Overcoming Data-Sharing Challenges in the Opioid Epidemic: Integrating Substance Use Disorder Treatment in Primary Care JULY 2018 Contents About the Authors 3Executive Summary This paper was prepared for the California Health Care Foundation by the law firm of 4Introduction Manatt, Phelps & Phillips, LLP (Manatt). Robert 5Overview of 42 CFR Part 2 Belfort, JD, is a partner at Manatt who focuses Statutory Origins on the representation of health care providers, health plans, and other health care companies Applicability of Part 2 on regulatory and transactional matters. Belfort Limited Exceptions to Part 2 Restrictions counsels clients on compliance with HIPAA Consent Requirements and other state and federal privacy laws. Alex Recent Revisions to Part 2 Dworkowitz, JD, is a Manatt associate with expertise on privacy laws and other health regu- 10Relationship of Part 2 to HIPAA latory issues. 11Challenges Faced by Primary Care Practices About the Foundation That Treat SUD Disorders The California Health Care Foundation is Applicability of Part 2 to Primary Care Practices dedicated to advancing meaningful, measur- Segregating Part 2 Records able improvements in the way the health care Experiences of Primary Care Practices with Part 2 delivery system provides care to the people of Compliance California, particularly those with low incomes and those whose needs are not well served by 17Strategies for Sharing Part 2 Information the status quo. We work to ensure that people Structuring Operations to Avoid Part 2 Applicability have access to the care they need, when they need it, at a price they can afford. Development of Flexible EHR Infrastructure Effective Use of Consent Forms CHCF informs policymakers and industry lead- Proper Training and Education ers, invests in ideas and innovations, and Obtaining Information from Local Specialized SUD Programs connects with changemakers to create a more responsive, patient-centered health care system. Putting Data in Patients’ Hands 20Further Amendments to Part 2 For more information, visit www.chcf.org. 21 Endnotes Disclaimer This paper has been prepared for educational purposes only. Nothing in this paper is intended as or should be relied upon as legal advice. Any party that is contemplating the use or disclosure of health information for any purpose is encour- aged to consult with its legal counsel. California Health Care Foundation 2 Executive Summary practices must have a system under which personnel I outside the Part 2 program cannot access a patient’s n response to the opioid epidemic, states and the SUD record unless the patient has consented. federal government have sought to increase the avail- ability of substance use disorder (SUD) treatment. 4.Avoiding Part 2 regulation simplifies data sharing Through medication-assisted treatment (MAT) programs among practitioners serving patients with SUDs. and other efforts, primary care practices have taken a Some primary care practices delivering SUD care may more prominent role in providing SUD care.1 Primary be able to avoid regulation under Part 2 by limiting care practices are stepping up to treat addiction due to the scope and active promotion of their SUD services. many factors — recognition of the role of the medical 5.Primary care practices that operate Part 2 pro- system in driving opioid overuse and addiction, shifting grams can best integrate care if they utilize a single of attitudes about addiction with acceptance of SUD as electronic health record (EHR) system that segre- a chronic disease, and insufficient specialized treatment gates Part 2 records from other records. This system resources to address growing demands, especially in could potentially rely on technical safeguards such as rural areas. However, common roadblocks for primary firewalls, or administrative safeguards such as access- care practices are the inability to efficiently and effec- control policies coupled with audits. tively communicate with SUD providers and a lack of clear guidance about how to share SUD and primary care 6.The administrative burden of obtaining consent can treatment information. be reduced by integrating consent requests into standard workflows. Consents should be written as This paper summarizes the requirements of the federal broadly as the law allows and the patient permits, and SUD confidentiality rules set forth under 42 Code of may be combined with other forms. Federal Regulations (CFR) Part 2, discusses the steps 7.Primary care practices also stated in interviews that primary care practices currently take to effectively that specialized SUD providers generally do not coordinate SUD care without violating the rules, suggests share their records because they typically do not additional compliance strategies that might enhance obtain a patient’s written consent to share records data sharing, and offers for consideration modest revi- with other providers. In some cases, SUD providers sions to the rules that could promote the integration of may fear that their patients will be stigmatized if their care without undermining patient privacy. The key find- data are shared with practitioners outside of the SUD ings of the paper are as follows: program; in other cases, the process of consent may 1.42 CFR Part 2 typically does not allow a patient’s be viewed as an avoidable burden in an environment information that is subject to the regulation to be where resources are extremely limited. disclosed without the patient’s written consent. 8.Primary care practices can gain greater access to This even applies for the purpose of providing treat- SUD treatment information by working with spe- ment (except in a medical emergency). cialized SUD programs in their communities to 2.Part 2 applies to a federally assisted primary care standardize consent forms and procedures for practice if the practice “holds itself out” as provid- requesting consent. Community-wide electronic ing SUD services. A primary care practice meets this health information exchanges can also improve access test if the practice maintains a license to provide SUD to Part 2 records. services or otherwise indicates that the practice has 9.Modest changes to the Part 2 rules could improve specialized SUD expertise through advertising, sig- access to SUD information. These changes could nage, personnel classifications, or other means. There include permitting consent forms to designate a is substantial ambiguity as to when a practice crosses class of recipients (rather than just individual provid- the line into “holding itself out” when engaging in ers), clarifying that the type of Part 2 records being these types of activities. disclosed can be described in general terms, and 3.In interviews, primary care practices subject to allowing care coordinators to be recognized as “quali- Part 2 reported that a key challenge is developing fied service organizations” so that such coordinators record systems that segregate information subject can access Part 2 records on behalf of Part 2 programs to Part 2 from other medical information. These without patient consent. Overcoming Data-Sharing Challenges in the Opioid Epidemic: Integrating Substance Use Disorder Treatment in Primary Care 3 Introduction The opioid epidemic comes at a time when the delivery system for SUD care is evolving, as states and providers I t is difficult to exaggerate the impact of the opioid epi- aim to break down treatment siloes and encourage care demic on the health of this nation. In 2016, over 63,000 to be coordinated among different providers and inte- Americans died from drug overdoses, more than three grated with other forms of health care, including physical times the rate in 1999 (see Figure 1). Approximately and mental health services. Yet better care coordination two-thirds of those overdose deaths were from use of is only possible if traditional SUD providers can effec- opioids, with the death rate from heroin use alone climb- tively exchange information with other parts of the health ing approximately 600% in this 17-year period.2 These care system such as primary care physicians. This type numbers represent not only lost lives, but destroyed fam- of information sharing can be a significant challenge for ilies and communities. providers, as they are required to balance the stringent privacy protections in federal and state laws with these Many analyses of the epidemic focus on its underlying new goals of coordinating care. causes, such as increased use of prescriptions of addic- tive painkillers like OxyContin and the loss of jobs in This paper examines the laws that regulate SUD infor- rural areas. Many have also called for increased funding mation sharing and how providers responding to the for services, whether it be through improved access to opioid epidemic navigate those laws. This paper focuses health insurance or other forms of funding. The capacity on primary care practices that have taken on increased of the existing delivery system to provide the necessary responsibility for SUD care as the opioid epidemic has care has also been called into question. Less common are stretched the capacity of specialized SUD treatment cen- discussions about another critical aspect of the response ters. Certain sections of this paper focus on California to the opioid epidemic — the mechanisms for sharing as a case study, but the issues discussed in this paper information about opioid addiction and other SUDs are applicable to primary care practices throughout the among the providers charged with treating SUD patients. country. Figure 1. Number of Drug Overdose Deaths in the United States, by Selected Drug Type, 1999 to 2016 NUMBER OF DEATHS Total Drug Overdoses Any Opioid* Heroin 70,000 63,632 60,000 50,000 42,249 40,000 30,000 16,849 20,000 15,469 8,050 10,000 1,960 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 *Includes heroin. Source: Drug Overdose Deaths in the United States, 1999–2016, Centers for Disease Control and Prevention, December 2017, www.cdc.gov. California Health Care Foundation 4 The following section of this paper provides an overview In particular, SUD information may be disclosed without of the federal SUD confidentiality regulation, 42 Code consent in the following narrow cases: of Federal Regulations (CFR) Part 2, which protects the $$ Tomedical personnel in the case of a “bona fide privacy of certain information related to the treatment medical emergency.” of opioid use and other SUDs. The paper goes on to examine how these federal rules compare to other state $$ To “qualified personnel” conducting “scientific and federal privacy protections applicable to SUD infor- research, management audits, financial audits, or mation, to analyze these rules from the perspective of program