On Friday, SAMHSA released a long-awaited proposed rule that would, among other things, restore research access to Medicare and Medicaid claims involving substance use disorders. I’m still digging into the rule, and I’ve got a big question I can’t nail down to my satisfaction. But I think the rule looks pretty darn good. If it’s adopted, it should bring a victorious end to Austin’s and my long-running campaign to get SAMHSA to rethink its policy.
What SAMHSA’s proposing is an overhaul of the federal regulation governing research disclosures of substance use-related medical claims for identifiable patients. Before, only providers could legally share that kind of data with researchers. Now, anyone who is a “lawful holder” of data on substance use disorders can do so. Those lawful holders include third-party payers—not only Medicare and Medicaid, but also private employers and private insurers.
Such disclosures won’t go unregulated. Patient privacy is still a paramount concern. But in an especially elegant move, SAMHSA has decided that the existing rules governing human-subjects research do enough to protect patient privacy. Although researchers will have to get a HIPAA waiver and adhere to the Common Rule, they can do both by securing IRB approval for their research. Researchers already get such approval as a matter of course.
On top of that, researchers must commit to resisting any efforts to subpoena the sensitive information that’s shared with them. They can’t disclose it to anyone else. They have to report their research in a manner that doesn’t compromise patient privacy. And they’ve got to take good care of the data. Those are essentially the same (completely reasonable) restrictions that researchers worked under before.
That’s all good news. Here’s my question. The rule contains this funny provision on “data linkages.” The issue arises because researchers typically need to link several datasets together in order to get a full picture of the care that members of a given population receive. If you only look at Medicaid data, for example, you’d miss the care that some of those patients receive through the VA system. To make the necessary linkages, researchers need patient-identifying information.
So far as I can tell, the rule would allow researchers to perform their own data linkages with raw Medicare and Medicaid data—the same thing they were doing before the unannounced data-scrubbing began. If that’s right, you’ll get no argument from me. SAMHSA should get a big round of applause.
But the rule also sets out guidelines for any researcher “[t]hat requests linkages to data sets from a federal data repository(-ies) holding patient identifying information.” As SAMHSA explains, this would
allow a researcher to disclose patient identifying information to a federal data repository and permit the federal data repository to link the patient identifying information to data held by that repository and return the linked data file back to the researcher.
That’s all fine and good if this is just an option for researchers. Most researchers, though, don’t want to outsource data linkages to the federal government. They want to link the data themselves. They’d be horrified if the only way to link data were to go hat in hand to an overtaxed CMS and beg it to do the linking. Delays would be interminable. The costs would be excessive. And mistakes would be inevitable. Honestly, I’d be surprised if CMS even wanted the job.
Even so, I’m mildly nervous that SAMHSA believes that all data linkages have to go through the federal government. To be clear, that’s not the best reading of the rule. For one thing, the provision on data linkages applies only to those researchers that “request” a data link. For another, why authorize CMS to share personally identifiable data if researchers can’t use them to link datasets together? Linking is the entire point of identifiers. No need to link? No need to have them.
But there’s a bit of ambiguity. If it can be cleared away, researchers should breathe a big sigh of relief. The rule doesn’t go as far as it might with respect to all-payer claims databases—I’ll have more to say on that soon. But the Medicare and Medicaid data upon which researchers depend will no longer be scrubbed of critical claims. When it comes to substance use disorders and associated afflictions, we won’t be flying blind anymore.
