2020-25810. Confidentiality of Substance Use Disorder Patient Records

AGENCY:

Substance Abuse and Mental Health Services Administration (SAMHSA), U.S. Department of Health and Human Services (HHS).

ACTION:

Final rule.

SUMMARY:

This final rule amends the Substance Abuse and Mental Health Services Administration's (SAMHSA) regulation governing the Confidentiality of Substance Use Disorder Patient Records, to clarify one of the conditions under which a court may authorize disclosure of confidential communications made by a patient to a part 2 program as defined in this regulation. This change to the regulation is intended to clarify that a court has the authority to permit disclosure of confidential communications when the disclosure is necessary in connection with investigation or prosecution of an extremely serious crime, such as one that directly threatens loss of life or serious bodily injury, where the extremely serious crime was allegedly committed by either a patient or an individual other than the patient.

DATES:

Effective Date: This final rule is effective January 13, 2021.

FOR FURTHER INFORMATION CONTACT:

Deepa Avula: [phone]. [e-mail].

Table of Contents

I. Legal Authority

II. Background and Summary

III. Final Rule: Discussion of Public Comments

IV. Regulatory Impact Analysis

I. Legal Authority

HHS is finalizing this rule under the authority of 42 U.S.C. 290dd-2.

II. Background and Summary

On January 18, 2017, HHS published a final rule (82 FR 6052) (2017 final rule) that made certain changes to the regulations governing the confidentiality of substance use disorder patient records at 42 CFR part 2 (part 2). The part 2 regulations apply to part 2 programs, defined by HHS as federally assisted programs (federally assisted as defined in § 2.12(b) and program as defined in § 2.11), as well as other lawful holders who have obtained part 2 information in accordance with the part 2 authorizing statute and implementing regulations. See § 2.12(e)(1) for examples.^[1]

HHS did not intend in the 2017 final rule to substantively revise the provision of part 2 governing confidential communications that appears in § 2.63. However, the phrase “allegedly committed by the patient” was erroneously added to § 2.63(a)(2) in the 2017 final rule. The fact that the preamble of the 2017 final rule did not address that change, or explain its intended reasoning, indicates that no substantive change was intended.

In addition, since the publishing of the 2017 final rule, then-Acting Secretary of HHS Eric D. Hargan declared the opioid crisis a public health emergency, pursuant to section 319 of the Public Health Service Act, 42 U.S.C. 247d, and Secretary Alex M. Azar II renewed the declaration, most recently as of the date of this publication, on July 6, 2020. According to the Centers for Disease Control and Prevention, more than 750,000 people died from a drug overdose between 1999 and 2018.^[2] A November 2017 report from the President's Council of Economic Advisors entitled “The Underestimated Costs of the Opioid Crisis” estimates that in 2015, the economic cost of the opioid crisis was $504 billion, or 2.8 percent of Gross Domestic Product that year.^[3] The President's Commission on Combatting Drug Addiction and the Opioid Crisis in its 2017 final report identifies the gravity of the opioid crisis and notes the importance of a comprehensive effort by Federal partners, including the Department of Justice and the Drug Enforcement Administration, to address this crisis.^[4]

As demand for treatment increases and new entities become part 2 programs, HHS believes that the need to prevent drug trafficking and patient exploitation at or by part 2 programs makes it imperative to correct the error in § 2.63(a)(2). If left in its current form, the rule would hamper law enforcement efforts, in situations where an individual other than the patient committed an extremely serious crime, such as one which directly threatens loss of life or serious bodily injury, and in which access to substance use disorder (SUD) treatment records is necessary in connection with the investigation or prosecution of that extremely serious crime.

In addition to fixing the error from the 2017 final rule, HHS believes reverting to the previous language for this section is necessary to help reduce and deter drug trafficking at or from part 2 programs, and thereby to prevent the occurrence of extremely serious crimes from interfering with the delivery, by part 2 programs, of high quality, medically necessary treatment to patients with substance use disorders.

Accordingly, HHS will amend the text of § 2.63(a)(2) to remove the phrase “allegedly committed by the patient.”

