42 CFR Part 2 Consent Requirements:Creating Electronic ConsentsFriday, September 15, 2:00 to 3:30 ET
Housekeeping Webinar is being recorded andwill be posted to SAMHSA’sYouTube page All lines are muted–submitcomments via chat Session will conclude with a Q&Asession
PresentersDanielle TarinoPublic Health AnalystSAMHSA Health IT Team9/18/2017Stan PeabodySoftware TesterFEi Systems3
Focus of Today’s Webinar Background on 42 CFR Part 2 42 CFR Part 2 consent requirements SAMHSA’s Consent2Share to show examples how theserequirements can be developed electronically Not a comprehensive training on 42 CFR Part 2 Not comprehensive review of all Consent2Share features9/18/20174
The Current Health Care Environment
Need for Data Segmentation andConsent mplywith clientchoicesComplywith 42CFR Pt. 2
42 CFR Part 2: Overview42 CFR Part 2 regulates the disclosure and use of patientrecords by a federally-assisted program that holds itself out asproviding substance use disorder treatment, diagnosis, and/orreferrals to treatment (as defined in the Rule).
42 CFR Part 2 Origins: Legislation Stigma and fear of prosecution deterredtreatment Intent: To ensure an individual’s right toprivacy and confidentiality Vanguard of personal privacy and thecornerstone of treatment programs
42 CFR Part 2 Origins: The BasicsProtects confidentiality of theidentity, diagnosis, prognosis, ortreatment of any patient recordsmaintained in connection with theperformance of any federallyassisted program or activityrelating to substance abuseeducation, prevention, training,treatment, rehabilitation orresearch.
42 CFR Part 2 Origins: A Key PurposeThe purpose of 42 CFR Part 2 is toensure that a patient receivingtreatment for a substance usedisorder in a Part 2 program is notmade more vulnerable than anindividual with a substance usedisorder who does not seektreatment.
Programs Covered Programs conducted in whole or in part (directly or by contract) byany US department or agency Programs carried out under a license, certification, registration, orother authorization granted by any US department or agencyincluding Medicare providers and DEA licensed entities thatprovide SUD treatment Programs supported by funds provided by any US department oragency as a recipient of federal financial assistance in any form Programs conducted by a state or local government unit thatreceives federal funds that could be spent for SUD Programs allowed federal income tax deductions for contributionsto the program or granted federal tax exempt status by the IRS
Consent Exclusions Medical EmergencyQualified ResearchAudits and EvaluationsCourt Orders for DisclosureDirect Administrative ControlsQualified Service Organizations (QSO)Crime and Law EnforcementChild Abuse/NeglectMinors or Incompetent PatientsCause of Death
Changes Since Original 42 CFR Part 2Law written in 1975 and updated in1987. Since 1987: New models of integrated care Emphasis on information sharingto coordinate care Electronic infrastructure forinformation exchange andelectronic health records Electronic devices to share data
42 CFR Part 2 Revisions and Final Rule Final Rule published in theFederal Register on01/18/17 Federal Register RevisedEffective date: 03/21/2017 Now in e-disorder-patient-records
Revision: Modernize, Facilitate, & ProtectThe final rule is intended to: Modernize the Part 2 rules Facilitate electronic exchange of substance use disorderinformation for treatment and other health care purposes Ensure appropriate confidentiality protections for records thatmight identify an individual, directly or indirectly, as having asubstance use disorder.
