CARES Act - SUD Confidentiality Changes

CARES Act:  Confidentiality changes will promote better outcomes and more integrated care for individuals with substance use disorders

The recently-enacted Coronavirus Aid, Relief, and Economic Security Act (CARES Act) included a significant change in federal privacy laws related to treatment for substance use disorders (SUD).  Once fully implemented, confidentiality around treatment for SUD will operate in the same basic way as the Health Insurance Portability and Accountability Act (HIPAA).  And while the new law streamlines consent requirements, it maintains the nondiscrimination protections that existed prior to the CARES Act.

The improvements found in the CARES Act should promote better outcomes and more integrated care for individuals with SUD.  Providers and health plans that serve Medicaid beneficiaries – as well as dual eligible special needs plans (DSNPs) – will have new opportunities to support patients and members.

What changed?

Prior to the CARES Act, an individual with SUD was required to execute a narrowly-written consent for each disclosure, to each entity, for every health encounter with a new practitioner, and the effect typically was that the person’s non-SUD providers were unaware of the diagnoses and treatment an individual was receiving related to SUD services.

These strict confidentiality standards, originally enacted in the 1970s and then defined in 42 CFR Part 2 (often referred to as “Part 2”), encouraged individuals with substance use disorders to seek care without fear that the SUD provider would share any information without the patient’s consent – even that the individual was in care for SUD – which could result in potential criminal prosecution or a loss of various benefits and rights.  However, over time it’s become clear that the strict confidentiality standards have impeded meaningful care coordination, and have resulted in avoidable duplications of medications, and a lack of collaboration across the individual’s entire treatment team.  With the opioid crisis, and with the growth in organized systems of care (such as patient-centered medical homes and accountable care organizations [ACO]), the SUD confidentiality standards have been seen as a barrier to meaningful treatment across clinical teams, and many have advocated for Congress to change the underlying law.

Under Section 3221 of the CARES Act, Congress eased the confidentiality laws around SUD, while recognizing that the stigma around SUD treatment – and the risk of criminal prosecution – remain.  Under Section 3221, an individual still must provide written consent for information sharing, but importantly a single written consent will allow his/her SUD provider to share treatment and diagnostic information with other members of the individual’s health care team, without requiring a separate written consent for each instance of data sharing.  In this way, collaboration across a treatment team can occur, much like it does within the HIPAA framework.

As a result, the individual’s primary care provider (PCP) and other physicians for chronic or acute illnesses will have a better understanding of the individual’s overall underlying health status, prescriptions, and utilization patterns.  Moreover, because SUD treatment often is associated with behavioral health services related to mental illness, information can be shared to help coordinate care between the mental health and SUD treatment systems, since these providers are often distinct from one another.  Similarly, hospitals and other facilities will have more information on patients with SUDs and opioid use when the individual is seen in an emergency room or needs a procedure or admission.

Implications

Health outcomes

Many individuals and organizations have advocated for the change enacted in the CARES Act, primarily because it will improve health outcomes. Services will be better coordinated; providers are likely to prescribe fewer duplicate or contraindicated medications; more caution will be paid when delivering services that could trigger relapse for a patient with SUD (e.g. dental care or surgeries); better interventions and social supports can be arrayed around a person with multiple co-occurring disorders including SUD; and patterns of care such as high emergency room utilization will be better understood with more appropriate interventions.

Indeed, the approaches around patient-centered medical homes, integrated plans of care, coordinated care, and whole person care will be promoted.

Accountable care organizations

Up until now, the siloing of SUD treatment information from the rest of health care delivery has impeded aligned incentives for accountable care organizations (ACOs), especially shared risk arrangements related to the Medicaid adult expansion population, which has a relatively high prevalence of beneficiaries with SUD diagnoses. With increased transparency about SUD treatments and diagnoses, ACOs will be better positioned to invest in care coordination, case management, peer support, and opioid-related treatment that will support patients, and hopefully reduce the incidence of avoidable emergency department visits and inpatient stays. It also allows ACOs to bring SUD providers more directly into interdisciplinary treatment teams, discharge planning, and transitions of care, with the right financial incentives across services and providers.