III. Final Rule: Discussion of Public Comments

On August 26, 2019, HHS published a Notice of Proposed Rulemaking (NPRM) (84 FR 44566) to amend § 2.63(a)(2) by deleting the phrase “allegedly committed by the patient” that was erroneously added in the 2017 final rule.

HHS received 427 public comments, ranging from general support or opposition to comments specific to the proposed correction. Some comments were outside the scope of our proposal, or HHS's legal authority regarding the confidentiality of substance use disorder patient records. Consequentially, HHS does not discuss these comments in the final rule.

Comment: Several commenters expressed support for the proposed rule, with some noting that the proposed change would enhance the ability to address opioid-related crime; would make the regulation less cumbersome to read; and would strike a balance between confidentiality and justice.

Response: We thank commenters for their support.

Comment: Many commenters argued that the addition of “allegedly committed by the patient” was not a technical error when it first appeared in the final rule in 2017. Several commenters asserted that removal of the phrase “allegedly committed by the patient” would constitute a substantive change to the rule, rather than a technical correction. Commenters stated that the final 2017 rule was published after following the standard rulemaking process under the Administrative Procedure Act, and that the text of the final 2017 rule would have been extensively reviewed by both SAMHSA and HHS prior to publication, leading them to believe the addition was not an error. One commenter noted that they could not determine with any clarity whether the addition of “allegedly committed by the patient” was consistent with well-accepted understanding of the pre-2017 language, and that commenter therefore requested that HHS provide future certainty and clarity as to the intended scope of the rule. Finally, another commenter asserted that the current language “allegedly committed by the patient” reflects a delicate balance of competing interests in privacy and public safety, such that the proposed change would go beyond merely correcting a technical error.

Response: The error in the 2017 final rule that occurred by adding “allegedly committed by the patient” traces back to the 2016 proposed rule. The 2016 proposed rule enumerated every section of part 2 for which a revision was then being proposed and described each revision and the reasoning behind it. Notably, the 2016 proposed rule did not include any proposal to revise section 2.63. In the 2017 final rule, there was no summary of public comment on adding the phrase “allegedly committed by the patient” to section 2.63, because no change had been proposed to section 2.63, so the public was never invited to comment on that provision or otherwise notified that the provision would be amended. The only place where the phrase “allegedly committed by the patient” appeared was in the restatement of the part 2 regulation, which appeared at the end of the 2017 final rule. Thus, the phrase “allegedly committed by the patient” was added in error to the regulatory text of section 2.63. Furthermore, as discussed above, this error could hamper or impede federal law enforcement efforts in situations where an individual other than the patient committed an extremely serious crime, such as one which directly threatens loss of life or serious bodily injury, and access to SUD treatment records is necessary in connection with the investigation or prosecution of that extremely serious crime.

We believe that correcting this error is necessary both to address the opioid epidemic and to protect patients.

Comment: One commenter said that HHS should use the opportunity of the current comment period to ameliorate any procedural error in 2017, so that the phrase “allegedly committed by the patient” remains in the part 2 regulations at section 2.63(a)(2).

Response: As stated above, the addition of the phrase “allegedly committed by the patient” was not a logical outgrowth of the 2016 NPRM proposals, or of comments received thereon, and it was added in error to the regulatory text of section 2.63. The change that we are finalizing would restore section 2.63 to its pre-2017 state, consistent with thirty years of rulemaking history since the adoption of section 2.63 in the 1987 final rule. Furthermore, as stated previously, it has come to our attention that the erroneous addition of the phrase “allegedly committed by the patient” may hinder Federal law enforcement efforts, which is a separate substantive reason for SAMSHA to delete the inadvertently added phrase and restore the provision to the previous regulatory text.

