In February 2016, the Department of Health and Human Services (“DHHS”) published a proposed change to the Confidentiality of Alcohol and Drug Abuse Patient Records regulations (42 C.F.R. Part 2) to expedite health integration and information exchange. On January 18, 2017, DHHS finalized those changes to the Rule, which will be effective as of February 17, 2017.

The health care delivery system has changed considerably during the past 40 years, and Part 2 regulations were in need of modernization. DHHS believes that, although the Rule must protect the privacy of patients, the Part 2 changes will help to promote health integration and allow information exchange with research institutions.

The new provisions include the following:

• Any lawful holder of patient identifying information may disclose information protected by Part 2 to qualified individuals for purposes of scientific research, if the research meets the regulatory standards. See my November 1, 2015, blog post “HIPAA and Clinical Research.” The sharing of data will enable organizations to conduct essential research on substance use disorders.
• In certain circumstances, clients may use general designations, such as “My Treating Providers” when giving consent to the sharing of personal information. Patients are not required to agree to disclosures of their personal information, but doing so should enable them to benefit from integrated health care systems. If clients do use the general disclosure designation, they can request a list of individuals and entities with whom their information has been shared.
• The amended rule outlines audit/evaluation procedures necessary to meet the requirements of CMS-regulated accountable care organizations and other CMS-regulated organizations to facilitate financial and quality assurance functions.
• Part 2 has been updated to cover physical and electronic documentation.
• Further guidance will be forthcoming as to the implementation of these provisions.