As the leading knowledge and technology partner for human services providers nationwide, Netsmart provides expertise, technology, and healthcare connectivity and integration solutions that help addiction treatment, behavioral health and other human services providers deliver effective, outcomes-based services and care to more than 25 million persons nationwide. Netsmart clients include 500,000 users in 24,000 in provider organizations across all 50 states.  Netsmart applauds the Substance Abuse and Mental Health Services Administration (SAMHSA) for its efforts to update and modernize privacy regulations related to the confidentiality of alcohol and substance use treatment records. In developing the Final Rule, SAMHSA faced the significant challenge of balancing statutory limitations and guardrails with the need to address the varying interests of persons with a history of diagnosis, treatment or referral for substance use disorders (SUD) who wish to consent to disclose their medical records to their treating providers, share some of that information, or opt out of such disclosure.

Our analysis of this rule is based on the following principles:

1)  Whether and to what extent a person chooses to share his or her health information is fundamentally a decision that should lie with that person, not the Part 2 program, SAMHSA or the healthcare system. The ultimate goal of consent should be that any person – if they so desire – whether they suffer from a substance use disorder, mental illness, diabetes, cancer or heart disease – have the ability to share his or her health data with their healthcare providers, utilizing today’s technology, with equal simplicity.  The provisions of the Final Rule make this unattainable for the millions of people with substance use disorders.

2)  Many people who have a SUD are reluctant to share their data due to potential impacts on their employment, housing, family lives, relations with child welfare organizations, other personal reasons or just general stigma that is still attached to addiction and substance users.  It is important that those who do not want to share treatment information can easily and effectively carry out his or her desires.  These persons must be able to choose to opt-out (or not opt-in) to a Health Information Exchange (HIE) for sharing their SUD treatment information.

3)  Some persons want to share only segments of their data among their treating providers. Unfortunately, this is not achievable with today’s technology.  While certain electronic health record (EHR) vendors, such as Netsmart, are able to segment data, most other EHR and HIE vendors will need to modify their systems to perform, respond to and manage this type of segmented data. For this to happen, the federal government will need to design the standards and mandate this capability in some form of regulation (like the HITECH Act) and apply it to all EHR, HIE, population health vendors and care coordination providers. The cost of modifying all these systems will be significant. In the best case, Netsmart believes that a robust system capable of supporting this type of segmented data will not be available for 7-10 more years, rendering the potential for this type of data exchange moot for the near future.  In the interim, the vast majority of providers and HIEs will not spend the money to modify their systems to support it.

Unfortunately, the Final Rule retains the original rule’s discriminatory impact on people with a history of diagnosis, treatment or referral for SUD who wish to consent today to disclose their medical records to their treating providers using currently available EHR and HIE technology – just like patients with any other illness or chronic disease. For example, a person receiving treatment for diabetes can consent to share his or her data with their treating providers freely with the protection of HIPAA. But if that same person also has a history of SUD treatment and receives treatment from a provider subject to 42 CFR Part 2, that person cannot consent to share their data in the same way as the person with diabetes alone. This creates a discriminatory and unequal healthcare access playing field for persons receiving SUD treatment or with a history of SUD treatment.

The Final Rule made noteworthy progress in several key areas:

To Whom Consent

The Final Rule allows for a consent for the release of SUD treatment information to be executed to an intermediary, such as an HIE, Accountable Care Organization (ACO), Health Home or other care coordination entity whose members have a treating provider relationship with a patient. This simplifies the consent process by permitting disclosure of SUD information with a single patient consent to past, present, and future providers in a care coordination organization, but protects patient privacy by limiting that disclosure to providers that have a treating relationship with the patient.

 From Whom Consent

SAMHSA agreed with Netsmart’s position and chose not to adopt more stringent From Whom provisions.  The Final Rule allows for disclosure to and among the participants in an intermediary, such as an HIE, ACO, Health Home or other care coordination entity. Retaining the existing From Whom regulations allows for multi-party bi-directional consent to facilitate the exchange of a patient’s information among multiple treating providers. It also allows for re-disclosure between and among treating providers in a care coordination entity.

The rule also fell short in several important areas:

Lack of Parity:  List of Disclosures Requirement

The new simplified To Whom consent process is permitted only if the intermediary party has the ability to track and generate a List of Disclosures, which identifies the recipients of the SUD information for up to the prior two years. The List of Disclosures requirement for SUD information is more robust than the Accounting of Disclosures required under HIPAA.  Although the HITECH Act imposed a duty to account for disclosures for treatment (similar to the List of Disclosures), that requirement has not yet been implemented. In addition, the List of Disclosures must be implemented when the intermediary begins utilizing the general designation under the consent process. This may result in significant delays due to cost and technological limitations. Finally, while SAMHSA does not prohibit it, the agency requests that the costs for the List of Disclosures not be passed on to patients.

So in effect, in addition to not being eligible for HITECH Act Meaningful Use financial incentives in parity with physical health, behavioral health and addiction treatment providers now have a more stringent disclosure list compliance burden than medical providers.

Complex Re-Disclosure

The Final Rule only slightly modified the existing prohibition against re-disclosure, making it clear that only data that directly or indirectly identifies a patient as suffering from an SUD is subject to this prohibition. Any information that could potentially identify the patient as suffering from an SUD, such as name, diagnosis, medications or vital signs, each accompanied by the name of the Part 2 program, would be subject to the prohibition. The Preamble to the Final Rule confirms that the disclosure from one treating provider to another treating provider in an HIE would be considered a re-disclosure. Thus, the consent process described above using the retained From Whom provision is necessary to avoid the prohibition when addressing the disclosure and re-disclosure of SUD information in an HIE or integrated care environment.

Increased Patient Risk

These additional restrictions beyond what a person with a physical illness must endure heighten the risk to patient safety from a harmful drug interaction or other causes by making it more difficult and cumbersome for SUD patients

to consent to share medication history and other vital health information with clinicians/prescribers in the emergency department, urgent care and other primary care facilities. 

Impractical and Unattainable for HIEs

Many HIEs simply don’t have the funding, rules framework or technology to comply with Final Rule requirements, including continued reliance on data segmentation. So while in theory the rule is technologically viable, in the real world the result will be extremely serious:  In all probability the easiest way for most HIEs to respond to the new rule will be to continue to refuse to accept data from patients whose health records include SUD data subject to 42 CFR Part 2 protections, thus barring them from receiving the higher quality of care we are striving for as a nation.


We believe that SAMHSA’s ability to update privacy and consent regulations is constrained by the existing statutes. To overcome this problem, Netsmart will advocate in Congress for statutory changes to better enable needed changes and attain healthcare parity for this at-risk population and the providers who serve them.