Comment: A few commenters expressed concern that the proposal would substantially change or broaden the definition of “extremely serious crime,” either by including drug-trafficking, or offenses not committed by the patient, or both within that definition. Commenters asserted that the 1987 rule specifically excluded drug-related offenses from the definition of an “extremely serious crime.” One commenter asserted that the 1987 rule authorized a court to find that a drug-related offense might constitute an “extremely serious crime,” but only in the context of offenses committed by the patient who is being investigated or prosecuted. Another commenter noted that the definition of a serious crime may not capture a prescriber who acts as a rogue doctor because that action may not “directly threaten(s) loss of life or serious bodily injury.” Many commenters expressed concern about expanding the definition of serious crimes to include drug trafficking. Further, several commenters believed that removal of the phrase “allegedly committed by the patient” would reach too broadly to implicate individuals other than the patient or the prescriber in drug trafficking.

Response: The 1987 final rule did not restrict the disclosure of SUD treatment records under section 2.63 only to the investigation of extremely serious crimes “allegedly committed by the patient.” We believe that the commenters are referring to the discussion in the 1987 final rule of section 2.65, which narrowly did address court orders for the disclosure of SUD treatment records to investigate a patient for an extremely serious crime. We do not believe the change that is being finalized will affect the meaning of an “extremely serious crime.” Pursuant to the current regulation at section 2.63(a)(2), the term “extremely serious crime” includes those crimes that “directly threaten. . .loss of life or serious bodily injury.” Thus, where drugs are being trafficked through an SUD treatment clinic in a way that directly threatens loss of life or serious bodily injury, that activity would qualify as an “extremely serious crime.”

Comment: A few commenters argued that the proposed change would broaden the scope of law enforcement ability to investigate part 2 programs while criminalizing treatment, with some stating that this proposal permits Federal law enforcement to conduct fishing expeditions and broadly search part 2 patient records for criminal activity. Several commenters feared that the proposed provision could be misused or abused by law enforcement officials. Specifically, commenters expressed concern that law enforcement officials may subject patients to harassment, bullying, or misguided and dangerous tactics, including operating outside the boundaries of a part 2 facility to gather information (such as parking outside of treatment programs to identify patients who might have outstanding warrants). A few commenters suggested that patients on medication might be subjected to Driving While Intoxicated tests. A few commenters emphasized that this high-risk population is fearful and distrustful of law enforcement due to past mistreatment of those with SUD or previous fabrication of cases. The commenters asserted that many people with mental health challenges are part of minority groups or marginalized communities whose interactions with law enforcement are problematic (even lethal) or that that agencies may not be properly trained to handle substance use treatment and addiction issues.

Response: The change to section 2.63 (removing the words “allegedly committed by the patient”) that is being finalized would restore the regulatory text to what it was for 30 years prior to the 2017 final rule. The change in the 2017 final rule was made in error. The authorizing statute (42 U.S.C. 290dd-2) and the regulations promulgated thereunder (42 CFR part 2) contain various safeguards against misuse of SUD treatment records. And the regulations specifically provide that “[t]he patient records subject to the regulations in this part may be disclosed or used only as permitted by the regulations in this part and may not otherwise be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any Federal, state, or local authority. Any disclosure made under the regulations in this part must be limited to that information which is necessary to carry out the purpose of the disclosure.” 42 CFR 2.13(a). Further, disclosure under this section is subject to the careful review of a court that would presumably consider the impact on patients and other factors before making a decision on whether to issue an order authorizing the disclosure.

Comment: Several commenters stated that the proposed change would violate the language or the purpose of the enabling statute. A few commenters believed that the proposal is outside of the authority of the agency.

Response: Under 42 U.S.C. 290dd-2(b)(2)(C), the content of an SUD treatment record may be disclosed without patient consent if authorized by the order of a court of competent jurisdiction for good cause; thus, we believe that this change does not violate the language of the enabling statute, nor do we believe that the change would broaden the scope of law enforcement beyond what is authorized in the statute. The change would merely restore the regulatory text to what it was for 30 years prior to the 2017 final rule.

Comment: Many commenters stated that the proposed rule offered insufficient evidence to support the claim that the phrase “allegedly committed by the patient” hindered Federal law enforcement efforts targeted at rogue doctors and pill mills. A few commenters specifically requested examples to demonstrate this language has been used by law enforcement prior to 2017 for the investigation or prosecution of crimes committed by the patient, the program, or the patient's providers. Other commenters requested that HHS first utilize existing information obtained through the DEA registration process to target rogue doctors and pill mills as opposed to expanding law enforcement access to part 2 patient records for similar information. Several commenters believed the existing law enforcement levers were sufficient for addressing law enforcement concerns, with some suggesting that the DEA take a more active role in identifying and addressing pill mills and rogue doctors.

