On April 30, ASAM sent a letter to the U.S. Department of Health and Human Services (HHS) to provide comments on the proposed modifications to the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, intended to support, and remove barriers to, coordinated care and individual engagement (Proposed Rule). While ASAM has historically supported efforts to increase care coordination and patient engagement, several aspects of the Proposed Rule raise serious concerns regarding patient privacy and autonomy.

In the Proposed Rule, the Department asserts that the Privacy Rule contemplates disclosures without authorization of protected health information (PHI) to third party organizations for care coordination and case management. HHS proposes to expressly permit covered entities to disclose PHI to social services agencies, community-based organizations, home and community-based services (HCBS) providers, and other similar third parties that provide health-related services to specific individuals for individual-level care coordination and case management, either as a treatment activity of a covered health care provider or as a health care operations activity of a covered health care provider or health plan. These third parties may not be HIPAA-covered entities themselves. With the recent changes that partially align Part 2 with HIPAA, this PHI could include sensitive SUD-related records if the patient has consented to sharing their records for health care treatment, payment, and operations. Consequently, an individual’s sensitive SUD-related records, were they disclosed under this permission to a non-HIPAA-covered entity, would no longer be protected by the HIPAA Privacy Rule. Therefore, ASAM strongly urges the Department not to implement this aspect of the Proposed Rule. A patient’s consent should be required before their PHI is disclosed, for any reason, to a non-HIPAA-covered entity, and thereby removed from the protection of HIPAA Rules. 

If this aspect of the Proposed Rule is to be implemented, however, ASAM believes that safeguards should be established. That is, the permission should be limited to circumstances in which a particular service is specifically identified in an individual's care plan and/or for which a social need has been identified via a screening assessment. Further, it should require as a condition of the disclosure, that the parties put in place an agreement that describes and/or limits the uses and further disclosures allowed by the third-party recipients. The parties should be required to narrowly define the PHI being transmitted, the purpose of the disclosure, and the duration of access, as well as to provide notification in the event of a data breach. Essentially, the Department should require an agreement similar to a Business Associate Agreement to be signed to protect the individual’s PHI from improper access, use and disclosure.

The Proposed Rule also contemplates changes to the criteria for when PHI may be shared without consent in emergency circumstances, such as when an individual is incapacitated due to a drug overdose. HHS proposes to amend the Privacy Rule:

• to replace “the exercise of professional judgment” standard with a standard permitting certain disclosures based on a “good faith belief” about an individual's best interests; and
• to replace the provision that currently permits a covered entity to use or disclose an individual's PHI based on a “serious and imminent threat” with a “serious and reasonably foreseeable threat” standard.

ASAM does not believe these changes are necessary to facilitate communication between a health care professional and a patient’s family members or friends involved in the patient’s care. In particular, the proposed change from “serious and imminent threat” to “serious and reasonably foreseeable threat” may disproportionately impact Black, Hispanic/Latinx, Asian, Pacific Islander, Native American, and other racially oppressed and disenfranchised people, as both conscious and unconscious bias may cause these groups to be seen as a “serious and imminent threat,” causing more encounters with law enforcement and worsening our nation’s existing health inequities.

HHS is also considering further revising the rule to permit a covered entity to disclose the PHI of an individual who has decision making capacity to the individual's family member, friend, or other person involved in care, in a manner inconsistent with the individual's known privacy preferences, based on the covered entity's good faith belief that the use or disclosure is in the individual's best interests.. ASAM’s answer is emphatic: the Rule should not be further revised to permit a covered entity to disclose the PHI of an individual with decision-making capacity against the individual’s wishes or without their consent. Giving providers the authority to override the patient’s privacy preferences, even in “good faith,” is not only irresponsible and unethical, but it directly conflicts with well-established, fundamental patient rights.

These proposed changes to the HIPAA Privacy Rule carry extra significance for patients with substance use disorder (SUD), given recent changes to 42 U.S.C. § 290dd-2, the statutory basis for 42 C.F.R. Part 2 (known as “Part 2”), which governs the confidentiality of substance use disorder (SUD) treatment records. The Coronavirus Aid, Relief, and Economic Security Act (CARES Act), passed on March 27, 2020 revised Part 2 to align it more with HIPAA. Specifically, the CARES Act revised the Part 2 consent requirements such that, once consent has been obtained, the contents of the SUD treatment record may be used or disclosed by a covered entity, business associate, or a Part 2 program “for purposes of treatment, payment, and health care operations as permitted by the HIPAA regulations.” If the HIPAA Privacy Rule is revised as proposed, it will impact how SUD treatment records may be shared in the future. The Substance Abuse and Mental Health Services Administration (SAMSHA) and HHS Office of Civil Rights (OCR) are expected to promulgate another proposed rule this fall to implement the CARES Act changes to Part 2. ASAM will provide further comments on that proposed rule once it is issued.

Read ASAM’s full comment letter here.

Read the HHS Proposed Rule here.