AHLA's Speaking of Health Law
AHLA's Speaking of Health Law
Top Ten 2021: Behavioral Health Outlook
Based on AHLA’s annual Health Law Connections article, this special series brings together thought leaders from across the health law field to discuss the top ten issues of 2021. In the eighth episode, Lori Foley, PYA, speaks to Gerald (Jud) E. DeLoss, Illinois Association for Behavioral Health, about the intersection between behavioral health and the rest of health care, especially as it relates to issues of privacy and confidentiality. They discuss changes to SAMHSA’s 42 CFR Part 2, key drivers behind those changes, and how the CARES Act has substantially modified these regulations over the past year. Sponsored by PYA.
To learn more about AHLA and the educational resources available to the health law community, visit americanhealthlaw.org.
The American Health Law Association is pleased to present this special series highlighting the top 10 issues of 2021, where we bring together thought leaders from across the health law field to discuss the major trends and developments of the year. Support for A H L A in this series is provided by P Y A, which helps clients find value in the complex challenges related to mergers and acquisitions, clinical integrations, regulatory compliance, business valuations, and fair market value assessments, and tax and assurance. For more information, visit pya pc.com.
Speaker 2:Hi, this is Lori Foley. I'm a principal with p y a and glad to be with you today. Thank you for joining us today as we discuss the behavioral health 2021 outlook. I'm joined today by Judd. Judd is the c e o of the Illinois Association for Behavioral Health, and a contributing author to the top 10 article that was the genesis of this podcast series. Judd, glad you're here today.
Speaker 3:Thank you, Lori. It's good to be here. Uh, I did wanna make a quick shout out. Uh, my engagement, uh, with a H L A has been over several years as a private practice attorney and, and then joining, uh, the Illinois Association this past July. But, uh, prior to that time, uh, I had the good fortune to work with the behavioral health task force and, and lead up that task force. And, uh, I would, uh, refer, uh, a l a members to the task force for its outstanding, uh, publication materials and, and, uh, other, uh, training resources.
Speaker 2:Absolutely. So it sounds like that probably helped guide some of the thinking. So your, um, context was, I believe, number eight out of a, uh, out of a top 10 list. And behavioral health is just a key issue that we're facing within healthcare. We're facing it nationwide and so many different areas. Um, so today we're gonna spend some time, I think, digging deeper into some of the intersection of behavioral health, where it intersects the legal obligations, particularly related to HIPAA that, um, some of our, um, colleagues may be facing on a, on a regular basis. I know there were a lot of meta modifications made to those regulations within the last year related to confidentiality. Um, how is that impacting your approach and your, um, thoughts about, um, this subject?
Speaker 3:Well, it's, it is a great question, and it really kind of leads into this, this, uh, massive shift in, in how, uh, behavioral health does intersect and integrate with, with the rest of the medical and healthcare world. Uh, for many years it's been siloed off and, and, uh, the changes that were, um, made and have been made, uh, there have been substantial revisions to the, uh, regulations, uh, relating to privacy and confidentiality of, uh, behavioral healthcare information over the past four years. Uh, the goal, uh, the assertive goal was to, uh, integrate that information to provide better treatment, better outcomes, and, and to, uh, uh, ensure that the whole picture of the patient was included rather than having some of it being, uh, segmented off.
Speaker 2:And I probably took a straight to hipaa, but really it's a broader, it's a broader regulation, right? It's, it's broader than just hipaa. In fact, it, some of these changes maybe more align it, but if we step further back and, and go to, um, the substance abuse and mental health services administration changes, what do those look like?
