	Protecting Privacy in an Evolving Health System

On January 18, 2017, the Secretary of Health and Human Services (HHS) published a final rule that amends the federal regulations responsible for safeguarding the privacy of patient records maintained by substance use disorder treatment programs across the country. According to the HHS Substance Abuse and Mental Health Services Administration (SAMHSA), which administers Part 2, the changes in the final rule are intended "to better align [Part 2] with advances in the U.S. health care delivery system while retaining important privacy protections." Today, the health care system is embracing new models for delivering services—including accountable care organizations (ACOs) and patient-centered health homes—that rely on sharing patient information to coordinate and integrate care. Under Part 2, the disclosure of substance use disorder treatment records requires a patient's written consent, unless the type of disclosure falls under one of a handful of specific statutory exceptions. This contrasts with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, which permits clinicians to share patient information for treatment and payment purposes. Whereas the primary care facility is permitted under HIPAA to share the patient's information with the Part 2-covered alcohol and drug treatment program and any other health care facility providing care, the alcohol and drug treatment program generally needs the patient's consent under Part 2 to release information to another health care facility. Substance use disorder treatment programs typically are subject to both sets of regulations—Part 2 and the HIPAA Privacy Rule—unless there is a conflict between the two. In that case, the program must comply with the regulations that are more protective of patient privacy, which generally means following the requirements under Part 2. Although SAMHSA's primary goal was to modify Part 2 to facilitate the sharing of patients' Part 2 data with other providers participating in clinically integrated health care networks, the agency's rulemaking options were constrained by the underlying statutory language. Under the final rule, more options are available. A patient can now list any of the following in the "to whom" section of the consent form:
the name of an individual; the name of an entity (e.g., hospital, clinic, physician practice) that has a "treating provider relationship" with the patient; the name of an entity with which the patient does not have a treating provider relationship and which is a third-party payer; and/or the name of an entity with which the patient does not have a treating provider relationship and which is not a third-party payer (e.g., ACO, health information exchange, research institution), plus either the name(s) of specific individual participants; the name(s) of an entity participant(s) with which the patient has a treating provider relationship; or a general designation of individual or entity participants, or class of participants, with which the patient has a treating provider relationship (e.g., "all my past, present, and future treating providers"). Thus, a patient may now consent to disclose Part 2 data to an organization such as a health information exchange (HIE) that does not have a treating provider relationship with the patient, but which acts as an intermediary. Stakeholder Reaction Has Been Mixed

Groups that advocate for the privacy of individuals with substance use disorders generally are satisfied with the final rule because it retains Part 2's confidentiality protections. Representatives of the behavioral health provider and medical informatics communities support the final rule's general consent provisions that permit disclosure of Part 2 data to intermediaries such as HIEs and ACOs. They argue that these requirements are administratively and technologically burdensome and provide little if any additional privacy protections. In tandem with its Part 2 rulemaking activities, SAMHSA has worked closely with federal and nonfederal partners to develop HIT standards and applications that support the use and disclosure of information protected by Part 2. New Technologies Support Part 2 Data Exchange

To facilitate the electronic exchange of Part 2 data, each patient's consent preferences specifying the type of information that may be shared, and the individuals or entities with whom the information may be shared, must be carefully managed. Patient consent has to travel with the data in order to control access. In addition, a mechanism is required for segregating the data in a medical record to capture a patient's preferences. Data segmentation allows a patient's record to be broken down into multiple categories, allowing certain protected data elements to be removed (redacted) if a patient has not consented to their disclosure. Based on the DS4P standards, SAMHSA designed Consent2Share, an open-source online tool for data segmentation and consent management. Consent2Share integrates with existing EHR systems and HIE networks to manage the exchange of health information among providers.
On January 18, 2017, the Secretary of Health and Human Services (HHS) published a final rule to amend the federal regulations known as "Part 2" that protect the privacy of patient records maintained by alcohol and drug treatment programs across the country. Part 2 was developed in the 1970s to allay the concerns of individuals with substance use disorders who were afraid to get treatment for fear that their medical information would be released, leading to discrimination and even prosecution.
Health care providers participating in new health care delivery models such as accountable care organizations (ACOs), which rely on sharing medical information to coordinate and integrate patient care, complain that Part 2 restricts their ability to access important medical data.
Disclosure of Part 2 Data
Disclosure of Part 2-covered data generally requires a patient's written consent unless the type of disclosure falls under one of a handful of statutory exceptions. Consent is needed for a clinician to release patient information to another health care facility to improve the coordination of care. This requirement contrasts with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, which applies more broadly to medical information throughout the health care system, and which permits health care providers to share patient data with few restrictions.
Alcohol and drug treatment programs typically are subject to both Part 2 and the Privacy Rule unless there is a conflict between the two. In that case, the program must comply with the regulations that are more protective of privacy, which generally means following Part 2.
Changes in the Final Rule
The final rule was developed by the HHS Substance Abuse and Mental Health Services Administration (SAMHSA). According to SAMHSA, the changes in the final rule are intended primarily to facilitate the sharing of Part 2 data among providers participating in clinically integrated health care networks that include addiction treatment programs.
The final rule introduced flexibility to the Part 2 consent process. It provided patients with more options for designating the types of individuals and entities that may receive protected information. A patient may now consent to disclose Part 2 data to an organization such as an ACO or health information exchange (HIE) that does not have a direct treatment relationship with the patient, but which acts as an intermediary. The intermediary may then disclose the information to some or all of the providers who treat the patient, pursuant to the patient's consent preferences.
Groups that advocate for the privacy of individuals with substance use disorders generally are satisfied with the final rule because it retains Part 2's core confidentiality protections. But the reaction of many health care provider organizations has been mixed. While applauding the changes that permit disclosure of Part 2 data to intermediaries such as ACOs and HIEs, providers are critical of other changes that they claim are administratively and technologically burdensome and provide little if any additional privacy protections.
Exchange of Part 2 Data
To facilitate the electronic exchange of Part 2 data, each patient's consent preferences specifying the type of information that may be shared, and the individuals or entities with whom the information may be shared, must be carefully managed. To control access, patient consent must travel with the data. In addition, the data in a medical record must be segregated to capture a patient's preferences. Data segmentation allows a patient's record to be separated into multiple categories, so that certain protected data elements can be removed (redacted) if a patient has not consented to their disclosure.
SAMHSA has worked with its federal and nonfederal partners to develop Consent2Share, an online tool for data segmentation and consent management. Consent2Share integrates with electronic health record systems and HIEs to support the exchange of Part 2 and other sensitive health data.