evaluation.” primary care practices who treat individuals for opioid $$ As authorized by a court order, including in cases use and other SUDs, and to suggest strategies that pri- to avert a substantial risk of death or serious mary care practices can undertake to achieve compliance bodily harm.5 with these privacy protections while promoting informa- tion sharing that benefits patients needing opioid use In addition, the statute does not apply to records shared treatment. Finally, modest changes to the Part 2 rules are with the military, the Department of Veteran Affairs, or identified that might simplify SUD data sharing without the reporting of incidents of suspected child abuse to compromising patient privacy. state and local authorities.6 As part of this paper, interviews were conducted with Shortly after DAPTRA was enacted, the newly created primary care practices in California, Connecticut, and Office for Drug Abuse Prevention adopted regulations Oregon that provide treatment to opioid users; a special- interpreting the law. In issuing the regulations, the agency ized SUD provider that operates throughout the country; explained the rationale behind the law and the rules: and an association that represents primary care practices. Also interviewed were representatives of the California Drug abuse in our society, at least with heroin, inevi- Department of Health Care Services — the state agency tably involves unlawful possession of drugs as a that regulates SUD providers and operates Medi-Cal, the minimum criminal complication, and the very high state’s Medicaid program — as well as the New York State cost of the heroin required to maintain a full-blown Department of Health, New York’s Medicaid agency. habit leads in many instances to a pattern of crimes against property. Socially, there is no more crushing a stigma than to be known as a junkie. If society is to make significant progress in the struggle against drug Overview of 42 CFR abuse, it is imperative that all unnecessary impedi- Part 2 ments to voluntary treatment be removed. There is clear agreement among drug abuse treatment pro- gram operators that their ability to assure patients Statutory Origins and prospective patients of anonymity is essential to Federal confidentiality protections for SUD date back the success of their programs. The identification of a to 1972, when Congress enacted the Drug Abuse person as a patient of a general practitioner or hospi- Prevention, Treatment, and Rehabilitation Act (DAPTRA).3 tal clinic is not ordinarily of great significance, but the As amended, DAPTRA makes confidential “records of the identification of a person as an enrollee in a narcotic identity, diagnosis, prognosis, or treatment of any patient treatment program can, in and of itself, have pro- which are maintained in connection with the performance foundly adverse consequences.7 of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, The regulations have been modified several times over or research, which is conducted, regulated, or directly or the past 45 years (see Figure 2, page 6). But the under- indirectly assisted by any department or agency of the lying rationale for these rules — and the high level of United States.”4 DAPTRA generally requires patient con- protection for SUD information that they provide — has sent for the disclosure of SUD information, but it does not materially changed. The analysis that follows is based contain limited exceptions to the consent requirement. on the most recent version of these regulations. Overcoming Data-Sharing Challenges in the Opioid Epidemic: Integrating Substance Use Disorder Treatment in Primary Care 5 Figure 2. Timeline of Substance Use Disorder Confidentiality Laws March 21, 1972. President Nixon signs June 9, 1987. After inviting public comment the Drug Abuse Office and Treatment Act on the revision of the SUD confidentiality of 1972, which makes SUD information regulations, the Alcohol, Drug Abuse, and confidential. Nixon says the bill is “designed Mental Health Administration makes some to mount a frontal assault on our number revisions to the rules, but keeps their basic one public enemy.” structure intact. November 17, 1972. The Special December 28, 2000. The HIPAA Action Office for Drug Abuse Privacy Rule is promulgated, Prevention issues regulations on the which does not affect the stricter confidentiality of SUD information. requirements of Part 2. 1972 1973 1977 1980 1985 1995 2005 2010 2018 July 1, 1975. The SUD confidentiality 2016. 42,249 Americans die from regulations are revised and moved to an opioid overdose, compared to 42 CFR Part 2. 8,050 opioid deaths in 1999. January 18, 2017. SAMHSA issues a final rule revising the Part 2 regulations. Applicability of Part 2 In order to meet the terms of the second requirement Given the brevity of DAPTRA and its lack of details, most and qualify as a “program,” an individual or entity must providers turn to the regulations at 42 CFR Part 2, not either “hold itself out” as providing SUD services, or the underlying statute, to determine the applicability of have an identified unit that “holds itself out” as provid- the federal SUD protections. The Part 2 regulations do ing such services. In addition, a Part 2 program includes not apply to every record maintained by any health care “medical personnel or other staff in a general medical provider that shows that a patient has an SUD. Instead, in facility” if such staff’s “primary function is the provision order for Part 2 to be applicable to an SUD record, three of substance use disorder diagnosis, treatment, or refer- requirements must be met. First, the record must “iden- ral for treatment and is identified as such specialized tify a patient as having or having had a substance use medical personnel or other staff by the general medical disorder either directly, by reference to publicly available facility.”10 General medical facilities may include hospi- information, or through verification of such identification tals, Federally Qualified Health Centers (FQHCs), and by another person.”8 Second, the record must have been physician practices.11 The Substance Abuse and Mental obtained by a “program.” Third, that “program” must Health Services Administration (SAMHSA), the federal be “federally assisted.”9 The first requirement is fairly agency responsible for administering Part 2, has said that straightforward, but the remaining two require further an individual or entity “holds itself out” as providing SUD explanation. services if it engages in: California Health Care Foundation 6 Any activity that would lead one to reasonably con- never share information regarding a patient being treated clude that the individual or entity provides substance by said practitioner. The Part 2 disclosure prohibitions: use disorder diagnosis, treatment, or referral for treat- ment, including but not limited to: (1) Authorization [D]o not apply to communications of information by the state or federal government (e.g.,  licensed, between or among personnel having a need for the certified, registered) to provide, and provides, such information in connection with their duties that arise services, (2) Advertisements, notices, or statements out of the provision of diagnosis, treatment, or referral relative to such services, or (3) Consultation activities for treatment of patients with substance use disorders relative to such services.12 if the communications are: (i) Within a part 2 program; or (ii) Between a part 2 program and an entity that has Even if an individual or entity is considered a “program,” direct administrative control over the program.15 it still may not be subject to Part 2 if it does not meet the third requirement — that is, is not “federally assisted.” Thus, two practitioners working for the same Part 2 pro- The definition of “federal assistance” is quite broad: A gram may share SUD information for treatment purposes. program is federally assisted if, among other things, it The “administrative control” exception is discussed participates in Medicare or Medicaid and is paid claims below. under those programs, receives any other type of federal funding, is tax-exempt, or maintains a Drug Enforcement In addition, a Part 2 program may disclose SUD infor- Agency registration. Nevertheless, a small class of mation without patient consent to a “qualified service providers that hold themselves out as providing SUD ser- organization” that provides services to that program.16 A vices do not qualify as federally assisted. For example, qualified service organization (QSO) is an individual or a private, for-profit SUD treatment center that does not entity that provides services to a Part 2 program “such as accept Medicare, Medicaid, or other federal funding may data processing, bill collecting, dosage preparation, lab- not be federally assisted and therefore may not be sub- oratory analyses, or legal, accounting, population health ject to regulation under Part 2. Thus, any clinic or practice management, medical staffing, or other professional ser- seeing Medicaid or Medicare patients (therefore, receiv- vices” and which has entered into an agreement with the ing federal funding for their care) would be subject to Part 2 program in which the QSO agrees, among other regulation under Part 2 if they met the first requirement things, to abide by the Part 2 restrictions.17 The QSO (identifying patients as having SUDs) and the second exception is an implicit acknowledgment of the real- requirement (hold themselves out as an SUD provider). ity that Part 2 programs cannot feasibly obtain patient consent to share SUD information with the range of contractors they must rely on to help administer their Limited Exceptions to Part 2 operations. Restrictions As noted earlier, the circumstances under which a Part 2 program may disclose SUD information without patient Consent Requirements consent are extremely limited under DAPTRA. The Part 2 Assuming no exception applies, a Part 2 program must regulations track the statute by allowing disclosures for obtain a patient’s consent before disclosing any of the purposes of child abuse reporting, responding to medi- patient’s SUD records. DAPTRA requires consent but says cal emergencies, conducting research, performing audit little about the form or content of the consent, stating evaluations, and pursuant to court orders.13 Like DAPTRA, only that it needs to be written. In contrast, the Part 2 the regulations do not apply to disclosures made within rules contain detailed specifications about what must the armed forces or from the Department of Veterans be included in the consent form. Among other things, Affairs.14 the form must include the patient’s name, a description of how much and what kind of information