The Perceived Impact of 42 CFR Part 2 on Coordination and Integration of Care: A Qualitative Analysis

Title 42 of the Code of Federal Regulations Part 2 (42 CFR Part 2) is a poorly understood set of health care regulations that govern how and when information on treatment for alcohol and drug use disorders can be shared. The regulations broadly prohibit the release or disclosure of information about individuals in care for alcohol and drug use disorders unless the patient provides written consent to specific persons. Because alcohol and drug use disorders are stigmatized conditions and may lead to sanctions (for example, loss of employment, housing, and child custody; discrimination; and prosecution for criminal offenses), the regulations “ensure that a patient receiving treatment for a substance use disorder . . . is not made more vulnerable [because they seek treatment] than an individual with a substance use disorder who does not seek treatment” (1). The regulations (released in 1975 and updated in 1987) were designed to encourage initiation of care.

The regulations stipulate that covered programs may disclose patient information only if the patient provides written consent. Limited disclosure without consent is permitted for medical emergencies, internal communication within the treatment program, response to a valid court order, research or audit, and compliance with requirements to report child abuse or criminal activity within the program (2). In order to facilitate communication between the treatment provider and referral sources, courts, other health care providers, and others with a legitimate need to know, patients sign a release of information that authorizes the provider to disclose specific information about the treatment to a specific individual until a specific date or condition when the consent expires (2). Patients may revoke consent at any time.

The regulations predate the creation of electronic health records and reflect a time when individuals with alcohol and drug use disorders were treated almost exclusively in stand-alone, specialized facilities. Until the passage of HIPAA in 1996 and the publication of Standards for Privacy of Individually Identifiable Health Information (Privacy Rule) in 2000, there were few safeguards protecting the confidentiality of health records; therefore, 42 CFR Part 2 was a necessity.

The health care and addiction treatment environments are changing. Increasingly, health care is provided by teams rather than by specific individuals, and electronic health records are replacing paper medical records in order to promote communication and coordination within care teams. Primary care settings screen for and address alcohol and drug use disorders. HIPAA and the Privacy Rule, moreover, cover all health records, including alcohol and drug treatment records. Compliance with the federal confidentiality regulations prohibiting unauthorized release of information on treatment for alcohol and drug use disorders effectively requires a separate record for alcohol and drug treatment and may inhibit coordination and integration of care.

In February 2016, the Substance Abuse and Mental Health Services Administration (SAMHSA) released a proposed rule to revise 42 CFR Part 2. The revision seeks “to make the regulations more understandable and less burdensome,” “to facilitate information exchange,” and to “better align [the regulations] with advances in the U.S. health care delivery system while retaining important privacy protections” (1). Currently, the confidentiality regulations apply to about 12,000 programs that identify themselves as providing addiction diagnosis and treatment services (1). The proposed rule extends the regulations to include units within general medical facilities if the unit, or personnel in the unit, provides and is identified as providing diagnosis, treatment, or treatment referrals for alcohol and drug use disorders. This extension of the parties covered by the regulation could substantially increase the number of entities who must adhere to 42 CFR Part 2. SAMHSA was unable to estimate the number of affected practitioners or programs (1).

To facilitate care coordination and to recognize that services are often provided by a care team, the proposed rule would permit addiction treatment providers to release information to health care teams at various medical facilities (1), with the consent of the patient. The consent must describe the amount and kind of information to be disclosed, and patients must confirm that they understand the terms of the consent and that they have a right to know (upon request) the names of the entities that have received their information. Electronic signatures are permitted. Substance use procedure and diagnostic codes, moreover, may be shared with health information exchanges and with organizations that coordinate care, such as accountable care organizations, coordinated care organizations (CCOs), and patient-centered medical homes (1). Lawful holders of patient-identified information must have formal policies and procedures to maintain the security and sanitization of the records.