Response: The change to section 2.63 (removing the words “allegedly committed by the patient”) that is being finalized would restore the regulatory text to what it was prior to the 2017 final rule. The change in the 2017 final rule was made in error. If left in its current form, the rule would hamper or impede Federal law enforcement efforts in situations where an individual other than the patient committed an extremely serious crime, such as one which directly threatens loss of life or serious bodily injury, and access to SUD treatment records is necessary in connection with the investigation or prosecution of that extremely serious crime. Detailed examples of pre-2017 instances of law enforcement using section 2.63 would be difficult to provide, in part because disclosure of patient records in these situations is typically done under seal. Regardless, we do not believe that a change to section 2.63 that was made in error two years ago should change the law enforcement practices of thirty years of prior precedent. The use of DEA's legal authority or records is outside of the scope of this final rule.

Comment: A few commenters expressed concern that the proposed change would impact prescriber willingness to appropriately prescribe opioids. Several commenters expressed concern that the proposal will deter clinicians from taking on perceived risks associated with providing SUD care. Likewise, several commenters expressed concern that opioid prescription volume might be used to inappropriately implicate prescribers in diversion activities, noting that prescription volumes were not reliable indicators of diversion for non-medical use. Similarly, several commenters believed it inappropriate to seek information on prescriber behavior (e.g., rogue doctors, pill mills) by searching patient records.

Response: We understand that opioid prescribing volume is not the only indicator of diversion for non-medical use of opioids, and we do not believe that the change to section 2.63 that we are finalizing would indicate otherwise.

Comment: One commenter suggested several alternatives to the current proposal, including requiring independent, office-based buprenorphine practitioners to be regulated and licensed by Single State Authorities, requiring compliance with best practices including addiction treatment counseling, and requiring the elimination of cash payments. Another commenter suggested the addition of explicit language to address “serious crime allegedly committed by either (a) the patient; (b) the part 2 program holding the records containing the confidential communications, or (c) employees or agents of that part 2 program.” Yet another commenter cited examples from state law that requires manufacturers of Schedule II or III controlled substances, including opioids, to participate in a drug stewardship program to collect, secure, transport and safely dispose of unwanted drugs to deter trafficking. A few commenters believed that there are evidence-based public health solutions available to address the opioid epidemic and law enforcement is not one of these solutions. One commenter recommended that instead of investigating providers for drug-related crimes, providers could proactively participate in voluntary certification processes formed through Joint Commission, American Society of Addiction Medicine, California Society of Addiction Medicine or HHS.

Response: There are many potential actions to curb illegal prescribing activity that contributes to the proliferation of pill mills. We believe the correction to section 2.63 is one of the many necessary steps that may help reduce and deter drug trafficking at or from part 2 programs because it would allow law enforcement to request a court order to obtain confidential communications that could support claims of drug trafficking and patient exploitation within a part 2 program. We will continue to explore additional interventions and alternatives for curbing the opioid crisis within our legal authority.

Comment: Many commenters expressed broad concern about the proposal eroding or undermining patient privacy rights or the confidentiality of records. Likewise, many commenters asserted that their privacy would be violated by the proposal, and therefore requested that SAMHSA reject the proposal. Several commenters noted in context that the loss of privacy associated with the proposal would lead to other ill effects either for the commenters themselves, or for patients more broadly, in the form of loss of trust in care providers, diminished willingness to enter or remain in treatment, or increased potential for social stigma and discrimination. A few commenters also stated that the proposal could have negative effects not just on privacy, but also on SUD care or the opioid epidemic in the aggregate. One commenter suggested that the proposal is out of keeping with physicians' confidentiality duty to patients under common law.

