Austin and I have received a statement from SAMHSA, copied below, on why the agency has instructed CMS to scrub any Medicare and Medicaid data of patient identifying information. The agency’s statement tracks the analysis I laid out a couple of days ago. As I explained, SAMHSA’s position jibes with the text of the rules but is at odds with the spirit in which they were adopted.
The federal law set forth in 42 USC 290dd-2 guarantees the confidentiality of patient records of individuals receiving substance abuse treatment services from federally assisted alcohol and drug abuse programs. The implementing regulations, which are codified at 42 CFR Part 2 (Part 2), impose restrictions on the disclosure and use of these records. As a general matter, patient records maintained by a federally assisted alcohol or drug abuse program may only be disclosed if a patient consents in writing, pursuant to a court order, or if the disclosure falls within one of a few limited exceptions (e.g., medical emergency, research, and certain audit and evaluation activities) enumerated in statute. Part 2 also places strict limitations on the redisclosure of records covered by the law. These restrictions apply to any information that would identify a patient, directly or indirectly, as an alcohol or drug abuser.
The protections offered by Part 2 allow patients to seek substance abuse treatment without fear that their privacy will be compromised. Because of the stigma surrounding substance abuse, there continues to be a need for strong privacy protections to minimize potential discrimination and legal consequences (both criminal and civil) that individuals might face.
CMS/Medicare, as a third party payer, is legally bound by the regulations’ prohibition on redisclosure when it receives data that is protected by Part 2. This is because 42 CFR 2.12(d)(2)(i) specifically states that the restrictions on disclosure apply to third party payers with respect to records disclosed to them by Part 2 programs. Accordingly, CMS may not further disclose this data unless it has obtained patient consent or the disclosure is otherwise permitted by Part 2.
At present, the research exception in the regulations (42 CFR 2.52) is available only to Part 2 programs and not third party payers, like CMS. The research exception provides that patient identifying information may be disclosed for the purpose of conducting scientific research if the program director makes a determination as outlined in that section. CMS is not a Part 2 program and, therefore, may not disclose Part 2-protected data for research purposes without patient consent.
Alcohol or drug abuse treatment information from limited data set files or from CMS public use files are available to the public and researchers since neither of these contains personally identifiable protected health information. This complies with the current Part 2 rules.
CMS and SAMHSA are committed to supporting the use of behavioral health data, including data that falls within the ambit of Part 2, for research purposes. Both agencies have been engaged in ongoing discussions about compliance with the regulations.
Additionally, SAMHSA, in consultation with CMS and other HHS agencies, is examining ways in which Part 2 may be updated in accordance with SAMHSA’s statutory authority. SAMHSA recently held a listening session to receive input from stakeholders on a possible revision of the regulations. One of the provisions SAMHSA specifically sought input on was the research exception and the agency is now considering the feedback that was received.
SAMHSA’s apparent willingness to revisit its rules is encouraging. But I don’t want to let the agency off the hook too easily. CMS had been releasing personally identifiable substance use data for years—without a single privacy breach, so far as we know. Yet, when SAMHSA insisted in 2013 that CMS withhold that data, neither agency publicly informed the research community about the change. Nor did SAMHSA even mention Medicare or Medicaid when it announced its “listening session.” Instead, here’s what the agency said:
Under the current regulations, the Part 2 ‘‘program director’’ has to authorize the release of information for scientific research purposes. This issue has been brought to SAMHSA’s attention from organizations that store patient health data, including data that are subject to Part 2, which may be used for research (e.g. health management organizations). Under the current regulatory framework, absent consent, these organizations do not have the authority to disclose Part 2 data for scientific research purposes to qualified researchers or research organizations. This issue can be addressed by expanding the authority for releasing data to qualified researchers/research organizations to other health care entities that receive and store Part 2 data, including third-party payers, HIEs, and care coordination organizations for the purposes of research, audit, or evaluation.
SAMHSA is considering expanding the authority for releasing data to qualified researchers/research organizations to health care entities that receive and store Part 2 data, including third-party payers, health management organizations, HIEs, and care coordination organizations.
How can you get feedback from the research community if you never tell them what you’re up to?