To support the exchange of information within the constraints of the proposed 42 CFR Part 2 revisions, SAMHSA developed Consent2Share, an open-source data segmentation application that can be incorporated into existing electronic health records to manage patient consent and adhere to 42 CFR Part 2 (1). The application was developed using standards created by the Office of the National Coordinator for Health Information Technology as part of its Data Segmentation for Privacy (DS4P) initiative. DS4P developed interoperability data segmentation standards to maintain confidentiality and respect patient consent directives (1). Data segmentation is required if information on the diagnosis, treatment, or referral for a substance use disorder is included in an electronic health record. The proposed rule notes that most electronic health records and health information exchanges do not currently support data segmentation and that addiction treatment programs without data segmentation and consent management capacities will be unable to participate in integrated care models (1).

Oregon’s work on health care reform provides a case study of contemporary challenges in complying with 42 CFR Part 2 and the need for revisions in the regulations. Beginning in July 2012, the Oregon Health Plan (Medicaid) authorized 16 regional CCOs to manage and deliver medical, dental, and behavioral health care for Medicaid recipients. The goal of the CCOs is to integrate, coordinate, and manage medical, dental, and behavioral health care benefits within a global budget with modest annual increases (≤3.4%) (3,4). To ensure the quality of care, the Center for Medicare and Medicaid Services requires the Oregon Health Authority to report on 33 accountability measures (3,4).

To assess the impact of Oregon’s health care reforms on access to and utilization of addiction treatment services, the first two authors completed semiannual interviews with selected CCO leaders and treatment providers. A qualitative analysis of the interview transcripts was conducted to describe stakeholder perceptions of the confidentiality regulations and the challenges of compliance with 42 CFR Part 2.

Methods

The analysis was drawn from a mixed-methods assessment of the impact of Oregon’s health care reforms on the organization and utilization of treatment for alcohol and drug use disorders. Initial interviews were completed with the 16 CCOs. Subsequent in-person and telephone interviews were completed every six months with leadership in ten of the 16 CCOs and with addiction treatment and primary care providers contracting with the CCOs. The semistructured, open-ended interview protocol probed strategies to integrate services for substance use disorders, the use of electronic health records, communication among providers, and approaches for adhering to the federal confidentiality regulations. This analysis was limited to the perceived effects of 42 CFR Part 2. Oregon Health and Science University’s Institutional Review Board reviewed the protocol and approved a waiver of consent.

Interviews

Between June 2013 and December 2015, the first two authors completed 114 semiannual interviews with 76 individuals: 37 CCO leaders (50 interviews), 12 addiction and mental health treatment providers (24 interviews), 17 state and county employees (27 interviews), six medical providers (nine interviews), and four other stakeholders (four interviews). The interview guide, which was based on the Consolidated Framework for Implementation Research (CFIR) (5) and diffusion theory (6), assessed CCO infrastructure and design, integration models and strategies, use of electronic health records, alternative payment strategies, outcome monitoring, and prevention services and strategies. Comments on 42 CFR Part 2 surfaced in discussions of transitions in care, integration of behavioral health providers, treatment planning, team-based care, and use of electronic health records. The interview guide also included a specific prompt: “Please discuss record sharing with addiction treatment programs and 42 CFR, Part 2.”

Qualitative Analysis

Interviews were digitally recorded, saved, stored securely, and professionally transcribed. Handwritten interview notes were used when the recording failed or was inaudible. The research team developed a list of a priori codes on the basis of CFIR and diffusion theory (5,6) and refined the coding scheme after coding an initial set of interviews (7). At the conclusion of document coding, 40 (35%) interviews were selected for “check coding.” Intercoder reliability (.87) documented an acceptable level of consistency (7). During the first coding phase, all quotes related to 42 CFR Part 2 were coded as “42CFR,” and the research team extracted those quotes. Qualitative analysis software (Atlas-ti, version 7) facilitated coding and retrieval of text (8).