Speaker 3:Yeah, that's, that's an excellent point and, and really has been the focus, uh, of, uh, of a great deal of modifications these past few years. Um, most of the, uh, substance use disorder or addiction information, uh, is covered by a fairly obscure set of federal regulations called 42 C FFR part two. Um, and, uh, those, those regulations, uh, are, are, uh, titled the Confidentiality of Substance Abuse, substance Use Disorder, uh, patient Records. And, uh, they are much more stringent, uh, than HIPAA or any, uh, most other state laws, in fact. Uh, so they have been, um, depending upon your perspective, either, uh, viewed as a, a barrier or, uh, a hurdle towards integrating, uh, the stream or flow of healthcare information, uh, from substance use or, or addiction treatment providers and that, and the, those programs into the medical and healthcare field. Um, although the changes have, have come very slowly because there are, uh, a very, uh, strident group of, of advocates that oppose those changes. Um, the background of, of part two as it's referred to in the industry, uh, is, is the confidentiality was created as the result of, to address the, the issue of, uh, law enforcement finding, uh, patients that had sought treatment at, uh, these addiction treatment facilities, uh, rating them, obtaining copies of the records that demonstrated that they were using illegal substances and then prosecuted them using those, that information. Um, and certainly over the years there have been claims and, and, uh, issues relating towards, uh, the war on drugs and, uh, a lot of other claims that, uh, have, have hardened those positions to maintain the privacy and, and, uh, essentially the, the, the segmentation and, and complete obscurity of the, that information from the rest of the healthcare world. Uh, and there's still those that believe that I, I have worked, uh, on both sides of the equation, especially in, particularly in my position with the association. So I do understand to a great extent, and I do respect those that have, uh, differing views than, than, uh, some, uh, on this issue. Um, but it, it has been, it has been, um, a great deal of change and it has come very rapidly over, particularly over the past two years.
Speaker 2:What were some of, of the key drivers for that change? Was it just the need to be able to integrate or, um, what, what caused what was really the motivation behind that?
Speaker 3:Yeah, I think, I think, uh, the, the integration was one key. Um, the ability to share the information, uh, although the regulations only apply to substance use, uh, programs, uh, as they're defined under the Fed federal regulations, the way that the, the law and alert regulations are applied and interpreted, actually, uh, imposes an obligation downstream. So, uh, to give you an example of, of how 42 CFR part two, part two worked historically, uh, in order to, to share any, virtually any, with, with a, a few minor exceptions, virtually any s u d information outside of that treatment program, patient consent or a court order must be obtained. So that would, uh, apply to a referral to a, a primary care provider to a hospital, uh, for payment purposes with an M C O or health insurer. Uh, any type of, of disclosure would require that sort of, of, uh, process. Now, that's, that's fairly easy, although in the age of electronic, uh, health records consent and having written consent has been obviously a, a hurdle. Uh, but once that information is shared, there is also a prohibition on re-discussing it. So under hipaa, typically you, you, you typically don't need to consent to share information under hipaa. Uh, but once it's released or disclosed or shared, then the recipient, uh, may do with it what they are legally, uh, permitted to do. Uh, in other words, if you have a hospital that releases information to a doctor, the doctor can re-release that information in accordance with HIPAA without an additional consent or notifying the, the patient that that information has been shared. Um, in, in the part two world, in the addiction treatment world, if that information is shared via consent from a a part two program to a doctor, the doctor must go back and get the patient's consent in order to disclose it. And that goes on indefinitely, uh, infinitely. So anytime information was going to be shared and, and could be shared under part two, there had to be a new consent obtained, which obviously, as you can imagine, once you get downstream quite a ways, it's almost impossible to, to, to flow back up and identify where the patient might have been, where they might be. Cuz this isn't necessarily someone that is, is, uh, you know, uh, currently, uh, receiving treatment. It's, it's anyone. Uh, and and in terms of the, the number of years that those, uh, records are, are being held by the, the Part two program, uh, so there were, there
Speaker 2:Were So where some barriers,
Speaker 3:Yeah,
Speaker 2:Where some might have taken treatment, payment and operations for granted, if you will, you know mm-hmm.<affirmative> healthcare providers, behavioral healthcare providers were not that, uh, didn't have that flexibility. It just wasn't a, it wasn't a granted flexibility for T P O. They had to go get all the years of, of protection or permission, it sounds like. So what were some of the key changes that, that have occurred in the last two years that, that have
Speaker 3:Been impactful? Yeah, that's, that's a great question. So, um, this past year, there had been, uh, a couple of, uh, in, in, in 2020, there were a couple of changes, and I'll start with those changes that were made to the regulations themselves, the part two regulations in, in 42, uh, COAF federal regulations, um, in addition to some changes that had occurred previously in the past three, four years, this past, uh, in, in, in 2020, um, the, uh, the regulations went into effect that would open up and provide more flexibility in terms of sharing that information. Uh, so Sam says, sort of whittled away at some of these, these, uh, restrictions and these, uh, requirements. Uh, one of the more interesting, uh, nuances of, of the more recent rule changes was that in order to avoid the application of Part two, Samis, uh, interpreted the regulations to now say that a record which was traditionally, uh, protected under part two, did not include anything that was orally transmitted by the Part two program to the recipient. So, if a doctor was talking to a part two program on the telephone, received information, wrote that down in his or her record, that wouldn't be considered a part two covered, uh, bit of information. If that information had come through fax or an electronic health record transmission of some sort, and it was adopted and incorporated into the, the physician's, uh, medical