NAACOS Part 2 Comments

October 25, 2019

Elinore McCance-Katz, M.D., Ph.D.
Assistant Secretary for Mental Health and Substance Use
Substance Abuse and Mental Health Services Administration
5600 Fishers Lane
Rockville, MD 20857

Submitted electronically via https://www.regulations.gov

Re: Confidentiality of Substance Use Disorder Patient Records Proposed Rule (SAMHSA-4162-20)

Dear Dr. McCance-Katz:

The National Association of ACOs (NAACOS) is pleased to submit comments in response to the Notice of Proposed Rulemaking, Confidentiality of Substance Use Disorder Patient Records, as published in the August 26, 2019 Federal Register.^[1]

NAACOS is the largest association of accountable care organizations (ACOs), representing more than 6 million beneficiary lives through 350 Medicare Shared Savings Program (MSSP), Next Generation, and commercial ACOs. The model is a market-based solution to fragmented and costly care that empowers local physicians, hospitals, and other providers to work together and take responsibility for improving quality, enhancing patient experience, and reducing waste. Importantly, the ACO model also maintains patient choice of clinicians. Our members, more than many other healthcare organizations, want to see an effective, coordinated, patient-centric health system. While the origin of Medicare ACOs dates back to the George W. Bush administration, ACOs have grown considerably in recent years and now include nearly 560 ACOs, covering more than 13 million beneficiaries.

We strongly support the administration’s goal to enhance care coordination and health outcomes, reduce healthcare costs, and improve care quality through its Regulatory Sprint to Coordinated Care. NAACOS shares with the U.S. Department of Health & Human Services (HHS) the goal of moving toward a value-based payment system and the cost reductions and quality improvements it brings. ACOs have for years invested in resources, such as data analytics, information technology, care coordinators, and worked to change institutional culture to focus on prevention and care coordination so that they can succeed in alternative payment models. But in order to succeed in these payment and delivery models and best support patient care, HHS needs to provide necessary tools, including access to patient information and claims data.

NAACOS supports the work of HHS and the Substance Abuse and Mental Health Services Administration (SAMHSA) to change regulations around 42 CFR Part 2 (Part 2) to better support coordinated care among providers that treat substance use disorder (SUD), while maintaining privacy safeguards for patients seeking treatment for SUD. Changes are needed to better bring Part 2, which passed Congress in 1975, in line with how medicine is delivered and paid for today. It’s time to better integrate the treatment of mental health, including addiction, with physical health. That includes providing clinicians with better access to all of patients’ records, so they can treat the whole person.

This proposed rule will help patients by making changes and clarifications in the regulations to better integrate care when possible. Importantly, this rule does nothing to change patient consent and maintains the basic framework for confidentiality protection of SUD patient records created by federally funded treatment programs. It is pro-patient and pro-privacy.

However, NAACOS is disappointed the rule doesn’t go further. We have long advocated that only when Part 2 is aligned with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) will providers be able to appropriately care for SUD patients. HHS officials maintain that current law doesn’t allow them to fully align Part 2 and HIPAA, and therefore congressional action is required.^[2] NAACOS will continue to push Congress to pass a law aligning the two health privacy laws, and we urge HHS to work with Congress on this issue. A multi-stakeholder group of providers, payers, patients, mental health advocates, and others supports H.R. 2062 and S. 1012.^[3] Earlier this year, 39 state attorneys general asked Congress to update this outdated law, demonstrating wide-ranging support for this issue.^[4] Aligning Part 2 with HIPAA will improve care coordination and quality improvement. If providers, including ACOs, don’t receive the necessary information about their patients, then it’s impossible for them to provide the kind of patient-centered, well-coordinated care that will improve health outcomes.

H.R. 2062 and S. 1012 would improve our health system in several ways. Most importantly, they would strengthen patient privacy protections for substance use disorder by instituting breach notification requirements and penalties, which haven’t been exercised under Part 2. SUD records would still be protected by HIPAA. The legislation would reduce the stigma attached to addiction and substance abuse by further creating parity between it and physical health. It would improve patient safety by limiting the overprescribing of certain dangerous drugs, including the prescription of contraindicated medicines. Finally, it would improve today’s care delivery system by optimizing care coordination demanded by ACOs and other value-based care arrangements. Obtaining multiple consents from the patient under the current requirement of Part 2 is challenging and obstructs whole-person, integrated approaches to care. Full alignment of Part 2 and HIPAA will allow for the kind of truly high-quality, patient-centered care patients deserve.

While we again thank HHS for work on this important issue, NAACOS urges SAMHSA to address the below issues in the final rule.

Disclosures for Payment and Healthcare Operations

SAMHSA proposes to amend §2.33(b) to codify 17 examples of “payment and healthcare operations” for which Part 2 records may be disclosed once a patient’s initial consent is obtained. Unfortunately, SAMHSA again stated that §2.33(b) is not intended to cover care coordination or case management. For SAMHSA, these use cases fall under “treatment, diagnosis, and referral,” and, therefore, require patient consent for disclosures to subsequent providers. HIPAA, by contrast, includes care coordination and case management under the definition of healthcare operations and doesn’t require subsequent patient consent.^[5]

NAACOS does not support SAMHSA’s interpretation that care coordination and case management fall under “treatment, diagnosis, and referral.” We urge a final rule to include care coordination and case management in the definition of healthcare operations.