Response: While the 2017 error may appear to change the basic privacy protections, there are existing statutory and regulatory provisions related to criminal investigations that protect patient privacy and have not changed. The authorizing statute for part 2 (at 42 U.S.C. 290dd-2(c)) prohibits the use of patient records to initiate or substantiate any criminal charges against a patient, or to conduct any investigation of a patient, except as authorized by a court order granted under subsection (b)(2)(c) of the statute. Subsection (b)(2)(c) of the statute specifies that using patient records to investigate or prosecute a patient requires an order from a court of competent jurisdiction, granted after an application showing good cause, including the need to avert a substantial risk of death or serious bodily harm. The change in the 2017 final rule was made in error, and it does not represent a departure from the basic privacy protections that SUD patients have held under part 2 since 1987.

Comment: Many commenters expressed concern with the 30-day public comment period, stating that the 30 days was not enough time for citizens to analyze, discuss, and respond to the proposal or for HHS to sufficiently collect public feedback. Several commenters believed more time for public comment was warranted given the number of people and organizations that will be affected. Several commenters suggested or stated that the 30-day comment period violated the Administrative Procedure Act. A few commenters said the comment period deprived patients of their procedural rights or the right to participate in commenting. A few commenters also noted that a related NPRM was published on the same day with a 60-day comment period and indicated that it may be difficult for patients to respond to both rules in the allotted timeframe. Another commenter suggested the 30-day comment period indicates that HHS is not truly interested in what the public has to say. Many commenters requested that HHS extend the comment period, with some expressly requesting 60 days, stating that the proposal represented a significant, fundamental or sweeping change to the current regulation.

Response: As noted above, the change to section 2.63 (removing the words “allegedly committed by the patient”) that is being finalized would restore the regulatory text to its pre-2017 language. We believe that a 30-day comment period for correction of an inadvertent error is consistent with section 553 of the Administrative Procedure Act, and we believe that the 30-days comment period was a sufficient amount of time for commenters to submit their written data, views, or arguments on a straightforward proposal.

Comment: A few commenters raised concerns that public comments submitted for the rule were not posted until almost the end of the comment period. A few commenters also remarked that the website for submitting comments did not work properly during the comment period.

Response: Regulations.gov is provided as a public service to increase participation in the government's regulatory activities by offering a central point for submitting comments on regulations. The agency reviews all comments for their appropriateness before posting, which sometimes may lead to a delay in posting. Although we regret that technical issues at times may have prevented individuals from submitting a comment on Regulations.gov, the Proposed Rule provided a physical mailing address where comments could be mailed. We believe that any technical issues with the website that individuals may have experienced were promptly resolved.

Comment: Many commenters asserted that the proposal would deter patients from entering and/or staying in SUD treatment and that this deterrence would more broadly negatively impact society, potentially making the opioid epidemic worse, causing overdoses and opioid-related mortality to increase, increasing crime rates and/or recidivism, or increasing communicable diseases. Several commenters also suggested that the deterrence of SUD treatment would exacerbate disparities in access to care for low-income communities. Other commenters expressed concern that the proposal would deter people from seeking or staying in SUD treatment. Several commenters suggested that if the proposal is finalized, then the only rational SUD treatment options would become “off the grid” self-help settings; one commenter stated that SUD patients had communicated the intent to stockpile MAT medications in case the proposal goes through, so as to be able withdraw from treatment in that case.

Response: As noted above, while the 2017 error may appear to change basic privacy protections, there are existing statutory and regulatory provisions related to criminal investigations that protect patient privacy and have not changed. The authorizing statute for part 2 (at 42 U.S.C. 290dd-2(c)) prohibits the use of patient records to initiate or substantiate any criminal charges against a patient, or to conduct any investigation of a patient, except as authorized by a court order granted under subsection (b)(2)(c) of the statute. Subsection (b)(2)(c) specifies that using patient records to investigate or prosecute a patient requires an order from a court of competent jurisdiction, granted after an application showing good cause, including the need to avert a substantial risk of death or serious bodily harm. Thus, we do not believe that an error made two years ago should alter the privacy and clinical practices of thirty years of prior precedent, nor should this reversion deter patients from treatment because of these concerns. Furthermore, part 2 regulations contain various safeguards to assure patients that their confidentiality and privacy will be protected and that such confidentiality and privacy will not be abrogated absent just and sufficient cause.