may be dis- As is the case under the statute, there is no Part 2 excep- closed, the purpose of the disclosure, and a date, event, tion that allows the sharing of SUD information for or condition upon which the consent will expire.18 treatment unrelated to a medical emergency. However, this does not mean a practitioner in a Part 2 program may Overcoming Data-Sharing Challenges in the Opioid Epidemic: Integrating Substance Use Disorder Treatment in Primary Care 7 In addition, the consent form typically must include the the document. This flexibility may provide opportunities name of the person or entity that is receiving the SUD for streamlining the process of obtaining a Part 2 consent. information (an exception to this rule included in the 2017 revisions to the regulations is discussed below).19 While a record must originate in a Part 2 program in order The Part 2 regulations do not define “entity” but the to be subject to Part 2, that does not mean Part 2 applies typical definition of this term is a distinct legal entity. only to records maintained by Part 2 programs. Instead, Accordingly, the more conservative course for a Part 2 the rules apply to any recipient of Part 2 information program is to name every legal entity that may receive that is made aware that the information being disclosed information on the form. Thus, if a community health cen- is subject to Part 2.20 As a result, an individual or entity ter has multiple sites that are all operated by the same that receives Part 2 information under a written consent legal entity then all of those sites can receive a patient’s must also be informed of its Part 2 obligations, which Part 2 information if the patient’s consent names that arise under the Part 2 redisclosure restriction. To facili- legal entity. In contrast, if the different sites are operated tate compliance with this requirement, the rules mandate by different affiliates of the same organization, then the that when Part 2 information is disclosed pursuant to the consent form may need to list those affiliates in order for patient’s consent, a written statement must be provided the patient’s information to be disclosed to each of those to the recipient together with the information. This writ- sites. This does not mean, however, that the form must ten statement — sometimes referred to as a redisclosure name every clinician employed by each legal entity; list- warning — informs the recipient that the records being ing the name of the entity is sufficient. provided are subject to Part 2 and that the recipient can- not redisclose those records unless permitted by Part 2.21 The seemingly simple requirement to name the recipient of the information, in fact, has become a barrier to infor- mation exchange. This is because a patient’s providers Recent Revisions to Part 2 may change frequently. When a patient is initially admit- After years without any substantive changes to the ted for treatment by a Part 2 program, the patient may Part 2 rules, SAMHSA modified the regulations in 2017 sign a consent authorizing the disclosure of information and again in early 2018. The revisions were intended to to the person or organization serving as the patient’s pri- account for the growth in health information technology. mary care physician. But the patient may switch primary In practice, however, the changes left the basic structure care physicians or organizations while receiving treatment of the Part 2 rules largely intact. at the Part 2 program, or the patient may begin receiv- ing services from a new psychologist or other specialist The most significant change to the Part 2 regulations is during that time. If the patient previously identified an that they no longer require the name of the specific infor- FQHC on a consent form, for example, and the patient mation recipient, whether that recipient is an individual begins seeing a new practitioner who works for that person or a legal entity, to be included on the consent FQHC, then the patient need not execute a new consent form in certain circumstances. Instead, a general des- form. However, if the patient begins receiving care from ignation — which could state, for instance, “all of the a practitioner that is not employed or contracted by that providers that provide me with treatment” — can be FQHC, then the patient would need to sign a new form. included in the form in limited situations. The use of a In other words, patients need to sign a new consent form general designation could minimize the type of problems every time they begin a relationship with a new treating associated with changes in a patient’s treating providers provider that is not an employee or contractor of a pro- that are discussed above. To take advantage of this pro- vider listed on a previously signed consent form. vision, however, the SUD information typically must be exchanged through an intermediary, such as “an entity While Part 2 requires significant specificity in the consent that facilitates the exchange of health information,” form, the rules do not mandate that the consent be a rather than directly between individual providers.22 If the stand-alone document. Thus, a Part 2 consent form may recipient is a health information exchange, for example, be combined with a broader consent for the disclosure of the exchange may receive and maintain the informa- other medical records or a general intake or registration tion without patient consent as a QSO of the disclosing form as long as all of the Part 2 elements are included in Part 2 program, and then redisclose the information in California Health Care Foundation 8 accordance with the general designation set forth in the clinical notes.24 Such a rule could pose a barrier to the consent to the exchange’s participants that have a treat- electronic exchange of SUD records, since the disclosing ing provider relationship with the patient.23 But the health party would need the technical ability to segregate its information exchange cannot redisclose the information records according to the wishes of its patients, a capac- to an individual or entity that lacks a treating provider ity that many electronic health records systems currently relationship. While the regulation does not define “an lack. The regulation itself, however, makes no reference entity that facilitates the exchange of health informa- to this type of checkbox requirement, and in discussing tion,” the notion seems to be that the entity should be the issue SAMHSA has been equivocal as to whether it separate and apart from individual providers, and that an believes a form with checkboxes is required. electronic health record system that is owned by a single provider organization would not fall within this definition. The January 2018 revisions to Part 2 are compara- tively minor. While they retain the requirement that a The revised regulations arguably create an odd result. If disclosing party provide a redisclosure warning to the a patient signs a consent form under which the patient information recipient, the text of that warning may now agrees to allow a Part 2 program to disclose their infor- be significantly shorter, as it is sufficient to state that “42 mation to “all of the providers that provide me with CFR Part  2 prohibits unauthorized disclosure of these treatment,” then the Part 2 program cannot disclose the records.”25 In addition, the 2018 revisions allow recipi- patient’s information directly to the patient’s primary care ents of Part 2 information to disclose that information to practice because that primary care practice has not been their “contractors, subcontractors, or legal representa- specifically named on the form and the primary care tives to carry out payment and/or health care operations” practice is not an “entity that facilitates the exchange of on their behalf. Thus, for example, if a patient signs a health information.” But the rules do allow disclosure to consent allowing a Part 2 program to disclose to the the primary care practice if the Part 2 program transmits patient’s health insurer, that insurer can now redisclose the information through a health information exchange in to a utilization management contractor for purposes of which the primary care practice participates. The policy determining whether the insurer should pay the Part 2 rationale for this distinction is not clear. program for services it provided, even if the consent form never identified such contractor. Although the definition In allowing the use of a general designation of informa- of “health care operations” under the Health Insurance tion recipients in limited circumstances, SAMHSA made it Portability and Accountability Act of 1996 (HIPAA) easier for entities to exchange SUD information through includes “case management and care coordination,” multistakeholder information exchanges and other inter- SAMHSA said in the preamble to the amended rule that mediaries. But the revised regulations also took a step the provision “is not intended to cover care coordination in the opposite direction, requiring all consent forms or case management.”26 This may reflect the belief that — whether using a specific or general designation of the new exception should not allow the sharing of Part 2 recipients — to meet a new requirement. While the previ- information for treatment purposes, as HIPAA also says ous version of the regulation mandated that the consent that care coordination undertaken by a provider can be form describe “how much and what kind of information considered treatment.27 Thus, if patients sign a consent is to be disclosed,” under the 2017 revision, the Part 2 allowing their information to be shared with a primary regulations now require “an explicit description of the care practice, that primary care practice cannot, in turn, substance use disorder information that may be dis- share that information with a contractor that assists the closed.” It is possible that SAMHSA simply intends that practice in coordinating the care of its patients.28 Again, the consent form must list different types of SUD informa- there is no clear explanation for the policy rationale tion that must be disclosed, such as treatment histories, behind this distinction. discharge summaries, and prescription drug records. But in the preamble to the regulation, SAMHSA discussed the possibility of consent forms including checkboxes next to categories of SUD information and allowing patients to select which categories may be disclosed, such as agreeing to the disclosure of SUD medications but not Overcoming Data-Sharing Challenges in the Opioid Epidemic: Integrating Substance Use Disorder Treatment in Primary Care 9 data sharing. Under Part 2, unless there is a medi- Relationship of Part 2 cal emergency, such