Last week, I wrote that the Substance Abuse and Mental Health Services Administration (SAMHSA) was wrong to say that its rules required CMS to withhold from researchers any personally identifiable substance use claims from Medicare and Medicaid data. Now, after spending more time with the agency’s rules, I’m not so sure. Even so, SAMHSA’s decision-making raises some troubling questions.
By statute, any patient records pertaining to substance use or alcoholism that are maintained in connection with the performance of any federally supported program or activity are confidential. At the same time, however, the statute also says that such records can be disclosed “[t]o qualified personnel for the purpose of conducting scientific research.”
To implement this provision, the agency that became SAMHSA, in 1976, adopted 42 C.F.R. §2.52, which allows patient identifying information to be disclosed “for the purpose of scientific research.” In so doing, the agency emphasized the importance of retrospective studies to the “search for truth” and recognized that “it would be wholly inappropriate to use the rulemaking process to impose an absolute requirement of patient consent with respect to activities which by statute may be conducted without it.” [40 Fed. Reg. 20536-37 (1976)]
In 1987, the language of §2.52 was updated to “clarify” that disclosure was appropriate only “if the program director makes a determination” that the researchers are qualified and meet certain stringent standards. [52 Fed. Reg. 21800 (1987)] Initially, I assumed CMS would count as a program director. The problem is that the regulations define “program” to be an “individual or entity” that “provides … alcohol or drug abuse diagnosis [or] treatment.” Under that definition, it seems that CMS is probably not a program—and it thus can’t take advantage of §2.52.
Instead, SAMHSA’s regulations seem to treat CMS as a “third party payer,” which is defined broadly enough to include both private insurers and government agencies. And under 42 C.F.R. §2.12(d)(2), “[t]he restrictions on disclosure in these regulations apply to … [t]hird party payers with regard to records disclosed to them by federally assisted alcohol and drug abuse programs.”
In other words, Medicare and Medicaid may be bound by confidentiality restrictions, even though they aren’t authorized in §2.52 to disclose patient identifying data to researchers. This made sense back in 1976, when the regulations were first adopted. Allowing providers to share substance use information would facilitate research, but the same wasn’t necessarily true for insurers. Crunching huge data sets of submitted claims just wasn’t possible in an era before computers came into widespread use. And so in a rulemaking notice that spilled a lot of ink about the importance of research, the agency never mentioned the possibility that prohibiting disclosures from third-party payers might inhibit research.
All of this suggests, however, that CMS’s new policy of scrubbing Medicare and Medicaid data is based on regulations that were drafted in another era and that have not been amended to keep pace with changing circumstances. That’s worrisome. I’ve seen no evidence that SAMHSA has ever publicly considered the wisdom of allowing Medicare and Medicaid to disclose patient-identified data to researchers. If the agency had, I can’t imagine why it would allow private providers—but not the government—to do so.
More to the point, SAMHSA had a choice when it discovered that CMS had been releasing its data for years without any apparent breaches of patient confidentiality. It could have reflexively told CMS to stop—which is what it looks like it did. Or it could have issued guidance to temporarily accommodate CMS’s practice even as it proposed amending the rules to enable the disclosures.
What I can’t fathom is why SAMHSA forced a major change in longstanding CMS practice without ever notifying the research community. No federal statute requires withholding the data: this is just the agency’s choice. It should heed its 1976 position that it would be “wholly inappropriate” to stifle research without adequate justification.
