The purpose of this bulletin is to provide an update on new regulations under 42 CFR Part 2 (“Part 2”) relating to disclosure of patient substance use disorder records and new guidance on the Health Insurance Portability and Accountability Act (HIPAA) relating to sharing patient mental health information, including identification of areas where the changes intersect with Washington State law. The new Part 2 regulations go into effect on February 2, 2018. This bulletin is informational only and does not provide legal advice. Please consult with your hospital’s legal counsel as you determine applicability of this information to your facility.
The new regulations under 42 CFR Part 2 will take effect February 2, 2018 and in certain limited circumstances make it easier for health care providers to share patient substance use disorder records and provide for greater flexibility in disclosing patient identifying information. Recently issued guidance on the HIPAA Privacy Rule clarifies the conditions and criteria necessary for sharing mental health information of patients in distress due to a substance use or mental health disorder.
Review this bulletin with legal counsel to determine impact on your hospital and any resulting changes that may be made to hospital process or procedure. Inform staff who have responsibility for disclosure of health information, including clinical staff, of the changes.
Some revisions have been made to federal regulations and guidance that impacts:
- sharing protected health information of patients suffering from substance abuse and/or mental health disorders; and
- sharing of substance abuse treatment records.
New HIPAA Guidance on Disclosure of Records for Patients Suffering from Substance Use or Mental Health Disorders (link)
The U.S. Department of Health & Human Services (HHS) Office for Civil Rights (OCR) recently released new guidance clarifying the circumstances under which HIPAA’s Privacy Rule permits disclosure of protected health information (PHI) to family members and caregivers where a patient is experiencing a substance use disorder or mental health crisis. See Information Related to Mental and Behavioral Health, including Opioid Overdose.
Covered entities, such as hospitals, must read the requirements under the HIPAA Privacy Rule in conjunction with state law under chapter 70.02 RCW, particularly RCW 70.02.050 and RCW 70.02.205 relating to disclosures without patient authorization, to determine permissible sharing of health information under state and federal law. Generally, where state law is more stringent than HIPAA, state law applies.
- Disclosure to Family and Friends: The OCR communication emphasized that before taking other steps for a patient in crisis, the health care provider must initially assess the capacity of the patient to communicate and make decisions about sharing information. If a patient has capacity, providers must first determine if the patient consents to disclosure of the information. Where a patient is incapacitated and a personal representative is not available to make decisions, a provider may share PHI if doing so is in the best interest of the patient.
- State law requirements under RCW 70.02.205 must also be met including, but not limited to, the disclosure is to a family member, domestic partner, other relative, a close personal friend, or other person identified by the patient, or the disclosure is for the purpose of notifying, including identifying or locating, a family member or personal representative of the patient’s location, general condition, or death.
- Where disclosure involves sharing patient mental health information, state law imposes additional restrictions under RCW 70.02.205(2) limiting the information to the patient’s diagnoses and treatment recommendations, issues concerning the patient’s safety, and community resources. The disclosure must also be consistent with the provider’s professional judgment and standards of ethical conduct and limited to the minimum information necessary to accomplish the purpose of the disclosure.
- Disclosure for a Threat to Health or Safety: It is worth noting that where a patient presents a serious and imminent threat to self or others, a health care provider may share necessary patient information, without the patient’s consent, with law enforcement, family members or friends, and others who may be able to avert or mitigate the threatened harm. See RCW 70.02.050 and 45 CFR 164.512(j).
New Rules on Disclosure of Substance Abuse Records Under 42 CFR Part 2 (link)
Federal law provides guidance on disclosure of substance use disorder records. The Substance Abuse and Mental Health Services Administration (SAMHSA) recently published new regulations governing confidentiality and disclosures of patient substance use disorder records, known as 42 CFR Part 2 or “Part 2.” The Final Rule, which goes into effect February 2, 2018, pertains to disclosure of the records for purposes of payment, health care operations, and audits and evaluations.
- Abbreviated Notice: Health care providers may use a short-form notice of prohibition on re-disclosure when disclosing patient records with the patient’s written consent.
- Disclosure for Health Care Operations and Payment: Records may be shared with contractors, subcontractors, or legal representatives for purposes of payment and health care operations, which should help align disclosures with state law and HIPAA, but not care coordination or case management. There must be a written contract with the recipient requiring his/her compliance with the provisions of Part 2.
- Disclosure for Audits and Evaluations: Disclosures may be made to federal, state, and local agencies performing audits or evaluations of programs subject to Part 2.
Background and References
42 CFR Part 2 – Final Rule
Office for Civil Rights Memo – HIPAA Privacy Rule and Sharing Information Related to Mental Health