information exchange is typically to HIPAA prohibited without patient consent. The basic policy assumption underlying HIPAA is that physicians, nurses, Part 2 is significantly stricter than HIPAA. HIPAA limits social workers, and other types of licensed health care the use and disclosure of “protected health information” professionals can be trusted to share a patient’s informa- (PHI), which is defined as health information created or tion with one another for health care–related purposes. received by a provider, health plan, employer, or health In contrast, the basic policy assumption underlying Part 2 care clearinghouse that can be used to identify an indi- is that SUD information is simply too stigmatizing to allow vidual.29 HIPAA restricts the sharing of PHI by covered for disclosure in the ordinary course of treatment without entities such as providers and health plans.30 Virtually all the patient’s consent. Part 2 programs are covered entities under HIPAA. HIPAA also differs from Part 2 with respect to its authoriza- HIPAA, like Part 2, treats PHI as confidential and prohib- tion requirements. The HIPAA authorization requirements its its disclosure absent patient authorization unless an contain many of the same elements as the Part 2 consent exception applies. But HIPAA differs substantially from requirements: Both require a description of the informa- Part 2 in that the HIPAA exceptions are much broader than tion to be disclosed, a description of the purpose of the those under Part 2. HIPAA allows for disclosure without disclosure, and the specification of an expiration date or patient consent for purposes of providing treatment to a expiration event, among other elements.33 But HIPAA patient, determining the amount of payment that should only requires the authorization form to identify the “class be made to a provider, or for “health care operations,” of persons” to whom disclosure may be made. In con- which include quality improvement and care coordination, trast, as discussed above, Part 2 typically requires the among other activities.31 There are some limitations to this name of the specific recipients. general rule. For example, psychotherapy notes cannot be exchanged under these exceptions, and PHI can be HIPAA and Part 2 are thus in significant tension. But exchanged to support the health care operations of the HIPAA does not displace more stringent federal laws. In recipient only if both the disclosing party and the recipient issuing the Privacy Rule in December 2000, the federal have a relationship with the person subject to the PHI.32 Department of Health and Human Services explained But, generally speaking, the treatment, payment, and that there was no conflict between Part 2 and HIPAA health care operations exceptions are fairly broad. “because these disclosures [under HIPAA] are permis- sive and not mandatory.”34 In other words, a provider can In short, under HIPAA, providers that care for the same comply with both HIPAA and Part 2 by abiding by the patient can share the patient’s records with one another rules of the stricter regulation, which for Part 2 programs regardless of whether the patient has authorized such will almost always be Part 2. Table 1. 42 CFR Part 2 and HIPAA: A Comparison of Key Provisions PART 2 HIPAA What types of providers does the law Federally assisted providers that hold themselves Virtually all health care providers apply to? out as providing SUD services Can a provider disclose PHI to another No, unless it’s a medical emergency Yes provider without patient consent for purposes of treatment? Can a provider disclose PHI without Yes, if the provider and contractor have entered Yes, if the provider and contractor patient consent to a contractor for into a qualified service organization agreement have entered into a business administrative purposes such as associate agreement assistance with billing? Does an authorization form need to Typically yes, although a general designation No list the name(s) of individuals and may be used when exchanging through certain legal entities that may receive the intermediaries patient’s information? California Health Care Foundation 10 Challenges Faced by California Privacy Laws California’s Confidentiality of Medical Informa- Primary Care Practices tion Act (CMIA) mirrors HIPAA in many respects. It applies to “medical information,” defined as “any That Treat SUD Disorders individually identifiable information, in electronic In many parts of the country, there are simply not enough or physical form, in possession of or derived from providers specializing in SUD care to meet the treatment a provider of health care, health care service plan, demand created by the opioid epidemic. As a result, pharmaceutical company, or contractor regarding a primary care practices — including private physician patient’s medical history, mental or physical condi- practices and freestanding clinics such as FQHCs — are tion, or treatment.”35 Similar to HIPAA, medical commonly providing care to people living with SUDs. information is treated as confidential, but there are broad exceptions permitting disclosure. The CMIA From the perspective of primary care practices, the state allows providers and health plans to disclose medi- and federal SUD confidentiality regulations can be quite cal information without patient consent for purposes confusing. On the one hand, those regulations are writ- of diagnosis or treatment.36 Thus, like HIPAA, CMIA allows two providers to exchange a patient’s records ten with licensed SUD facilities in mind, and therefore do if the exchange is related to treating the patient. not target primary care practices that include a modest scope of incidental SUD-related care within their service However, under Part 2, “no state law may either offerings. On the other hand, labeling oneself a “primary authorize or compel any disclosure prohibited by care practice” is not an automatic shield from Part 2 obli- the regulations in this part.”37 Thus, if both CMIA gations. This section analyzes Part 2 from the perspective and Part 2 are applicable, a provider must comply with the stricter requirements of Part 2. of primary care practices and addresses the practical challenges they face in obtaining medical information In addition to the CMIA, Section 11845.5 of the needed to treat patients with SUDs. California Health and Safety Code regulates the confidentiality of SUD information in the state. Section 11845.5 closely follows DAPTRA in that Applicability of Part 2 to Primary it declares confidential all records “maintained in connection with the performance of any alcohol Care Practices and other drug abuse treatment or prevention effort As noted above, SAMHSA characterizes primary care or function conducted, regulated, or directly or practices such as FQHCs as “general medical facilities.” indirectly assisted by the department.” There are Assuming that such practices are “federally assisted” — limited exceptions to Section 11845.5 that track for example, they are tax-exempt, participate in Medicare DAPTRA and Part 2: like the federal statute and or Medicaid, or receive other federal funds — such prac- regulation, Section 11845.5 allows for disclosures tices are subject to Part 2 if the practice as a whole, or without consent for medical emergencies, research, a unit within the practice, “holds itself out” as provid- audits, or program evaluation, and it also allows dis- ing SUD services (see Figure 3, page 12). The same rule closure without consent for communications within applies to individual clinicians: Assuming a clinician the same program. In fact, some portions of Section receives some form of federal assistance, that person 11845.5 mirror DAPTRA almost word for word.38 will be subject to Part 2 if they hold themselves out as There are no California regulations that interpret providing SUD services. The key question, then, is when Section 11845.5. Instead, the state’s SUD regulation a primary care practice crosses the line from incidental states that providers must abide by the privacy pro- SUD-related care to holding itself out as treating SUDs. tections set forth at 42 CFR Part 2.39 Thus, it appears that the state views state law as being coextensive SAMHSA has been clear that if a provider is licensed to with Part 2 and not imposing any restrictions that go provide SUD services, it is considered to “hold itself out” beyond what is required under federal law.40 as providing SUD care. Thus, if a primary care practice is licensed by a state as a detoxification facility, an SUD out- patient program, or other specialized SUD provider, it will be subject to Part 2, except in the rare case when it is not “federally assisted.” If a practice operates an SUD unit Overcoming Data-Sharing Challenges in the Opioid Epidemic: Integrating Substance Use Disorder Treatment in Primary Care 11 with a specialized license and a separate primary care Notably, SAMHSA has taken the position that individual unit, then the SUD unit is subject to Part 2 but the primary clinicians with a waiver to prescribe or dispense buprenor- care unit is not. This is the case regardless of whether the phine and certain other controlled substances under the two units are located at the same or different sites. Drug Addiction Treatment Act of 2000 (DATA 2000) do Figure 3. Is Your Program Subject to Part 2? 1 Does the program provide SUD care in the US? 4 Does the program have an SUD license from a state? Yes No NOT a Part 2 Program Yes No IS a Part 2 Program 2 Is the program operated by the Department of Veterans Affairs? 5 Does the program take any other steps to “hold itself out” as an SUD provider?† Yes No NOT a Part 2 Program Yes No IS a NOT a 3 Part 2 Program Part 2 Program Is the program federally assisted?