Comment: A few commenters expressed concern that the proposal may enable housing, legal, educational, employment, and insurance discrimination or may help to discriminate against those seeking social services. Other commenters stated that the proposal could impact child custody agreements and could put patients at risk in civil proceedings including divorce and child custody proceedings.

Response: As noted above, the change to section 2.63 that is being finalized would restore the regulatory text to what it was prior to the 2017 final rule. The change in the 2017 final rule was made in error, and correcting the error does not represent a departure from the basic privacy protections that SUD patients have held under Part 2 since 1987. Moreover, the authorizing statute (42 U.S.C. 290dd-2) and the regulations promulgated thereunder (42 CFR part 2) contain various safeguards against misuse of SUD treatment records. And the regulations specifically provide that “[t]he patient records subject to the regulations in this part may be disclosed or used only as permitted by the regulations in this part and may not otherwise be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any Federal, state, or local authority. Any disclosure made under the regulations in this part must be limited to that information which is necessary to carry out the purpose of the disclosure.” 42 CFR 2.13(a). Thus, we do not believe that a change that was inadvertently made two years ago would alter the privacy and clinical practices of thirty years of precedent, nor should it deter patients from treatment because of these concerns.

Comment: A few commenters suggested specific training on substance use disorders for both law enforcement and medical professionals as a way to combat stigma. One commenter recommended that SAMHSA provide education for providers, health systems, and law enforcement to clarify the regulations.

Response: HHS appreciates this suggestion and will consider training opportunities for law enforcement and medical professionals on SUD records and the applicability of the part 2 regulations.

Comment: Many commenters objected to the proposed change because they believe it will allow personal or sensitive health information to be used for criminal justice purposes. More specifically, commenters said the proposal would enable information to be used to investigate, implicate or prosecute patients or their families, friends, or associates, as well as prospective patients, people in recovery, and/or treatment programs/providers. A few commenters said that treatment itself would become a tool of law enforcement. A few commenters said there was no reason to use substance use disorder information against patients, or to share it for the purposes of prosecuting people who want to turn their lives around. A few commenters believed the proposal could lead to self-incrimination by patients, especially among those who are legally ordered to obtain treatment or pregnant women in states that criminalize substance use during pregnancy. One commenter inquired as to what would prevent prosecution of a person who inadvertently confesses to a crime or knowledge of a crime. Another inquired as to which parts of a medical record would be excluded, and how information from an alcohol- or chemically impaired individual would be used.

Response: HHS understands the concerns expressed by commenters. The authorizing statute for Part 2 (at 42 U.S.C. 290dd-2(c)) prohibits the use of patient records to initiate or substantiate any criminal charges against a patient, or to conduct any investigation of a patient, except as authorized by a court order granted under subsection (b)(2)(c) of the statute. Subsection (b)(2)(c) of the statute specifies that using patient records to investigate or prosecute a patient requires an order from a court of competent jurisdiction, granted after an application showing good cause, including the need to avert a substantial risk of death or serious bodily harm. However, part 2 does not serve as an absolute shield for a patient's criminal activity. For example, part 2 regulations expressly permit disclosures related to crimes committed on program premises. As stated elsewhere in this final rule, HHS is reverting back to the pre-2017 language for this section, in order to remove wording that may hinder the ability of law enforcement to target rogue doctors and pill mills, for example, that are contributing to the opioid epidemic.

Comment: Many commenters expressed blanket opposition to the proposal. Several commenters indicated that they would be opposed to any changes to 42 CFR part 2 overall. A few commenters noted that while they are open to updates to 42 CFR part 2, they are opposed to the updates in this proposal.

Response: As described previously, HHS believes reverting to the previous language for this section will correct an inadvertent error in the 2017 final rule, by restoring the section to what it was for thirty years following the 1987 final rule. Moreover, correcting the erroneous addition of the phrase “allegedly committed by the patient” may remove a stumbling block to future law enforcement efforts targeting extremely serious crimes, which is a separate substantive reason for the correction.