Medicaid program design

State Medicaid programs often evaluate which services should be carved-into (or carved out of) managed care arrangements. One argument in favor of a SUD carve-out historically has been that confidentiality rules precluded meaningful integration with physical medicine, so SUD treatment could be carved out without any real jeopardy to an integrated approach. Section 3221 of the CARES Act potentially changes that calculation, and could lead to a re-evaluation of the Medicaid program design in setting the scope of services for managed care carve-ins.  In other words, because SUD treatment information will become more readily available to physical and mental health providers, having all those services organized within a single delivery system – such as a fully carved-in plan – could be one outcome of the change in the SUD confidentiality laws.

EHRs and PDMPs

Prior to the changes in the CARES Act, it was difficult to include SUD records in electronic health records (EHRs), because of privacy standards related to protecting those records from disclosure to non-SUD providers and payers in the absence of specific written consent from the individual. The result is that very few SUD providers participate in EHRs. Now, EHRs can be designed in a way that expands participation by SUD providers, without requiring the kind of complex rules-based permissions that would have been necessary prior to the CARES Act changes.

With respect to prescription drug monitoring programs (PDMPs), many Part 2 drugs (e.g. methadone and buprenorphine) similarly have been kept out of PDMPs, because the presence of these drugs revealed treatment for SUD, and therefore likely would have violated the earlier confidentiality rules. Under Section 3221, PDMPs more easily can include disclosure of Part 2 drugs.

Dual eligibles and DSNPs

For dual eligibles – those individuals who receive both Medicaid and Medicare benefits – the challenges related to SUD confidentiality have been even more exacerbated, because the payer for specialized SUD treatment (Medicaid) and the payer for physician, hospital, and most pharmacy services (Medicare) were already disparate.

Various mechanisms exist to coordinate (and integrate) services between Medicaid and Medicare for dual eligibles, often utilizing health plans that simultaneously enroll the same dual eligible individual in the organization’s Medicaid managed care plan and Medicare Advantage DSNP. Still, this integration can face challenges across the two programs, despite enhanced federal requirements that take effect in January 2021 pursuant to the Bipartisan Budget Act of 2018.

The change in the SUD privacy standard should enable much better coordination in serving dual eligibles with SUD, by enabling coordination not only across Medicaid and Medicare, but also between SUD services and the related medical care that individuals need – primary and specialty care, careful discharge planning and transitions into community programs, and pharmacy benefits.

Ongoing risks 

It’s important to remember that privacy rules related to treatment for SUD existed for a reason. Depending on the substance, individuals could be subject to criminal prosecution. And short of that, a history of substance use can jeopardize employment, custody rights, use of public housing, and a host of other services. The stigma and real-life consequences of substance use remain quite real, and the strict adherence to privacy rules (as those rules adapt) remains critical to respecting the rights and needs of people who seek treatment for substance use disorders.

Prior to CARES, the U.S. Department of Justice (DOJ) was responsible for enforcing Part 2 privacy requirements, and in practice DOJ was fairly inactive.  Now, the enforcement protections will fall under HHS, like HIPAA.  As a result, even though the privacy protections themselves have been eased to align more closely with HIPAA, it’s likely that individuals who pursue SUD-related services will have a more active oversight entity looking to protect their rights.  In short, in all probability we will see greater federal enforcement of SUD confidentiality under Section 3221 than we did under Part 2.

What’s next?

Under Section 3221, the federal Department of health and Human Services (HHS) has a year to promulgate regulations to create the framework under the new privacy law.  Providers, health plans, EHR developers and other entities should prepare for the effective date of those new rules, and advocate for the best possible regulatory framework.

For more information

MACPAC has devoted a great deal of time and attention to the issue of SUD privacy standards.  Here are a couple of good resources:

MACPAC Letter to Secretary Alex Azar, October 25, 2019, RE: SAMHSA-4162-20; Confidentiality of Substance Use Disorder Patient Records.  https://www.macpac.gov/wp-content/uploads/2019/10/Comments-on-Proposed-Rule-on-Substance-Use-Disorder-Confidentiality-of-Patient-Records.pdf

Medicaid and CHIP Payment and Access Commission (MAPAC). 2018. Chapter 2: Substance use disorder confidentiality regulations and care integration in Medicaid and CHIP. In Report to Congress on Medicaid and CHIP. June 2018. Washington, DC: MACPAC. https://www.macpac.gov/wp-content/uploads/2018/06/Substance-Use-Disorder-Confidentiality-Regulationsand-Care-Integration-in-Medicaid-and-CHIP.pdf