42 CFR Part 2: Consent Requirements Generally requires patient consent for disclosures ofprotected health information for the purposes of treatment,payment, or health care operations Consent for disclosure must be in writing Re-disclosures without patient written consent areprohibited, except in certain circumstances or under certainexceptions as described by Part 2PatientConsentConsent inWritingRe-disclosuresw/o ConsentProhibited*
42 CFR Part 2 Consent Requirements, Pg. 1 Name of the entities making thedisclosure (“From”) Name of the entities to receive thedisclosure (“To”) Name of the patient who is the subjectof the disclosure Specific purpose or need for thedisclosure
42 CFR Part 2 Consent Requirements, Pg. 2 How much and what type of information to be disclosed The patient’s right to revoke the consent in writing andexceptions to the right to revoke The program’s ability to condition treatment, payment,enrollment, or eligibility of benefits on the patient The date, event, or condition on which the consent expires The signature of the patient (and/or other authorizedperson) (This may be signed on paper or via e-signature) The date that the consent is signed
Requirement: The “From Whom” ProviderName of the entity makingthe disclosureFrom Whom ProviderMust include the specificname(s) or the generaldesignation(s) of the Part 2program(s), entity(ies) orindividual(s) permitted tomake the disclosure.
Revisions: General DesignationDid not remove the general designation in the “From Whom”section of the consent form but did make terminology changes. The “From Whom” provision of the consent requirementsspecifies that a written consent to a disclosure of patientidentifying information must include the specific name(s) orgeneral designation(s) of the Part 2 program(s), entity(s), orindividual(s) permitted to make the disclosure.
Sally Uses the Authorization Page21
Sally Selects the “From Whom” Provider22
Requirement: The “To Whom” ProviderName of the entities to receivethe disclosureThe name(s) of the individual(s)or the name of theorganization(s) to whomdisclosure is to be madeTo Whom Provider
Requirement: The “To Whom” ProviderIndividual orTreatingEntity To Whom tyNoEntityNoPrimary designationName of individual(s) (e.g., JaneDoe, MD)Name of individual(s) (e.g., JohnDoe)Name of entity (e.g. LakeviewCounty Hospital)Name of entity that is a third-partypayer as specified under§ 2.31(a)(4)(iii)(A) (e.g., Medicare)Name of entity that is not coveredby § 2.31(a)(4)(iii)(A) (e.g., HIE, orresearch institution)Required Additional DesignationNoneNoneNoneNoneAt least one of the following:1. The name(s) of an individual participant(s) (e.g., Jane Doe,MD, or John Doe)2. The name(s) of an entity participant(s) with a treatingprovider relationship with the patient whose information isbeing disclosed (e.g., Lakeview County Hospital)3. A general designation of an individual or entityparticipant(s) or a class of participants limited to thoseparticipants who have a treating provider relationship withthe patient whose information is being disclosedNotes: Patient may choose all providers with a relationship;24patient may designate further to include“past”, “current,”or “future” treating providers; patient may specific one ormore individuals on health care team whom they do nothave a treating provider relationship.
Prohibition on RedisclosureEach disclosure made with the patient's written consent must beaccompanied by the following written statement:This information has been disclosed to you from records protected by federalconfidentiality rules (42 CFR part 2). The federal rules prohibit you frommaking any further disclosure of information in this record that identifies apatient as having or having had a substance use disorder either directly, byreference to publicly available information, or through verification of suchidentification by another person unless further disclosure is expresslypermitted by the written consent of the individual whose information is beingdisclosed or as otherwise permitted by 42 CFR part 2. A general authorizationfor the release of medical or other information is NOT sufficient for thispurpose (see §2.31). The federal rules restrict any use of the information toinvestigate or prosecute with regard to a crime any patient with a substanceuse disorder, except as provided at §§2.12(c)(5) and 2.65.25
Requirement: List of EntitiesWhen using a general designation, a statement must be includedon the consent form that the patient (or other individualauthorized to sign in lieu of the patient), confirms theirunderstanding that, upon their request and consistent with thispart, they must be provided a list of entities to which theirinformation has been disclosed pursuant to the generaldesignation (see §2.13(d)).
Revisions: General DesignationAllows, in certain circumstances, a patient to include a generaldesignation in the “To Whom” section of the consent form. Can be used for those providers who have a treating providerrelationship with the patient Requires an explicit description of the “amount and kind” ofsubstance use disorder treatment information Patients must be informed of their right to obtain a list of entitiesto whom their information has been disclosed The intermediary is responsible for complying with the List ofDisclosures requirement General designation is an option and not a requirement
Requirement: All My Treating ProvidersIf you include a General Designation, you must include options for: Current treating providers Past treating providers, and Future treating providers.
