{
  "id": "R44790",
  "type": "CRS Report",
  "typeId": "REPORTS",
  "number": "R44790",
  "active": true,
  "source": "EveryCRSReport.com",
  "versions": [
    {
      "source": "EveryCRSReport.com",
      "id": 585027,
      "date": "2018-06-18",
      "retrieved": "2018-09-12T22:46:36.181339",
      "title": "Privacy Protections for Individuals with Substance Use Disorders: The Part 2 Final Rule in Brief",
      "summary": "On January 18, 2017, the Secretary of Health and Human Services (HHS) published a final rule to amend the federal regulations known as \u201cPart 2\u201d that protect the privacy of patient records maintained by alcohol and drug treatment programs across the country. Part 2 was developed in the 1970s to allay the concerns of individuals with substance use disorders who were afraid to get treatment for fear that their medical information would be released, leading to discrimination and even prosecution. \nHealth care providers participating in new health care delivery models such as accountable care organizations (ACOs), which rely on sharing medical information to coordinate and integrate patient care, complain that Part 2 restricts their ability to access important medical data.\nDisclosure of Part 2 Data\nDisclosure of Part 2-covered data generally requires a patient\u2019s written consent unless the type of disclosure falls under one of a handful of statutory exceptions. Consent is needed for a clinician to release patient information to another health care facility to improve the coordination of care. This requirement contrasts with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, which applies more broadly to medical information throughout the health care system, and which permits health care providers to share patient data with few restrictions.\nAlcohol and drug treatment programs typically are subject to both Part 2 and the Privacy Rule unless there is a conflict between the two. In that case, the program must comply with the regulations that are more protective of privacy, which generally means following Part 2.\nChanges in the Final Rule\nThe final rule was developed by the HHS Substance Abuse and Mental Health Services Administration (SAMHSA). According to SAMHSA, the changes in the final rule are intended primarily to facilitate the sharing of Part 2 data among providers participating in clinically integrated health care networks that include addiction treatment programs. \nThe final rule introduced flexibility to the Part 2 consent process. It provided patients with more options for designating the types of individuals and entities that may receive protected information. A patient may now consent to disclose Part 2 data to an organization such as an ACO or health information exchange (HIE) that does not have a direct treatment relationship with the patient, but which acts as an intermediary. The intermediary may then disclose the information to some or all of the providers who treat the patient, pursuant to the patient\u2019s consent preferences.\nGroups that advocate for the privacy of individuals with substance use disorders generally are satisfied with the final rule because it retains Part 2\u2019s core confidentiality protections. But the reaction of many health care provider organizations has been mixed. While applauding the changes that permit disclosure of Part 2 data to intermediaries such as ACOs and HIEs, providers are critical of other changes that they claim are administratively and technologically burdensome and provide little if any additional privacy protections.\nExchange of Part 2 Data\nTo facilitate the electronic exchange of Part 2 data, each patient\u2019s consent preferences specifying the type of information that may be shared, and the individuals or entities with whom the information may be shared, must be carefully managed. To control access, patient consent must travel with the data. In addition, the data in a medical record must be segregated to capture a patient\u2019s preferences. Data segmentation allows a patient\u2019s record to be separated into multiple categories, so that certain protected data elements can be removed (redacted) if a patient has not consented to their disclosure. \nSAMHSA has worked with its federal and nonfederal partners to develop Consent2Share, an online tool for data segmentation and consent management. Consent2Share integrates with electronic health record systems and HIEs to support the exchange of Part 2 and other sensitive health data.",
      "type": "CRS Report",
      "typeId": "REPORTS",
      "active": true,
      "formats": [
        {
          "format": "HTML",
          "encoding": "utf-8",
          "url": "http://www.crs.gov/Reports/R44790",
          "sha1": "f67219ece4174a0e14d6de2338e71e760b67f464",
          "filename": "files/20180618_R44790_f67219ece4174a0e14d6de2338e71e760b67f464.html",
          "images": {}
        },
        {
          "format": "PDF",
          "encoding": null,
          "url": "http://www.crs.gov/Reports/pdf/R44790",
          "sha1": "74a91135177253d8dfcefd88310c419dd3bc34a7",
          "filename": "files/20180618_R44790_74a91135177253d8dfcefd88310c419dd3bc34a7.pdf",
          "images": {}
        }
      ],
      "topics": [
        {
          "source": "IBCList",
          "id": 4788,