After extracting text related to 42 CFR Part 2, the principal investigator (DM) and a research associate (RLB) conducted the second coding phase independently. Using an inductive approach, they reviewed each quote and developed emergent codes for overarching themes; these emergent codes were driven by the respondents’ experiences and perspectives (8). After coding independently, the principal investigator and research associate compared and discussed the themes until consensus was achieved.

Results

The 42 CFR Part 2 regulations were discussed in 65 of the 114 interviews and by 56 of the 76 individuals interviewed. Interviews with leadership in CCOs, their treatment providers, and other stakeholders generated four primary themes: legal confusion and uncertainty associated with the regulations (25 interviews), concerns that the regulations serve as a barrier to communication and information sharing (32 interviews), the need to update the regulations (16 interviews), and comments on releases of information (ten interviews). In total, 52 of the 65 interviews that addressed 42 CFR Part 2 included one or more of the four themes. Four interviews contained statements that the regulations posed no problem, and nine included comments that were unclear or unrelated to the regulations. Below, selected quotes illustrate the overall themes that emerged from the analysis.

Legal Uncertainty

Respondents noted that practitioners were uncertain about when and how the confidentiality regulations were applicable. In October 2013, a CCO executive commented, “If [patients] are involved in CD [chemical dependency] treatment services, what happens is that we, as a plan, can take a look at that experience. But . . . there just seems to be a lot of uncertainty about, can we do this? And can we share this? Can we share that? People here are really struggling with getting good solid guidance from our HIPAA folks.”

In May 2015, a physician working in a federally qualified health center used an anecdote to illustrate the legal problems associated with the confidentiality regulations. “We’re not an alcohol and drug treatment agency, so we actually don’t specifically fall under 42 CFR as a treatment agency. . . . We had a client recently who is a heroin user who approached one of our local medical providers. [The patient] didn’t reveal that she was a substance abuser, and [they] gave her a high dose of opiates. She came back and told her clinician. Her clinician had reason to fear for her health, given that she was using pretty significant amounts of heroin and now had opiate pills. [The primary care provider] notified the [opioid] prescriber that the client was a heroin user. So then we had this question like, uh-oh, is this 42 CFR? Well, it turns out that we are not an addiction treatment agency. So we don’t have that same rule for our clinicians. It was appropriate within HIPAA for [the primary care provider] to go back, and out of coordination of care and fear for the client’s safety and notify [the opioid prescriber], according to our HIPAA policy expert here.”

A Barrier to Communication and Information Sharing

Respondents reported that discomfort with interpreting and adhering to the regulations slowed and inhibited formal care coordination and information sharing. A CCO executive director explained in August 2013 that he leaves the room when patients are discussed because he does not want to know that they may be violating confidentiality regulations. He stated, “The 42 CFR Part 2 regulations are awful. We need practice standards that allow us to share patient information without violations of HIPAA and 42 CFR. Community health workers meet frequently to discuss patients with providers. I can’t be in the room because I am sure there are violations.”

That same month, a health director within a CCO explained that the CCO’s electronic medical record contained no alcohol and drug (A&D) information from licensed A&D providers. “A&D providers will not be feeding information in,” said the director. “They will be able to get information from it. But they won't be able to feed information in—42 CFR Part 2 is an enormous barrier that we wish would go away.”

Also in August 2013, an executive director at an addiction treatment program that works with multiple CCOs observed that the regulations had become an excuse not to integrate care. “People are afraid to address confidentiality,” said the director. “They prefer to hide behind HIPAA and 42 CFR Part 2. [The regulations] become excuses for not making change.”

A Need for Updated Regulations

Speaking in January 2014, a behavioral health director in one of Oregon’s largest CCOs reported on the organization’s efforts to change the federal legislation. “[42 CFR Part 2] needs to be radically changed,” according to this source. “I understand it as a historical artifact. Now, it’s a big stumbling block to integrated care. Too many people have the impression that information sharing is not allowed. They don’t know that you can request a release of information. In every discussion with our Congressional reps we are asking for change in the confidentiality standard.”