* * program is federally assisted if, for example, it is (a) a A nonprofit; (b) operated by a federal agency; (c) licensed or authorized by a federal agency; (d) participates in Medicare, Yes No M edicaid, or any other federally funded health insurance p rogram; or (e) receives any federal funding. † NOT a uch steps could include advertising SUD services and S Part 2 Program displaying signs publicizing SUD care. California Health Care Foundation 12 not necessarily hold themselves out as providing SUD an SUD. Thus, any records that relate to treatment of any care.41 In other words, SAMHSA does not view a clinician condition that is not an SUD — whether for treatment of with a DATA 2000 waiver as being licensed to provide schizophrenia or the common cold — would not be sub- SUD care. This does not mean that such clinicians are not ject to Part 2 so long as the records themselves did not subject to Part 2; instead, SAMHSA has said the analysis make any reference to the patient having an SUD. is “fact-specific.”42 Similarly, a primary care practice is not subject to Part 2 merely because it employs a clinician Further, even some records that do reference a patient with a DATA 2000 waiver. having an SUD may not be subject to Part 2. If a “general medical facility” has a unit that holds itself out as provid- Part 2 regulations and SAMHSA guidance do not pro- ing SUD care, but all other units of the facility do not vide great clarity as to when a provider crosses the line provide such services, then only the SUD unit is subject of “holding itself out” as an SUD provider, and therefore to Part 2. For example, if a primary care practice owns primary care practices can make reasonable judgments three clinic locations, one of which is licensed by the state as to what activities can be undertaken without implicat- to provide SUD services and the others are not, only the ing Part 2. Assuming a primary care practice does not location licensed to provide SUD services would be sub- maintain a specialty SUD license from the state, the ject to Part 2. If a physician in one of the other locations application of Part 2 will largely depend on the practice’s dispensed buprenorphine to patients but the practice efforts to publicize the fact that it provides SUD services.43 did not advertise the availability of SUD treatment, the If a primary care practice includes references to SUD ser- records associated with that activity would not be subject vices in mass media advertising, displays brochures that to Part 2, even though another location owned by the describe the availability of SUD care from such practice, same entity would be governed by the regulations. or posts signs on-site announcing the availability of SUD diagnosis or treatment, the practice arguably is “hold- From the primary care practice’s perspective, there is, ing itself out” as providing SUD care. For example, in however, a downside to this rule. A practitioner working recent guidance SAMHSA said that a physician working in a Part 2 program may share Part 2 information with at a mental health center who is identified as the facil- other personnel in that program without the patient’s ity’s lead SUD physician and primarily treats patients with consent, but generally cannot do so outside the pro- SUDs does hold herself out as an SUD provider.44 On the gram. To take the previous example, a counselor working other hand, it is unlikely that a practice will be deemed at the site licensed as an SUD program could discuss a to be “holding itself out” as providing SUD services if the patient’s case with another clinician at that same loca- practice conducts routine screenings for SUD conditions tion if necessary to provide treatment. But absent patient and informs a patient of the availability of counseling consent, the counselor could not contact the patient’s pri- after a screening shows the patient has an SUD. SAMHSA mary care physician working at a separate site to discuss said in that same guidance that a physician who has a the patient’s SUD treatment, even though the counselor DATA 2000 waiver but “occasionally” treats patients with and primary care physician are employed by the same an opioid dependency is not subject to Part 2. organization. The Part 2 rules do allow for communications without con- Segregating Part 2 Records sent between Part 2 programs and entities with “direct While in some cases primary care practices will not be administrative control” over such programs. However, subject to the restrictions of Part 2, in other cases they SAMHSA has stated in guidance that “patient informa- will be. Where Part 2 is applicable, Part 2 providers need tion may not be exchanged among all of the programs to determine how to maintain their medical records in and personnel that fall under the umbrella of the entity compliance. that has administrative control over the Part 2 program.”45 SAMHSA views this exception as only allowing for shar- The fact that a primary care practice is subject to Part 2 ing of information for administrative purposes relating to does not automatically mean that all of the practice’s med- the operation of the Part 2 program, such as submitting ical records are governed by Part 2. Part 2 only applies to bills; the exception does not cover disclosures to clini- records that identify a person as having, or having had, cians outside the Part 2 program for treatment purposes. Overcoming Data-Sharing Challenges in the Opioid Epidemic: Integrating Substance Use Disorder Treatment in Primary Care 13 Thus, in practice a primary care practice that has a unit component of their operations from being character- that is subject to Part 2 and separate units that are not ized as a Part 2 program. These steps include referring governed by the regulations must take steps to ensure to certain staff members as “behavioral health counsel- that the Part 2 unit does not share SUD records with the ors” rather than “substance use disorder counselors.” other units without patient consent. SAMHSA has said: One primary care practice indicated that its staff wanted to do more outreach to appropriate patients regarding In order for a program in a general medical care facil- the availability of SUD services, but they have not done ity to share information with other parts or units within so out of concern that this activity could cause the prac- the general medical care facility, administrative con- tice to become subject to Part 2. Instead, that practice trols must be in place to protect Part 2 information if said that discussions about SUD services occur only on it is shared.46 a patient-by-patient basis, not through ads or brochures. If a practitioner has concerns about a patient’s overuse SAMHSA has not provided detailed guidance on what of opioids, for example, then the practitioner will recom- these administrative controls should be. In the case of mend a MAT program.47 physical records, it may be sufficient to keep the SUD records in separately marked cabinets and inform non– In contrast, some primary care practices have accepted Part 2 personnel that those records cannot be accessed the fact that some of their facilities are subject to Part 2. without patient consent. In the case of electronic health These primary care practices therefore segregate Part 2 records, a firewall can be used that prevents non–Part 2 records from other health records. For example, one pri- personnel from accessing Part 2 records without consent. mary care practice operates a detoxification facility that However, there may be alternatives to a firewall, such as is licensed by the state as an SUD provider. The practice other access controls set forth in policies and procedures noted that it had created an EHR system in which Part 2 under which staff are trained about the legal restrictions, records are segregated from other medical records. The and SUD records are audited on a regular basis to ensure Part 2 records can only be accessed if the individual seek- that they have not been accessed inappropriately. ing the record certifies that such individual is part of the patient’s treatment team and has the right to review the record. Moreover, staff are instructed to check in the EHR Experiences of Primary Care system to make sure an authorization has been signed by Practices with Part 2 Compliance the patient before seeking to access that record. Another Preparing this paper involved speaking with primary care primary care practice that operates a separate SUD facil- practices in California, Connecticut, and Oregon that ity uses a different EHR system for its primary care sites provide SUD services to better understand how they than for its SUD site. seek to comply with Part 2 in practice. Also interviewed was a primary care trade association that has been work- Primary care practices that operate Part 2 programs seek ing with its members on this issue, as well as a provider to implement protocols to ensure that patient consents that operates specialized SUD facilities in states through- meet Part 2 requirements but sometimes face barriers in out the country and aims to coordinate care with primary doing so. One primary care practice with multiple sites care practices. specifically lists all of its locations on its model consent form, so if the patient agrees to sign that consent, any Primary care practices take different approaches to man- practitioner who is providing care to the patient at any of aging SUD data. A threshold issue for these practices is those sites can view the patient’s record. In contrast, one whether they conclude that Part 2 applies to their deliv- FQHC said the local county requires behavioral health ery of SUD services or instead deliver such services in a providers to use a county-provided health form and does manner that keeps them outside the scope of Part 2 reg- not allow revisions to that form. That FQHC said they ulation. Since these practices are all “federally assisted,” were unsure if county rules allowed one consent form to in order to avoid Part 2 compliance obligations, they can- be used to cover both its primary care sites and its behav- not “hold themselves out” as providing SUD care. ioral health sites, so it operated under the assumption that separate consent forms were needed. This interpre- The primary care association noted that some of its tation may create barriers to accessing SUD records in members have taken a variety of steps to prevent any some cases. California Health Care Foundation 14 Another primary care practice that is subject to Part 2 some if its primary care physicians had grown frustrated said it attempted to address the limitations of Part 2 by with their inability to obtain SUD medication records to putting more data in the hands of its patients. The prac- determine which of their patients were struggling with tice invested the resources to develop a patient portal addiction, and worried that if they prescribed benzodi- that contains physical health, mental health, and SUD azepines — anti-anxiety drugs such as Xanax that have records. By giving patients direct access to their own addictive properties — that those drugs would be abused health information, the practice found that they were by their patients, and they would be labeled as “candy- helping promote sharing with other providers, since man” doctors. As a reaction, these physicians refused to patients would sometimes print out their SUD records prescribe benzodiazepines, telling patients they would and share them with other treating providers. have to obtain such prescriptions from behavioral health providers. Regardless of whether a primary care practice is subject to Part 2, such practices often seek to obtain informa- The primary care practices interviewed did