Sally Selects “To Whom” Provider29
Sally Selects the “To” Provider30
Requirement: The Patient NameName of the patient who is the subject of the disclosure Name of the patient 42 CFR does not require it, but patients’ names should be associatedwith a unique identifier number Unique identifier numbers prevent misidentification of patients Consent2Share assigns unique Medical Record Numbers
Sally’s Name Populates after Signin32
Requirement: Purpose of the DisclosureSpecific Purpose or Need for the Disclosure The purpose of the disclosure. In accordance with §2.13(a), thedisclosure must be limited to that information which is necessary tocarry out the stated purpose.
Sally Selects Purpose of the Disclosure34
Sally Selects Purpose of the Disclosure35
Requirement: Amount and KindAmount and Kind ofInformation to be Disclosed How much and what kindof information is to bedisclosed, including anexplicit description of thesubstance use disorderinformation that may bedisclosed.
Amount and Kind Examples All of my substance use disorder information None of my substance use disorder information Only my substance use disorder information specified below: Medications & dosages Diagnostic information (my diagnoses) Lab test results Allergies Substance use history summaries Trauma history summary Employment information Living situation & social supports Claims/encounter data Other
Kind: CategoriesExamples of Part 2 CategoriesDiagnostic InformationMedications and DosagesLab TestsAllergiesSubstance Use HistoryTrauma History SummaryClinical NotesDischarge SummaryEmployment InformationLiving Situation and Social SupportsClaims/encounter Data Examples not requirements The Rule calls these categories The Rule allows such broadcategories, free text, or granularchoices based on standardarchitecture (e.g. C-CDA) orspecific document type (e.g.,Summary of Care record) Data domains may be linked toCDA templates, FHIR resources, orHL7 V2 messages that may beallowed or redacted fromexchange
Sally Selects Medical Information to Share39
Requirement: Consent RevocationThe Patient’s Right to Revoke and Exceptions A statement that the consent is subject to revocation at anytime except to the extent that the Part 2 program or otherlawful holder of patient identifying information that ispermitted to make the disclosure has already acted in relianceon it. Acting in reliance includes the provision of treatmentservices in reliance on a valid consent to disclose informationto a third-party payer
Sally Reviews Revocation Statement41
Requirement: ExpirationThe Date, Event, or Condition on which the Consent Expires The date, event, or condition upon which the consent willexpire if not revoked before. This date, event, or conditionmust ensure that the consent will last no longer thanreasonably necessary to serve the purpose for which it isprovided.
Sally Selects Dates43
Sally Reviews Disclosure Statement44
Requirement: Patient SignatureThe Signature of the Patient The signature of the patient and, when required for a patientwho is a minor, the signature of an individual authorized to giveconsent under §2.14; or, when required for a patient who isincompetent or deceased, the signature of an individualauthorized to sign under §2.15. Electronic signatures arepermitted to the extent that they are not prohibited by anyapplicable law.
Revision: eSignaturesThe Rules now addresses both paper and electronic documentation. Electronic signatures (eSignatures) a permitted to the extent thatthey are not prohibited by any other applicable laws.
Sally Selects eSignature47
Sally First Selects Attestation Box48
Sally Receives Success Notification49
Requirement: Date SignedThe Date that the Consent is Signed The date on which the consent is signed
Sally Confirms Consent and Date51
Privacy and & Best Care: Final Thoughts42 CFR Part 2 and other regulations provide ground rules.How these rules are applied to ensure privacy and the best carerequires careful analysis and monitoring. Who needs what information and when? Who determines who needs what information and when? What are the consequences and outcomes? Comply with all applicable laws: Other parts of 42 CFR Part 2 such as security, etc. Your State laws HIPAA Etc.
Federal Government Resource