record or E H R, then it would be covered by part two. So that was one of the more interesting I thought, nuances is, is how they were trying to, uh, make as much change as possible based upon their hands being tied. And, uh, we'll, we'll talk about it in a little bit. The reason their hands were tied is because the underlying enabling statute 42, USC two 90 DD dash two, uh, I've, I've read it enough that I've got it memorized now,<laugh>, um, it's, uh, is, is so precise in, in its requirements and the longstanding interpretations that have been given to that since the 1970s when it was adopted. Uh, so there have been some changes. Another more controversial change, uh, in, in this past year has been, uh, historically, uh, substance use disorder or, or, um, uh, methadone clinics and, and m a t providers, uh, were not, uh, allowed to, in fact, samhsa uh, prohibited them from sharing any of their, uh, prescribing information to the pres, uh, prescription drug monitoring programs that are set up in, in virtually all states. Now. I think Missouri is the only state that doesn't have one. Uh, and those PM pdmp, uh, would track the, the, the, the, uh, prescriptions for controlled substances, the d e A requirements. And so, uh, historically, there has been an entire set of records that were never included in those pdmp. Now, during, under these, uh, recent regulatory changes, there is the ability to share that information. However, it still requires patient consent. And that's really kind of the linchpin of part two is everything, almost everything requires patient consent, and it still does under these regulations, but they are now able to share, uh, that information with the prescription Drug Monitoring programs here in Illinois. Uh, there have been some proposed changes to our, our P D M P to, uh, permit that to happen. Again, with that, with that caveat that the patient has to agree to it, and really there's no way to force them to do so. So it, it, uh, I'm not sure how effective, you know, in the end, it will actually be,
Speaker 2:I know, um, COVID has brought a lot of different changes over the years before we turn to the CARES Act implications, because I know there were some, um, transitions that came through some of the responses to Covid. Any other key items that we haven't touched on that were preliminary, if you will?
Speaker 3:Um, you know, I, I think it, it really, it, it, uh, it, as I said, it, it really was an attempt to, to, um, make as many changes without changing the statute that SAMHSA could, could possibly undertake. And so, uh, it's, it's kind of ironic that the rule changes went into effect because of the CARES Act changes that will, that will, you, you mentioned that we will be talking about. Uh, but, uh, overall, I think that that was the goal. It, it, it appears to me, upon my reading and understanding of, of the Part two changes is let's try to open it, it up as much as possible, uh, to permit that kind of free flow of information. Uh, but in the end, we can only go so far because of our statutory limitations, and Congress must act to make that change.
Speaker 2:And so that tells me if they were able to put forth that change and have it executed within the CARES Act, that somebody had something at the ready, this, this didn't just come through, perhaps at Covid, it was just a good vehicle. And I know times it happens that way, there are all these vehicles to get laws or regulations passed that that might not be consistent with the beginning though, though, I think sharing of information during the covid, uh, and the public Health<inaudible> was, was critical. And this is probably a key piece of that. Um, but how do you translate and, and how did it get to this point that it did come through and there were those changes through the CARES Act?
Speaker 3:Well, it, it, uh, I, I don't wanna bore the listeners with, with, with, uh, stories of, of LO and, and my history and involvement with the Part two changes. But, uh, one of the, one of the more thrilling aspects of my legal career was the opportunity to testify in front, in front of the, uh, energy and Commerce Committee in the us, uh, house of Representatives, and, uh, providing testimony on, on the part two, on part two, and its interaction, as you mentioned, with hipaa. Uh, and the limitations that Part two imposes, uh, that, uh, a lot of providers were trying to deal with was, was really quite a thrill. And, and it really, uh, was an opportunity to educate. Uh, I was very impressed with, with the, the level of, of, uh, engagement by, uh, you know, Congress, uh, men and women from both sides of the aisle, uh, in order to, to obtain a better understanding of part two and how, uh, the changes, uh, would impact, uh, providers as well as, as well as patients. And, uh, and what could be done, uh, to save or protect those key considerations and those key, uh, provisions that were felt to be necessary to prevent, uh, privacy, uh, and, you know, uh, losses of privacy and or, uh, discrimination, uh, in terms of, uh, the use of that information once it was released. And so, uh, yes, there have been a number of attempts to, to change legislation, uh, the, the section two 90 DD dash two that I mentioned, uh, in order to, to allow or permit SAMHSA to craft regulations that were more permissive, uh, or more in alignment with hipaa. And so that had taken place over the past, uh, three, four years at least. Uh, and, and, and prior to that as well, but that's when things really started to gather steam. Uh, we saw a lot of, of, uh, situations, well, I shouldn't say a lot, but there were situations that were heavily publicized where there had been adverse, uh, reactions because information could not be shared with, with other prescribers, and there would be, uh, you know, consequences from that. Uh, we have, uh, heard and, and I've worked with, with, uh, uh, addiction, uh, treatment providers, uh, for a great deal of my career where we as a provider were not permitted to share information, uh, with parents or with other, uh, family members because of the restrictions that part two, uh, imposed. And so, uh, obviously if there was a discharge and a family was not aware of it, and, and bad things happened and deaths occurred, the program's hands were tied. They could not share that information with those, uh, family members. And, and, uh, obviously, uh, there was a, there was an outcry over that type of situation. So a number of changes were made, uh, regulatory wise over the past four years. And then, yes, in March of 2020, in the midst of, uh, the onset of Covid, uh, the CARES Act, uh, created some substantial and, and, uh, substantive changes to the regula, or pardon me, to the legislation, which then, uh, can be imposed, uh, through the regulations.
