 data in PDMPs for treatment purposes but limit or prohibit the use of this data 

for law enforcement purposes and in criminal proceedings consistent with 42 U.S.C. § 290dd2(c). 

Once again, we appreciate the opportunity to provide these comments for your consideration, 

and your willingness to consider these comments as you further develop potential changes to 

42 CFR Part 2 requirements. 

Sincerely, 

Megan Grover Howell 

Director, Policy and Regulatory Affairs 

Group Health Cooperative 

8 
MaineGeneral Health 

SAMHSA 

1 Choke Cherry Road 

Rockville, MD 20857 

RoomS-1011 

June 24, 2014 

Thank you for the opportunity to submit comments regarding the Confidentiality of Alcohol and 

Drug Abuse Patient Records Regulation ( 42 CFR, Part 2). MaineGeneral Health submits the 

following: 

Healthcare professionals need accurate and complete information to appropriately assess 

and treat a patient. The Part 2 consent form regulations are a barrier to proper treatment of 

patients. The Part 2 consent form regulations should be standardized with the HIPAA general 

consent form requirements and should preempt any conflicting state standards. The current 

regulations hinder a patient's ability to consent to full disclosure and benefit from the 

information age. 

The Part 2 consent form regulations, as current! y written prevent treating professionals 

from having all pertinent information about a patient, and are not in a patient's best interest. 

Healthcare professionals owe an ethical duty of confidentiality to their patients with or without 

the 42 CFR Part 2 regulations or HIP AA. Many patients are reluctant to share any medical 

information necessary information unless they have a relationship of trust with their doctor and 

are confident that their information will be protected. This is true for all personally identifying 

healthcare information (patients are as concerned about the disclosure of substance abuse 

treatment information as they are of HIV, mental health, sexually transmitted disease, cancer 

diagnosis, or other personally identifying healthcare information). All agree that trust is essential 

to a sound patient-physician relationship. Likewise there is general agreement that healthcare 

professionals may be harming patients because of a lack of essential ( and available) information 

for treatment because of the rigid requirements of the Part 2 rules. 

Part 2 information in Electronic Health records is obviously problematic because unless it 

is freestanding program Part 2 information is commingled. By way of example, Clinicians who 

use a controlled substance (e.g., methadone or buprenorphine) for detoxification or maintenance 

treatment of a substance use disorder require a federal DEA registration and become subject to 

Part 2 through the DEA license. As a result, when these Clinicians (with DEA registrations) are 

entering information into general medical records systems the information is being commingled. 

However, even ifwe were dealing with Part 2 information in only paper health records, 

bi-furcating the record under Part 2 and denying treating healthcare professionals all information 

about a patient is still not in the patient's best interest. The poly-pharmacy issues alone clinically 

make this sort of confidentiality restriction among healthcare providers with a common goal of 

treatment, harmful to the patient. 
Accordingly, it is in the best interests of the Patient that the Part 2 Consent Rules should 

be modified to mirror the HIP AA General Consent rules so as to allow the use of a general 

consent for disclosure: (A) To medical personnel to the extent necessary for treatment, payment 

and healthcare operations; and to (B) Health Information Exchanges. 

The rigid regulatory consent form requirements for Part 2 consent are unnecessary. By 

way of example, remove the requirement that a "statement prohibiting re-disclosure be 

included." The law prohibits it without consent. Let people follow the law. Requiring 

healthcare entities to tell everyone to follow the law is not effective and just adds wasteful 

administrative expense to the healthcare system. Also, remove the requirement that each 

disclosure made with written patient consent be accompanied by the scripted "written statement" 

that the information disclosed is protected by federal law. Again ignorance oflaw is no excuse, 

this regulation is not needed. 

In summary, a patient should be given the option to sign a general consent that will allow 

them to get the best treatment possible with the technology available today and as advanced in 

the years to come. 

1: -1~ 

1lll~antakos, Privacy Officer 

MaineGeneral Health 

35 Medical Center Parkway 

Augusta, Maine 04330 

Accordingly, it is in the best interests of the Patient that the Part 2 Consent Rules 

should be modified to mirror the HIPAA General Consent rules so as to allow the use of a 

general consent for disclosure: (A) To medical personnel to the extent necessary for treatment, 

payment and healthcare operations; and to (B) Health Information Exchanges. 

The rigid regulator consent form requirements for Part 2 consent are unnecessary. By 

way of example, remove the requirement that a "statement prohibiting re-disclosure be 

included." The law prohibits it without consent. Let people follow the law. Requiring 

healthcare entities to tell everyone to follow the law is not effective and just adds wasteful 

administrative expense to the healthcare system. Also, remove the requirement that each 

disclosure made with written patient consent be accompanied by the scripted "written 

statement" that the information disclosed is protected by federal law. Again ignorance of law is 

no excuse, this regulation is not needed. 

In summary, a patient should be given the option to sign a general consent that will 

allow them to get the best treatment possible with the technology available today and as 

advanced in the years to come. 

Elliot Sarantakos, Privacy Officer 

MaineGeneral Health 

35 Medical Center Parkway 

Augusta, Maine 04330