          "name": "Health Care Delivery"
        }
      ]
    },
    {
      "source": "EveryCRSReport.com",
      "id": 459806,
      "date": "2017-03-17",
      "retrieved": "2017-03-22T18:26:45.962997",
      "title": "Privacy Protections for Individuals with Substance Use Disorders: The Part 2 Final Rule in Brief",
      "summary": "On January 18, 2017, the Secretary of Health and Human Services (HHS) published a final rule to amend the federal regulations known as \u201cPart 2\u201d that protect the privacy of patient records maintained by alcohol and drug treatment programs across the country. Part 2 was developed in the 1970s to allay the concerns of individuals with substance use disorders who were afraid to get treatment for fear that their medical information would be released, leading to discrimination and even prosecution. \nHealth care providers participating in new health care delivery models such as accountable care organizations (ACOs), which rely on sharing medical information to coordinate and integrate patient care, complain that Part 2 restricts their ability to access important medical data.\nDisclosure of Part 2 Data\nDisclosure of Part 2-covered data generally requires a patient\u2019s written consent unless the type of disclosure falls under one of a handful of statutory exceptions. Consent is needed for a clinician to release patient information to another health care facility to improve the coordination of care. This requirement contrasts with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, which applies more broadly to medical information throughout the health care system, and which permits health care providers to share patient data with few restrictions.\nAlcohol and drug treatment programs typically are subject to both Part 2 and the Privacy Rule unless there is a conflict between the two. In that case, the program must comply with the regulations that are more protective of privacy, which generally means following Part 2.\nChanges in the Final Rule\nThe final rule was developed by the HHS Substance Abuse and Mental Health Services Administration (SAMHSA). According to SAMHSA, the changes in the final rule are intended primarily to facilitate the sharing of Part 2 data among providers participating in clinically integrated health care networks that include addiction treatment programs. \nThe final rule introduced flexibility to the Part 2 consent process. It provided patients with more options for designating the types of individuals and entities that may receive protected information. A patient may now consent to disclose Part 2 data to an organization such as an ACO or health information exchange (HIE) that does not have a direct treatment relationship with the patient, but which acts as an intermediary. The intermediary may then disclose the information to some or all of the providers who treat the patient, pursuant to the patient\u2019s consent preferences.\nGroups that advocate for the privacy of individuals with substance use disorders generally are satisfied with the final rule because it retains Part 2\u2019s core confidentiality protections. But the reaction of many health care provider organizations has been mixed. While applauding the changes that permit disclosure of Part 2 data to intermediaries such as ACOs and HIEs, providers are critical of other changes that they claim are administratively and technologically burdensome and provide little if any additional privacy protections.\nExchange of Part 2 Data\nTo facilitate the electronic exchange of Part 2 data, each patient\u2019s consent preferences specifying the type of information that may be shared, and the individuals or entities with whom the information may be shared, must be carefully managed. To control access, patient consent must travel with the data. In addition, the data in a medical record must be segregated to capture a patient\u2019s preferences. Data segmentation allows a patient\u2019s record to be separated into multiple categories, so that certain protected data elements can be removed (redacted) if a patient has not consented to their disclosure. \nSAMHSA has worked with its federal and nonfederal partners to develop Consent2Share, an online tool for data segmentation and consent management. Consent2Share integrates with electronic health record systems and HIEs to support the exchange of Part 2 and other sensitive health data.",
      "type": "CRS Report",
      "typeId": "REPORTS",
      "active": true,
      "formats": [
        {
          "format": "HTML",
          "encoding": "utf-8",
          "url": "http://www.crs.gov/Reports/R44790",
          "sha1": "d2257b91c5a3f4a0c6dc85dda60406f04b021cf1",
          "filename": "files/20170317_R44790_d2257b91c5a3f4a0c6dc85dda60406f04b021cf1.html",
          "images": null
        },
        {
          "format": "PDF",
          "encoding": null,
          "url": "http://www.crs.gov/Reports/pdf/R44790",
          "sha1": "9f35e7a104d6d5dc1eef64d245f1bf62fcc0f0b0",
          "filename": "files/20170317_R44790_9f35e7a104d6d5dc1eef64d245f1bf62fcc0f0b0.pdf",
          "images": null
        }
      ],
      "topics": [
        {
          "source": "IBCList",
          "id": 4788,
          "name": "Health Care Delivery"
        }
      ]
    }
  ],
  "topics": [
    "Health Policy"
  ]
}