On Friday, the Secretary of the Department of Health and Human Services (HHS) Sylvia Burwell announced proposed revisions to the rules governing the privacy of medical records for patients with histories of substance abuse.
The proposed changes seek to facilitate exchanges of health information while addressing privacy concerns for patients seeking treatment for substance abuse. The proposed changes are specific to the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, 42 CFR Part 2.
The Confidentiality of Alcohol and Drug Abuse Patient Records regulations provide more stringent federal protections for patients with substance use disorders records than most other health privacy laws, including HIPAA, according to HHS. Those regulations haven’t been updated since 1987.
The proposed changes "would maintain the requirement that patient consent be obtained prior to disclosing or exchanging medical records that would identify, directly or indirectly, an individual who has been diagnosed or treated for a substance-abuse disorder," reported Modern Healthcare. The change occurs where the rule would allow, without consent, "other health-related information shared by the Part 2 program to be disclosed...if permissible, under other applicable laws.”
The change, as quoted by Jim Pyles, a principal with Powers Pyles Sutter & Verville, in Modern Healthcare, would "allow a broad consent form to be signed." Some critics of the law note a general consent form would be given to individuals while at their weakest state of mental and/or physical health.
The measures signal the growing need to share health data as healthcare models become increasingly integrated and electronic infrastructure to share that data gets built out.
The agency noted in a press release announcing the changes that it "wants to ensure that patients with substance use disorders have the ability to participate in new integrated health care models without adverse consequences that could result from inappropriate disclosure of patient records."
“This proposal will help patients with substance use disorders fully participate and benefit from a health care delivery system that’s better, smarter and healthier, while protecting their privacy,” Burwell said in a prepared statement. “We are moving Medicare, and the healthcare system as a whole, toward new integrated care models that incentivize providers to coordinate and put the patient at the center of their care, and we are modernizing our rules to protect patients.”
The sharing of health data has not come without challenges, such as privacy concerns and the risk of exposure to cyberattacks. Just last year, Healthcare Dive reported that as many as 80 million current and former Anthem customers had their personal health data stolen in an attack that was, at least at the time, likely "the largest healthcare breach to date," according to a spokesman for Anthem's security company Mandiant.
The rule will be published in the Federal Register on February 9.