Another CCO executive director described statewide efforts for appropriate legal guidance and advocacy for change at the federal level. In remarks from April 2015, the executive said, “We have 36 different counties with 36 interpretations. It’s not okay. . . . We talked to some of the legislators. What we want to do is to be treated equally with physical health. And I think the time is right to do that. U.S. Senator [name] and I have been working on that.”

Release of Information

Providers commented on the need for and the challenge of securing consent from patients for a release of information. Issues included a lack of understanding within medical clinics of the requirements for a release of information, strategies to elicit consent from patients for release of information, and patient unwillingness to sign releases. An addiction treatment provider explained in August 2013 that some patients refuse to permit disclosure of their substance abuse problem to their physicians. “We require signed releases,” said the provider, “but the most difficult patients refuse. Patients protect their access to prescription medications because they know that if the physician knows they are in addiction treatment the doctors won’t prescribe.”

In a rural community, an addiction treatment provider complained in December 2013 that primary care practitioners do not understand that 42 CFR Part 2 contains more requirements for release of information than HIPAA. “We have everyone sign releases,” the provider explained. “A lot of primary care, however, does not understand. They say, ‘We have HIPAA.’ [But] 42 CFR Part 2 is more than HIPAA.”

Discussion

In general, the interviewees perceived 42 CFR Part 2, as currently approved, as inhibiting communication between addiction treatment and medical care and confusing providers. CCOs have begun to demand political action to reform the confidentiality regulations because the regulations do not reflect contemporary visions about optimal care systems, comprehensive care, and continuity of care; instead they contribute to fragmented silos of care. An Oregon Senate resolution requires the director of the Oregon Health Authority to request a change in the federal regulations. In August 14, 2015, the director sent a letter to the U.S. Department of Health and Human Services that requested a review and revision of three aspects of the regulations, including disclosure requirements and restrictions, the restrictive nature of 42 CFR Part 2 consent form requirements, and the role of a qualified service organization (QSO) and uses of a QSO agreement (9). A service organization provides professional services to the addiction treatment program. To be a QSO, they must complete a written agreement that if they receive patient information, the information is confidential and they agree to resist requests to disclose the information (2). The Oregon Health Authority letter provides a road map for other states that are seeking integrated systems of care and identifies needed changes that could be put to general use across the nation.

The Oregon letter explains that CCOs limit access to addiction treatment information because 42 CFR Part 2 prohibits information sharing without explicit consent for release of information. The result is poor coordination of care for the patients most in need of care coordination (9). The Oregon Health Authority suggested that the Secretary should allow consent to apply to a health care team and a system of care because staff turnover makes it difficult to specify the persons allowed to access a record (9). The Oregon Health Authority also sought to clarify the applicability of QSO agreements to CCOs and requested a change in 42 CFR Part 2 to permit providers in the same organized care network to share information (9).

The proposed rule addresses some of the concerns and permits the exchange of electronic health record data related to addiction treatment with health information exchanges and with CCOs. Patients may permit release of their treatment information to health care teams. On the other hand, the proposed rule requires data segmentation that restricts access to the data to those with consent to view the data (1). Data segmentation may be difficult to implement within systems of care that use different electronic health records.

The study had limitations. The study data were limited to one state and to the CCOs managing care for Medicaid recipients. The interviews, moreover, were conducted prior to the release of the proposed rule and were limited in scope and time. The interview protocol was broadly focused to generate contextual information on CCO operations and change over time and was not restricted to assessment of 42 CFR Part 2.

Conclusions

The experiences of CCOs in Oregon appear to reflect many of the perceived problems with the current regulations. CCOs are at the forefront of integration of addiction and primary care, and other states and organizations may face similar challenges addressing the current and proposed regulations. Requests by the state to the federal government also lay out a potential road map for reforming 42 CFR Part 2. These changes are critical for the performance of the health care system and for improving public health. Optimal regulations can preserve patient privacy while facilitating the integration of addiction treatment services with primary care.