Source: https://healthitsecurity.com/news/patient-privacy-addressed-in-recent-hhs-confidentiality-rule
Timestamp: 2017-06-26 20:47:12
Document Index: 657944461

Matched Legal Cases: ['art 2', 'art 2', 'art 2', 'art 2', 'art 2', 'art 2', '§\u20092']

A final rule was issued by HHS, addressing patient privacy concerns in the Confidentiality of Alcohol and Drug Abuse Patient Records regulations.
January 19, 2017 - The Confidentiality of Alcohol and Drug Abuse Patient Records regulations were recently updated and modernized, specifically addressing patient privacy concerns for individuals seeking treatment for a substance abuse disorder.
The changes were issued under a finalized rule from the Department of Health and Human Services (HHS).
Concerns had previously been raised over privacy of records for individuals who may seek treatment for substance abuse. There could be numerous consequences if records were released, including loss of employment, loss of housing, loss of child custody, or discrimination by medical professionals and insurers, according to HHS.
How Patient Privacy is Affected by Patient Matching ProposalData Encryption Workgroup Report Discusses Privacy ConcernsHIPAA Privacy Rules Considered in Recent Mental Health Bill
It has been 29 years since the part 2 regulations were significantly amended, HHS explained in the rule’s executive summary. The policy changes will better align the regulations with “advances in the U.S. health care delivery system while retaining important privacy protections.”
One of the changes included adding a requirement under confidentiality restrictions and safeguards. Upon request now, patients who have a general designation of “To whom” in their consent form, “must be provided a list of entities (referred to as a List of Disclosures) to which their information has been disclosed pursuant to the general designation.”
Part 2 programs and other entities that legally hold identifying patient information are now also required to have “formal policies and procedures addressing security, including sanitization of associated media, for both paper and electronic records.”
The section on re-disclosure of information was also clarified. The Substance Abuse and Mental Health Services Administration (SAMHSA) stated that prohibiting data to be re-disclosed only includes information that would identify, directly or indirectly, an individual who has been diagnosed, treated, or referred for treatment for a substance use disorder.
This would include through standard medical codes and/or descriptive language. Other health information, shared by the part 2 program could be re-disclosed if it is allowed under other applicable laws.
In general, public comments were in favor of the proposed final rule. In particular, commenters stated that they supported how the rule focused on preserving substance use disorder patients’ confidentiality rights, while still facilitating health information sharing.
In response to certain comments, SAMHSA reiterated that part 2 now has more “stringent federal protections” than health data privacy laws, including HIPAA.
Other commenters raised concerns over finding the right balance between patient privacy and information exchange.
“Some commenters suggested that patient confidentiality should not be compromised by any updates to the part 2 regulations, reasoning that the stigma associated with having or having had a substance use disorder and the fear that this information may be used against an individual would lead them to not seek treatment,” the Rule read. “To this end, a few of these commenters cautioned SAMHSA to remain diligent in the oversight of these regulations to ensure that the information is only being conveyed to the appropriate parties with the sole intent to improve patient care.”
Furthermore, commenters maintained that part 2 should better align with HIPAA regulations. This could help find the right balance between sharing patient data without sacrificing patient privacy.
For example, business associate agreements, patient-requested restrictions on disclosure, and de-identification standards could all be incorporated from HIPAA.
“In response to comments about alignment of this regulation with HIPAA, SAMHSA has aligned the interpretation the definition of “Patient identifying information” with HIPAA to the extent feasible,” the Rule stated. “In addition, SAMHSA revised Security for records (§ 2.16) to more closely align with HIPAA.”
Patient Privacy Concerns Eased with Senate Bill ProgressResearch Data Privacy Regulations Updated in Final Federal RuleConsidering HIPAA Privacy Rule with Mental Health Data