Comment: A few commenters requested additional clarification about the proposal. One commenter inquired whether patients would be notified if their records were disclosed. One commenter requested additional information regarding the use of records, specifically whether patients can opt out, in what context their records can be used, how often the records can be accessed, and how long the records are available for law enforcement use.

Response: Although a patient cannot opt out of disclosure under § 2.63, the authorizing statute (42 U.S.C. 290dd-2) and the regulations promulgated thereunder (42 CFR part 2) contain various safeguards regarding the use and disclosure of SUD treatment records for law enforcement purposes. The regulations specifically provide that “[t]he patient records subject to the regulations in this part may be disclosed or used only as permitted by the regulations in this part and may not otherwise be disclosed or used in any civil, criminal, administrative, or legislative proceedings conducted by any Federal, state, or local authority. Any disclosure made under the regulations in this part must be limited to that information which is necessary to carry out the purpose of the disclosure.” 42 CFR 2.13(a).

Comment: A few commenters expressed concern about the proposal's impact on psychotherapy notes and requested further guidance to determine how requirements for psychotherapy notes will or will not interact with this proposal. Specifically, these commenters noted that it is unclear if law enforcement authorities will have access to patients' psychotherapy notes that are written by behavioral health providers who treat SUD patients in part 2 programs, in addition to the patients' mental health and SUD records, as HIPAA requirements recognize that psychotherapy notes are usually separated from the patient's health record.

Response: Law enforcement may only access psychotherapy notes if all applicable requirements under part 2 and, if applicable, the HIPAA Privacy Rule are met. This final rule will not weaken the privacy protection for psychotherapy notes held by part 2 programs, if portions of those notes are subject to part 2. Part 2 requires that a court order be accompanied by a subpoena to compel disclosure, while the HIPAA Privacy Rule permits a covered entity to disclose records when required by law or with a court order or a subpoena unaccompanied by a court order, when certain conditions are met (See 45 CFR 164.512(a) and (e)). To the extent that a portion of a patient's part 2 record is also considered protected health information under the HIPAA Privacy Rule, a disclosure would need to meet the requirements of both rules.

IV. Regulatory Impact Analysis

HHS has examined the impacts of this final rule as required by Executive Order 12866 on Regulatory Planning and Review (September 30, 1993), Executive Order 13563 on Improving Regulation and Regulatory Review (January 18, 2011), the Regulatory Flexibility Act (Pub. L. 96-354), the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4), Executive Order 13132 on Federalism (August 4, 1999), and Executive Order 13771 on Reducing Regulation and Controlling Regulatory Costs (January 30, 2017). HHS does not believe the change constitutes an unfunded mandate, additional regulatory activity or imposes a cost or economic burden on part 2 programs.

Executive Orders 12866, 13563, 13132, and 13771.

Executive Order 12866 directs agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health, and safety effects; distributive impacts; and equity). Executive Order 13563 is supplemental to, and reaffirms the principles, structures, and definitions governing regulatory review, as established in Executive Order 12866. The change that is being finalized in this final rule will not have an annual effect on the economy of $100 million or more in at least one year. HHS notes that this change does not constitute a significant regulatory action under Executive Order 12866. The minor change to section 2.63(a)(2) that is being finalized will have no discernible economic impact, will not alter program budgets or obligations of grant or loan recipients, and raises no novel legal or policy questions. Indeed, as explained, this final rule reverts to the pre-2017 language for this section, which had remained unchanged for more than 30 years.

Executive Order 13132 establishes certain requirements that an agency must meet when it promulgates a proposed rule (and subsequent final rule) that imposes substantial direct requirement costs on state and local governments, preempts state law, or otherwise has Federalism implications. This final rule does not impose any costs on state or local governments or preempt state law; therefore, the requirements of Executive Order 13132 are not applicable.