not view the tion from unaffiliated Part 2 programs. The primary care opioid epidemic as having caused a change in data- practices interviewed noted that it was still fairly rare for sharing practices. Instead, they see the opioid epidemic specialized SUD practices that are not affiliated with the as heightening the importance of striking the right bal- primary care practice to seek consent from patients to ance between sharing SUD information and protecting allow the specialized SUD provider to share information patient privacy. The primary care association noted that, with the primary care practice. One primary care practice in response to the epidemic, there has been an influx of noted that a specialized SUD provider that was located new SUD treatment programs offered in the primary care across the street from its facility would sometimes ask setting, such as MAT programs. patients if they would consent to share their records with the primary care practice, since there was a significant The specialized SUD provider interviewed had a different overlap in the patients who were treated by both provid- perspective. That provider, which operates methadone ers. But this primary care practice noted that this level clinics and outpatient detoxification programs through- of cooperation was the exception, not the rule. Similarly, out the country, acknowledged that primary care practices one FQHC indicated that some of its patients received often express concerns about not having access to treat- care at a residential SUD program, and that the FQHC ment records from the SUD provider’s facilities. This sometimes sought information from that program in provider noted that the concern was often raised in the order to coordinate the patient’s care. But the residen- context of benzodiazepines, since a primary care clinician tial program was underfunded, understaffed, and lacked would want to make sure that his or her patients were not an electronic health records system; moreover, it did not taking a benzodiazepine and an opioid at the same time. have a standing process for asking patients for consent However, in the SUD provider’s view, the high stigma and to share information with other treating providers. As potential criminal penalties that people with SUDs can a result, the FQHC and the residential program spent face justify the need for more stringent SUD privacy rules. substantial time faxing information back and forth in an The provider noted that many of its patients do fear that attempt to obtain the patient’s consent. The FQHC noted their records may be wrongly shared with criminal justice that this was a time-consuming process, and the staff at agencies, an employer, or a family member, and that they the residential center simply did not have the capacity to appreciated the strict confidentiality requirements of the ask for patient consent on a routine basis. rules. The SUD provider said that it does not typically list a patient’s other treatment providers on the consent One primary care practice observed that fear about non- form. The provider also noted that not all data-sharing compliance with Part 2 rules often leads practitioners problems stemmed from the privacy rules: Since SUD to change their practices in ways that negatively affect programs were excluded from meaningful use funding, patient care. That practice explained that even though they often lacked EHR infrastructure, making it more diffi- the organization had determined that the provision of cult for them to share records electronically even in cases MAT at certain locations did not make those locations where there is consent. subject to Part 2, some social workers at those facilities were not sure, and were reluctant to share SUD screen- ing results with colleagues. That practice also said that Overcoming Data-Sharing Challenges in the Opioid Epidemic: Integrating Substance Use Disorder Treatment in Primary Care 15 Information Exchange Under New SUD Funding Models in California In the past several years, California has revised the Both the DMC-ODS and the California Hub & Spoke funding model for SUD services for its low-income resi- System rely on models where Part 2 providers need dents in two important respects. First, California’s 1115 to share Part 2 information with other entities. Under waiver — known as the California Medi-Cal 2020 waiver the DMC-ODS, it is the certified SUD providers that — is redesigning the delivery system for SUD services will share Part 2 information with the counties (which under Medicaid. Second, through the 21st Century operate as managed care plans), which in turn may Cures Act, California is receiving $90 million in federal redisclose that information to other county-contracted funding to implement the Medication Assisted Treat- providers who can provide SUD patients with additional ment Expansion Project, which targets the uninsured, services. Under the California Hub & Spoke System, the from 2017 to 2019. Both of these models assume hubs — federally assisted, licensed opioid treatment increased coordination among different provider enti- providers — are expected to share information directly ties treating patients with SUDs, and therefore Part 2 with the spokes, which, as primary care practices, often poses a potential challenge to their implementation. will not be subject to Part 2. Under the California Medi-Cal 2020 waiver, the state The underlying Part 2 compliance challenge for both has established the Drug Medi-Cal Organized Delivery models is the same. Information held by a Part 2 pro- System (DMC-ODS). In the DMC-ODS, counties have gram is to be used in part as the basis for providing a an option of implementing a pilot program under which suite of services to a patient. Since there is no excep- the county is responsible for the delivery of Medi-Cal tion to Part 2 that would allow for such data sharing, SUD services, that is, a system where the county plays the Part 2 program must obtain a patient’s consent, and the role as a managed care contractor responsible such consent must specifically name the information for SUD services. Under the waiver, the counties may recipients. It is therefore important for all providers to provide certain SUD services not available under the coordinate with the applicable Part 2 providers about Medi-Cal state plan. The waiver emphasizes increasing the language in the consent form. In the case of DMC- coordination between the SUD providers and primary ODS, this means that counties could provide to Part care practices. Under the terms of the waiver, SUD 2 programs the names of the primary care practices providers “will regularly communicate with physicians or clinics that typically treat those patients so that the of clients who are prescribed these medications unless Part 2 programs could include the names of those orga- the client refuses to consent to sign a 42 CFR Part 2 nizations on the consent form they provide to patients. compliant release of information for this purpose.”48 In the case of the California Hub & Spoke System, this The waiver requires counties to coordinate care to would mean that the hubs would need to include the ensure that Medi-Cal beneficiaries successfully transi- names of their applicable spokes on their forms. tion between different levels of SUD care and between By proactively identifying which providers might need specialized SUD care and physical health care. to receive a patient’s information under these models, One of the main components of the Medication Part 2 programs, working with counties and the state, Assisted Treatment Expansion Project is the California can facilitate information exchange that complies with Hub & Spoke System. Under this system, “hubs” are Part 2. In conversation with the Department of Health narcotic treatment programs, which are providers that Care Services, state officials said Part 2 programs were specialize in SUD services and dispense methadone. making efforts to use consent forms that named other The “spokes” are typically primary care practices that providers. However, given that specialized SUD provid- employ physicians who have a waiver to prescribe ers historically have not included the names of their buprenorphine; these physicians may practice inde- patient’s primary care practices on consent forms, it pendently, be part of a larger physician practice, or be may be a challenge to change this practice in a short part of an FQHC. Under the model, patients with more time period. complex needs or severe addictions are treated by the hubs, while patients with milder addictions — or those who are treated and then stabilized by the hubs — can be managed in primary care spokes. The model creates formal relationships between hubs and spokes so that they make referrals to one another as appropriate.49 California Health Care Foundation 16 Strategies for Sharing offers mental health services may decide that Part 2 Information SUDs are so commonly interrelated with mental health problems that the clinic must make it widely As the opioid epidemic demands greater treatment known that it treats both types of behavioral resources from primary care practices, many of these health conditions, even though this action will practices view the requirements of 42 CFR Part 2 as a trigger the need for Part 2 compliance. In contrast, significant obstacle. Some practices wish to see a funda- a primary care practice that has little or no mental mental change to federal law that allows specialized SUD health treatment capacity may conclude that SUD providers to share Part 2 information with primary care care is less integral to its practice, and therefore practices for treatment purposes without patient consent. the cost of Part 2 compliance outweighs the ben- But even if such legal changes are not forthcoming in the efit of promoting SUD services. near future, there are still steps that primary care prac- $$ The composition of the primary care prac- tices can take to improve clinical information exchange tice’s patient population. Primary care practices without running afoul of Part 2. Based on discussions with located in areas that have been hardest hit by the primary care practices and their representatives, several opioid epidemic may feel an obligation to make potential strategies are identified below. the availability of SUD treatment services widely known in the community. Practices that serve a Structuring Operations to Avoid large number of low-income patients, who tend to experience a higher rate of opioid addiction and Part 2 Applicability other SUDs, may reach the same conclusion. In For primary care practices that offer limited SUD services, these cases, practices are more likely to determine such as addiction counseling or MAT