When SAMHSA issued its proposed rule, I had two concerns about its scope. Writing on AcademyHealth’s behalf, I asked SAMHSA for clarification. Both of my concerns have been addressed in the final rule—one satisfactorily, the other not so much.
First, a provision on data linkages—efforts to link Medicare and Medicaid data with other datasets—could have been read to say that researchers couldn’t do such linkages on their own, but would have to ask CMS to perform such linkages for them. That would have been bad. As AcademyHealth explained, “CMS is overtaxed, and we are not optimistic that it will be able to expeditiously, inexpensively, and accurately do the complex work associated with linking data across disparate data sets.”
SAMHSA apparently agreed. In the final rule, it clarified “that the data linkages provision is not intended to prohibit a researcher from linking a data set in the researcher’s possession that contains part 2 data with a data set from a third party source.” In other words: victory!
Second, the proposed rule didn’t seem to allow records relating to substance use disorders to be shared with data intermediaries, including the all-payer claims databases (APCDs) that now exist in about 18 states. Because APCDs and other intermediaries aren’t providers or payers, they aren’t “lawful holders” of such records within the meaning of the regulations. As such, they can’t collect those records and they can’t share them with researchers.
SAMHSA recognized the issue and, in its rule, offered what it apparently considered a solution. The agency clarified that APCDs and other data intermediaries “are permitted to obtain [data on substance use disorders] under the research exception, provided that the conditions of the research exception are met.” At that point, APCDs and intermediaries would become “lawful holders” of the data and “would therefore be permitted to redisclose [those] data for research purposes.”
That sounds good. But if you look at the new rule, it appears that APCDs and other intermediaries can’t take advantage of the research exception. Under the rule, you’re eligible for the exception only if you’re (1) a HIPAA-covered entity or (2) subject to HHS rules governing human subjects research.
APCDs and other data intermediaries don’t appear to qualify. Because they’re not providers, plans, or payment clearinghouses, they’re not “covered entities” within the meaning of HIPAA. And I don’t see why APCDs or other intermediaries would be subject to the rules governing human subjects research. They’re not federal entities and, to my knowledge, their research isn’t supported by federal funds.
If that’s right—and it’s possible I’m missing something—then SAMHSA has effectively prohibited APCDs and other data intermediaries from receiving identifiable records pertaining to substance use disorders. The states that were hoping to use their APCDs to help them tackle the opioid epidemic can forget about it.