Executive Order 13771 directs Agencies to identify at least two existing regulations to repeal for every new regulation unless prohibited by law. The total incremental cost of all regulations issued in a given fiscal year must have costs within the amount of incremental costs allowed by the Director of the Office of Management and Budget, unless otherwise required by law or approved in writing by the Director of the Office of Management and Budget. This rule is not expected to lead to the promulgation of a rule constituting a “regulatory action” under Executive Order 13771 because the final rule is fixing a procedural error from a prior rulemaking and does not impose burden on regulated entities. The addition of the phrase “allegedly committed by the patient” was not a logical outgrowth of the 2016 NPRM proposals, or of comments received thereon, and it was added in error to the regulatory text of section 2.63.

Regulatory Flexibility Act

The Regulatory Flexibility Act (RFA) requires agencies that issue a regulation to analyze options for regulatory relief of small businesses if a rule has a significant impact on a substantial number of small entities. The RFA generally defines a “small entity” as (1) a proprietary firm meeting the size standards of the Small Business Administration; (2) a nonprofit organization that is not dominant in its field; or (3) a small government jurisdiction with a population of less than 50,000. (States and individuals are not included in the definition of “small entity”). HHS considers a rule to have a significant economic impact on a substantial number of small entities if at least five percent of small entities experience an impact of more than three percent of revenue. HHS determines that this rule does not have a significant economic impact on a substantial number of small entities. The rule would merely correct an erroneous change made in 2017 to, and restore the pre-2017 language to, the longstanding provision in 42 CFR 2.63, in order to avoid a possible interpretation that could hamper or impede Federal enforcement efforts in the fight to address the opioid crisis, including investigations that involve disclosures of Part 2 program records authorized by court orders. As such, this final rule will have a de minimis, if any, impact on small entities.

Unfunded Mandates Reform Act

Section 202(a) of the Unfunded Mandates Reform Act of 1995 requires that agencies prepare a written statement, which includes an assessment of anticipated costs and benefits, before proposing “any rule that includes any Federal mandate that may result in the expenditure by State, local, and tribal governments, in the aggregate, or by the private sector, of $100,000,000 or more (adjusted annually for inflation) in any one year.” In 2019 that threshold level is approximately $154 million. HHS does not expect the rule to exceed the threshold.

Paperwork Reduction Act

Under the Paperwork Reduction Act of 1995 (PRA), agencies are required to provide a 60-day notice in the Federal Register and solicit public comment before a collection of information requirement is submitted to the Office of Management and Budget (OMB) for review and approval. The change in this rulemaking would result in no new reporting burdens.

Congressional Review Act

Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), the Office of Information and Regulatory Affairs designated this rule as not a major rule, as defined by 5 U.S.C. 804(2).

List of Subjects in 42 CFR Part 2

• Alcohol abuse
• Alcoholism
• Drug abuse
• Grant programs—health
• Health records
• Privacy
• Reporting and recordkeeping requirements

For the reasons stated in the preamble, HHS amends 42 CFR part 2 as follows:

PART 2—CONFIDENTIALITY OF SUBSTANCE USE DISORDER PATIENT RECORDS

1. The authority citation for Part 2 continues to read follows:

Authority: 42 U.S.C. 290dd-2.

Subpart E—Court Orders Authorizing Disclosure and Use

§ 2.63

[Amended]

2. Amend § 2.63(a)(2) by removing the phrase “allegedly committed by the patient”.

* * * * *

Dated: August 27, 2020.

Elinore F. McCance-Katz,

Assistant Secretary for Mental Health and Substance Use, Substance Abuse and Mental Health Services Administration.

Approved: September 30, 2020.

Alex M. Azar II,

Secretary, Department of Health and Human Services.

Footnotes

1.  See 82 FR 6052, 6061 (January 18, 2017).

2.  Centers for Disease Control and Prevention (n.d.). Understanding the Epidemic. Retrieved from https://www.cdc.gov/​drugoverdose/​epidemic/​index.html.

3.  The Council of Economic Advisers (2017). Retrieved from https://www.whitehouse.gov/​sites/​whitehouse.gov/​files/​images/​The%20Underestimated%20Cost%20of%20the%20Opioid%20Crisis.pdf.

4.  Office of National Drug Control Policy (n.d.). Retrieved from https://www.whitehouse.gov/​ondcp/​presidents-commission/​.