that do not require that the percentage of their patients likely to need a specialized SUD license, the applicability of Part  2 is SUD treatment is too high to avoid the type of likely to depend on the extent to which the practice robust SUD service offering that will trigger Part 2 publicizes the fact that it provides SUD services. Primary regulation. care practices must weigh the benefits and drawbacks $$ The availability of other SUD resources in the of structuring their operations to keep them outside the scope of Part 2 regulation. On the one hand, by limit- community. Primary care practices may feel com- ing efforts to publicize the provision of SUD services, a pelled to aggressively advertise the availability of primary care practice may avoid the Part 2 requirements SUD services if there is limited or no specialized and may share all medical records for treatment pur- SUD treatment capacity in the local community. poses without patient consent. The burden of managing They may conclude that the community need is a patient consent process and segregating the records too great to ignore, even if such advertising results of different units is eliminated. On the other hand, limit- in Part 2 compliance obligations. In contrast, if ing the range of and communication about SUD services there is an adequate specialized SUD treatment may undermine optimal patient care, especially as a system in the area, primary care practices may growing share of the population served by certain pri- decide that a more limited and subtle role in the mary care practices struggles with opioid addiction, and provision of SUD-related services strikes the right an important public health purpose is served by aggres- balance. sively informing the public about which providers are able to treat addiction. Development of Flexible EHR Infrastructure The outcome of this cost-benefit analysis may depend on If a primary care practice is subject to Part 2, the practice several factors: can simplify Part 2 compliance by investing in an EHR $$ The nature of the primary care practice’s ser- infrastructure that facilitates the segregation of Part 2 vices. The type of services offered by a primary records. If a program’s Part 2 electronic health records care practice may influence the decision about are maintained separately from other medical records, whether the availability of SUD treatment should there is a technical foundation for restricting practitioners be openly promoted. For example, a clinic that working outside the Part 2 program from accessing SUD Overcoming Data-Sharing Challenges in the Opioid Epidemic: Integrating Substance Use Disorder Treatment in Primary Care 17 information, even if the practitioner is employed by the multiple primary care locations through different legal same legal entity that operates the Part 2 program. entities, the practice can list all of the locations on the consent form to ensure data exchange in the event of Once SUD records are segregated, there are different changes in a patient’s site of care. Similarly, if the practice options for achieving Part 2 compliance, including the contracts with a separate organization to provide care following: management to its patients, the practice should include the name of that care management organization on the $$ The EHR could be designed to block access to practice’s consent forms. A Part 2 program may also find SUD records through access controls that permit it useful to include the names of unaffiliated local pro- login to the Part 2 program component of the vider organizations frequently treating its patients on the system only by employees whose user IDs are consent form. There is no legal obstacle to being overin- associated with that program. clusive on the consent form. $$ The EHR could couple the type of access controls described above with a mechanism that allows a In addition, as discussed above, a Part 2 consent form user to open up access to a patient’s SUD records can be integrated into a more comprehensive document, if the user certifies that patient consent has been such as an intake or registration form, or a consent for the obtained. Alternatively, access to Part 2 records disclosure of all medical records. The Part 2 rules do not could be facilitated by intake staff, who change mandate the use of a stand-alone consent. By integrating consent values in the EHR when a patient provides a Part 2 consent into a broader document that is part of consent as part of the registration process. the provider’s existing workflow, the administrative bur- den of obtaining consent can be minimized. $$ In lieu of technical access controls, a primary care practice could develop policies and procedures prohibiting staff from accessing Part 2 records Proper Training and Education without patient consent. System users would be There are likely to be benefits in training staff on the key trained in compliance with these restrictions and Part 2 requirements. Staff at non–Part 2 practices may warned about the consequences of improper mistakenly believe that their practice is subject to Part 2, access. The practice could conduct periodic or they may otherwise view Part 2 as applying more system audits to verify that users accessing Part 2 expansively than it actually does. Explaining to staff the records were either performing services for the limits of Part 2 may make practitioners more willing to Part 2 program or had obtained patient consent. share information in ways that could help improve treat- ment and care coordination without violating state and As an alternative to data segregation within a single EHR, federal law. And where a primary care practice is subject practices can use an entirely separate EHR for their Part 2 to Part 2, such training will help reduce the likelihood that program or maintain Part 2 records separately on paper. staff violate the law. Indeed, these approaches are being utilized by several of the interviewed practices. But each of these options There may also be a need for primary care practices, is likely to impede information sharing between primary trade associations, and state or local government agen- care and SUD providers even when there is patient con- cies to facilitate community-wide education on Part 2 sent, and thereby undermine effective care coordination. requirements. Misunderstandings about the scope of Part 2 and the required elements of a Part 2 consent may impede data sharing even when it is legally permissible. Effective Use of Consent Forms Establishing a common understanding in the commu- If a primary care practice is subject to Part 2, it is impor- nity, especially about the validity of consent forms being tant for that practice to develop a process for obtaining used by various providers, may minimize the undue cau- consent that not only complies with Part 2 but also mini- tion some stakeholders exercise when they contemplate mizes the need to obtain multiple consents from the sharing SUD information. Government agencies can be same patient. A primary care practice should carefully particularly important in creating a shared community- determine which entities are listed as information recipi- wide understanding of Part 2 rules. ents on its model consent form. If the practice operates California Health Care Foundation 18 Obtaining Information from Local strict if Part 2 information is shared through a Specialized SUD Programs health information exchange or other interme- diary, rather than directly between providers. Even if a primary care practice does provide SUD ser- In particular, consent forms that list a class of vices, it is likely that some of the practice’s patients with information recipients (such as “all my treating opioid addictions will be receiving care from specialized providers”) comply with Part 2 when SUD informa- SUD providers. In such cases, primary care practices will tion is shared through an intermediary. Reliance be relying on information from these specialized SUD on this type of consent eliminates the need to providers. Specialized SUD providers may be reluctant to anticipate in advance which specific treating provide such information for multiple reasons. Doing so providers may later require access to SUD infor- would require them to revise their consent forms, which mation. In addition, health information exchanges would entail additional time and resources. Moreover, may already have a patient’s consent on file that some SUD providers may not want to share information would allow a primary care practice to obtain even if allowed under the law, as they may worry that a patient’s Part 2 information. By joining such a primary care practices will not do enough to protect the health information exchange, the primary care privacy of their own patients. practice may be able to access such information. If no such exchange exists, a primary care practice There are, however, actions that primary care practices could work with other providers in the region to can take to increase the likelihood that information can create one. be obtained from specialized SUD providers: $$ Build relationships. There is no requirement that Many of the strategies discussed above require a certain a Part 2 program include the name of another level of cooperation among multiple organizations or provider on its model consent form. But if SUD even the entire community of stakeholders. As a result, programs know the local primary care prac- trade associations and local and state government agen- tices and understand how those practices may cies have an especially critical role to play in supporting use Part 2 information, the SUD programs may these solutions. develop more trust in their potential partners and therefore may be more willing to use consent forms that name these other providers. Putting Data in Patients’ Hands Developing a patient portal can be an expensive $$ Obtain consent on behalf of Part 2 programs. undertaking for small primary care practices without dis- The Part 2 rules do not dictate who must obtain cretionary funds. But for practices with the resources to consent from a patient, nor do they require the operate a patient portal, developing such a site may be consent form to identify the source of the Part 2 worth the costs. Patients may be more likely to actively information by name. Therefore, if a primary care participate in their own care if they have access to their practice knows that one of its patients was obtain- own health care records. Moreover, giving patients ready ing care from a specialized SUD program and if access to their own records may support information the practice believes information from that spe- sharing with other providers. Even if a Part 2 program cialized SUD provider is relevant