While there is no formal regulatory definition of care coordination, HHS’s Agency for Healthcare Research and Quality provides this definition: “Care coordination is the deliberate organization of patient care activities between two or more participants (including the patient) involved in a patient’s care to facilitate the appropriate delivery of healthcare services. Organizing care involves the marshaling of personnel and other resources needed to carry out all required patient care activities, and is often managed by the exchange of information among participants responsible for different aspects of care.”^[6]

That definition is not consistent with how most view treatment and different from a traditional view of referrals. Finalizing this definition as proposed would place additional barriers to the type of integrated, care coordination HHS seeks to advance in its Regulatory Sprint to Coordinated Care.

Audits and Evaluations

In the preamble of SAMHSA’s final 2018 rule (83 FR 246), the agency states that ACOs or similar CMS-regulated healthcare models may wish to evaluate the impact of integrated care by participating providers or how individuals receive substance use disorder treatment through audits and evaluations provided by §2.53.^[7] Additionally, SAMHSA finalized regulations allowing disclosures to contractors, subcontractors, or legal representatives on behalf of third-party payers or quality improvement organizations under §2.53. This would allow ACOs and others access to a full, unredacted claims set to self-evaluate themselves and see how they’re treating addiction, identify hotspots in communities, and overall manage population health.

Through SAMHSA and CMS, HHS should clarify how it will implement this authority and how those eligible may access the full, unredacted claims data for audits and evaluations. For example, the agency could provide data-use agreements or a memorandum of understanding. While ACOs are interested in accessing Part 2 data for a number of valid reasons, it’s incumbent on CMS to outline how interested providers can access these claims for audits and evaluations. These provisions, which already exist, could be invaluable, but HHS is not leveraging this authority. Providers’ intent is to improve patient care, which is a goal the administration shares. CMS-regulated models, including ACOs, have the required leadership and governance structure needed to safeguard patient protections, as required under regulations. Lastly, allowing CMS-regulated healthcare models, like ACOs, the ability to access this data could provide a valuable test case for CMS and stakeholders in the appropriate use of Part 2 data.

Applicability and Re-Disclosure

SAMHSA emphasizes that treatment records created by non-Part 2 providers based on their own patient encounters are not subject to Part 2, and the agency proposes to clarify the ability of non-Part 2 providers to segregate any patient records received from Part 2 programs in order to avoid subjecting their own records to Part 2. SAMHSA is proposing these changes due to confusion about how rules apply to information shared between Part 2 programs and non-Part 2 providers. NAACOS is supportive of these efforts aimed at reducing confusion about these provisions in Part 2 and increasing coordinated care. However, we have questions about the technical feasibility of these changes given that electronic health records currently are not capable of easily segregating sensitive data from other patient data. SAMHSA should provide further guidance in the final rule or in sub-regulatory guidance about implementation of these provisions. While flexibility is important, it is also helpful to have definitive guidance to aid in compliance.

Permit an “Opt Out” Consent Process

SAMHSA could amend Part 2 to allow an “opt out” consent process, where patient information can be used and disclosed like under HIPAA, and patients could “opt out” if they want more stringent protection. The “opt out” consent process would have a default position where patient information would be permitted to be used and disclosed for treatment, payment, and healthcare operations as under HIPAA. The patient would receive detailed information initially about the use and disclosures permitted, and if patients did not want this to happen, they could sign a form that requires consent. This would also facilitate sharing of health information for safe, effective care.

Identifying Part 2 Providers

In the proposed rule, SAMHSA proposes to clarify what constitutes a Part 2 record to ensure that non-Part 2 providers are not discouraged from caring for SUD patients. Yet, one of the greatest challenges to complying with the Part 2 rule is the lack of clarity about what providers are covered by Part 2. While the definition of a Part 2 program includes individuals and entities that “hold themselves out” as providing SUD diagnosis, treatment, or referral for treatment, there exists no requirement for Part 2 providers to identify themselves publicly as a Part 2 covered provider to patients and other stakeholders. This lack of clarity about what providers and records are subject to Part 2 presents a barrier. NAACOS recommends that SAMHSA engage with affected stakeholders and issue a report on potential mechanisms to reduce ambiguity in Part 2 program identification. The assessment should include an analysis of the excess compliance burden due to the lack of public identification of Part 2 programs and what information would be helpful for patients to make choices about SUD treatment providers.

Conclusion

NAACOS is wholly supportive of patient privacy, but we believe it’s possible to both maintain privacy protections and support the kind of patient-centered, well-coordinated care that will improve beneficiary health outcomes. The proposed rule is appreciated but needs to go further to truly help patients and our health system. We encourage you to consider the recommendations included in this letter and to work with Congress on a legislative fix to Part 2 while we await a final rule.

Sincerely,