to the primary neglects to include the name of a specific provider as care practice’s treatment, the primary care practice a potential information recipient on a consent form, can contact the specialized SUD provider, provide patients receiving care from that provider can decide to a copy of the signed consent form, and ask for share records on their own if the Part 2 program oper- the patient’s Part 2 information. To avoid disputes ates a patient portal and the patients have a computer about the adequacy of the consent form, the or phone that allows access to the portal. There are no primary care practice can share a copy with local restrictions on how patients can choose to share their SUD providers in advance to obtain their sign-off. own information. $$ Use a health information exchange. Due to a quirk in the latest version of the Part 2 rules, the Part 2 authorization form requirements are less Overcoming Data-Sharing Challenges in the Opioid Epidemic: Integrating Substance Use Disorder Treatment in Primary Care 19 Further Amendments to employees, even though they serve as a bridge between SUD treatment and primary care. By Part 2 allowing care coordinators and case managers who facilitate SUD patients’ access to, but do not In its recent rulemakings, SAMHSA has signaled that directly deliver, primary medical care, the regula- it has little interest in fundamentally altering the Part 2 tions could promote the integration of health care regulatory framework, and that any such overhaul of the services. regulation would require legislative change, which seems unlikely. But there are still modest revisions that SAMHSA $$ Clarify that Part 2 consents are not required could make to Part 2 that, without altering the rule’s basic to include a series of checkboxes that allow requirements, would ease the burden on providers seek- patients to select which types of information ing to share SUD records for treatment purposes. A few may be disclosed. SAMHSA has created confu- of these potential amendments to Part 2 include the sion by suggesting in the preamble to a recent following: regulatory amendment that this type of “check- box” approach is necessary, even though it is not $$ Broaden the right of providers to include a mentioned in the regulations themselves. The class of data recipients on the consent form. As checkbox is infeasible, especially when Part 2 discussed above, a general designation of data records are transmitted electronically through mul- recipients is sufficient under Part 2 only if informa- tiprovider exchanges. SAMHSA could eliminate tion is shared through an intermediary such as uncertainty that may be hampering data sharing an electronic data exchange. The rationale for by clarifying that the checkbox is not required. this limitation is unclear. This flexibility could be extended to direct disclosures between providers for treatment purposes. By using consent forms that permit disclosure to a class such as “all of my treating providers,” a Part 2 program can avoid the often insurmountable burden of obtaining a new consent whenever the patient commences a relationship with a new provider. $$ Extend the definition of a QSO to include care coordination and case management. Some primary care organizations that operate Part 2 programs employ care coordinators and case managers who work with a variety of patients who have complex needs, including those with SUDs. Due to their broad responsibilities, these employ- ees may be part of the primary care component of the organization rather than its Part 2 compo- nent. As a result, patient consent is required for the Part 2 unit to share information with these California Health Care Foundation 20 Endnotes 1.Throughout this paper, the term “primary care practice” refers 22.42 CFR § 2.31(a)(4)(iii)(B). to organizations that provide primary care services — such 23.42 CFR § 2.31(a)(4)(iii)(B)(3). as Federally Qualified Health Centers, clinics, and private physician practices — and their staff. 24.82 Fed. Reg. 6052, 6086 (January 18, 2017). 2.Drug Overdose Deaths in the United States, 1999 – 2016,   25.83 Fed. Reg. 239, 251 (January 3, 2018). Centers for Disease Control and Prevention, December 2017, 26.45 CFR § 164.501; 83 Fed. Reg. 239, 243 www.cdc.gov. (January 3, 2018). 3.The Drug Abuse Prevention, Treatment and Rehabilitation 27.45 CFR § 164.501. Act of 1979, Pub. L. No. 96 – 181, 93 Stat. 1309. The law was initially titled the “Drug Abuse Office and Treatment Act” 28.If the care managers were employees of a primary care but was renamed in 1980. practice, then the practice could disclose Part 2 information to these care managers, because the patient’s consent allows 4.42 United States Code (USC) § 290dd – 2(a). the sharing of Part 2 information with employees of the entity 5.42 USC § 290dd – 2(b)(2). named on the consent. Similarly, if the primary care practice contracted with individuals to provide care management 6.42 USC § 290dd – 2(e). These are the only exceptions listed in services (i.e., issued those individuals IRS 1099 forms), then DAPTRA. As discussed below, the Part 2 regulations include arguably the consent form would apply to those care managers additional exceptions. Under certain circumstances, Part 2 as well. However, if the care managers instead were employed also allows for disclosure without consent for communications by a separate organization, then the care managers could within a Part 2 program or with an entity having direct not receive Part 2 information unless their employer was also administrative control over the program, to qualified service named on the consent form. organizations, and to law enforcement to report crimes occurring on the premises of a program. 42 CFR § 2.12(c)(3), 29.45 CFR § 160.103. (4), (5). 30.Ibid. Technically, HIPAA does not apply to all providers, 7.37 Fed. Reg. 24636, 24636 (November 17, 1972). but only those providers that engage in certain electronic transactions with health plans. A very small number of 8.42 CFR § 2.12(a)(1)(i). providers that accept patients only on a private pay basis 9.42 CFR § 2.12(a)(1)(ii). and do not submit claims to health insurers, therefore, are not subject to HIPAA. 10.82 Fed. Reg. 6052, 6065 (January 18, 2017); see also 42 CFR § 2.11. 31.45 CFR §§ 164.501, 164.506(c). 11.82 Fed. Reg. 6052, 6066 (January 18, 2017). 32.45 CFR §§ 164.506(c)(4), 164.508(a)(2). 12.Ibid. 33.45 CFR § 164.508(c). 13.42 CFR §§ 2.12(c)(6), 2.51, 2.52, 2.53, and 2.61. 34.65 Fed. Reg. 82461, 82482 (December 28, 2000). 14.42 CFR § 2.12(c)(1), (2). Department of Veteran Affairs 35.California Civil Code § 56.05(j). (VA) facilities are treated somewhat differently than facilities 36.California Civil Code § 56.10(c)(1). operated by the military. VA records are exempted from Part 2 entirely. In contrast, SUD records maintained by the Armed 37.42 CFR § 2.20. Forces may be subject to Part 2, but disclosures within the 38.Compare California Health and Safety Code § 11845.5(b)(3) Armed Forces or from the Armed Forces to a VA facility are (allowing for disclosure without consent to “qualified personnel not subject to Part 2. In effect, military health care facilities for the purpose of conducting scientific research, management are Part 2 programs, but the facilities only need to comply audits, financial and compliance audits, or program evaluation, with Part 2 to the extent they are disclosing Part 2 information but the personnel may not identify, directly or indirectly, any outside the Armed Forces or VA. individual client in any report of the research, audit, or 15.42 CFR § 2.12(c)(3). evaluation, or otherwise disclose patient identities in any manner”) with 42 USC § 290dd – 2(b)(2)(B) (allowing for disclosure 16.42 CFR § 2.12(c)(4). without consent to “qualified personnel for the purpose of 17.42 CFR § 2.11. conducting scientific research, management audits, financial audits, or program evaluation, but such personnel 18.42 CFR § 2.31(a). may not identify, directly or indirectly, any individual patient in 19.42 CFR § 2.31(a)(4). any report of such research, audit, or evaluation, or otherwise disclose patient identities in any manner”). 20.42 CFR § 2.12 (d)(2)(i)(C). 21.42 CFR § 2.32. Overcoming Data-Sharing Challenges in the Opioid Epidemic: Integrating Substance Use Disorder Treatment in Primary Care 21 39.California Code of Regulations, Title 9, §§ 9866(c), 10155(a), 10568(c), 10569(a)(1), 11036. 40.Section 11845.5 regulates an “alcohol and other drug abuse treatment or prevention effort or function.” While that term is not defined, a provision in the statute does define “an alcohol and other drug abuse program” to include “free clinics” — which include FQHCs — “that are established for the purpose, either in whole or in part, of providing any medical or dental care, social services, or treatment, or referral to these services for those persons recognized as having a problem of narcotics addiction or drug abuse.” California Health and Safety Code § 11842.5(d). In other words, the state could claim that certain FQHCs are formed “in part” to provide SUD care and therefore are subject to Section 11845.5 even if such FQHCs do not hold themselves out as providing SUD care. 41.82 Fed. Reg. 6052, 6066 (January 18, 2017). Although the Drug Addiction Treatment Act of 2000 allowed only physicians to prescribe and dispense buprenorphine, the Comprehensive Addiction and Recovery Act of 2016 allows nurse practitioners and physician assistants to prescribe or dispense buprenorphine from July 22, 2016, to October 1, 2021. 21 USC § 823(g)(2). 42.82 Fed. Reg. 6052, 6066 (January 18, 2017). 43.Ibid. 44.Disclosure of Substance Use Disorder Patient Records: Does Part 2 Apply to Me?, Substance Abuse and Mental Health Services Administration, www.samhsa.gov (PDF). 45.H. Westley Clark, Applying the Substance Abuse Confidentiality Regulations to Behavioral Health Primary Care Providers, Substance Abuse and Mental Health Services Administration, www.integration.samhsa.gov (download PPT). 46.“Applying the Substance Abuse Confidentiality Regulations,” Substance Abuse and Mental Health Services Administration, last modified May 1, 2018, www.samhsa.gov. 47.Medication-assisted treatment is the combination of counseling and the prescription of a substance such as buprenorphine intended to help the patient reduce or cease the use of opioids. 48.“152. Coordination with DMC-ODS Providers,” in California Medi-Cal 2020 Demonstration, Centers for Medicare & Medicaid Services, last modified April 5, 2018, www.medicaid.gov (PDF). 49.CA Hub and Spoke System (CA H&SS) Overview, California Department of Health Care Services (DHCS), www.dhcs.ca.gov (PDF); CA Hub and Spoke Awards, DHCS, July 19, 2017, www.dhcs.ca.gov (PDF). California Health Care Foundation 22