Speaker 2:So obviously everybody was trying to get their hands around, or their head wrapped around the, the pandemic and their response to it. Things were moving fast, and now we have new regulatory information coming through that they have to adopt in an area that's very regulated and key. What were some key things that came through that regulation, in particular, through the CARES Act that made a big difference?
Speaker 3:Well, as I mentioned, historically, there has been a concern about the ability to, to protect individuals, uh, from use of their, uh, medical records, their, their addiction, uh, medical records in, uh, the court of law. And so part two has historically imposed restrictions on the use of that information unless there is a valid court order. Uh, and the, and the court order process itself is actually very specific and, and, uh, requires a great deal of consideration and criteria to be met before the court can issue a valid part two order, uh, to require disclosure of information. So, um, you know, some of the, the, some of the limitations were in effect and they were beefed up, and then there were new protections that were added that had not, uh, been, uh, within the statute itself before. So, uh, for instance, you know, historically in proceedings, the information could not be shared. It could not be, uh, used or referenced against the, the individual or the, the patient. I guess it'd be a better way to term it. Um, and so the, the, the Care Act changes now, spell out that, that the information can't be used in, in legislative, administrative or legal proceedings, uh, that the information cannot be used to obtain a warrant. The information cannot be used as evidence in any kind of criminal prosecution or civil civil action. Um, and again, there's, there's a, the very, uh, uh, specific court order process that has to be met in order for that information to, to be utilized. And, and I think that was, that was one area. Um, you know, the, the issue has always been, uh, that investigatory, uh, angle and, and, and prohibiting that. I think the other big area that, that really is entirely new within the part two, uh, structure, uh, is the prohibition against discrimination. And historically, um, there has been a great deal of stigma that's been attached to addiction and addiction treatment. And, and that's, uh, some will say that, that, that the stigma has continued because of this entire segmentation and segregation of, of that field from the rest of healthcare, that you can talk about diabetes, you can talk about heart disease, you can talk about all of these medical conditions without, uh, you know, uh, concern of being stigmatized, uh, where addiction has historically had that sort of CD underbelly or, or been seen that way that it is, uh, you know, the, the, the behavior of the individual rather than some type of disease that's causing this, that they are, uh, somehow less worthy of, of treatment and, and of, of consideration. And so there had been, um, they had been cases in the past where even healthcare providers themselves had had discriminated against those that had an, a history of an S u d. Uh, they didn't feel that they were trustworthy. They didn't feel that they could, uh, you know, rely upon what the individual that, what the patient was telling them, that they had to go back and, and look at the actual records to, to make sure that they weren't being lied to or, or, or what have you. And so the CARES Act amendments, uh, it, it, it created an entirely new set of anti-discrimination protections, one, and first and foremost being, uh, you know, access to treatment or, or receiving any kind of treatment or care. Um, there was also an expansion into, into employment and, and hiring and, uh, prohibition against, uh, using that information and hiring, firing or, or any other employment, uh, related decision, uh, I think was, was, uh, a major step forward, uh, to pro protect individuals. Um, the housing, uh, area has historically been an issue for those suffering from mental illness or, or SUVs. And, and, uh, now there's a, a, a specific, uh, protection there, uh, under the a d a, not to get too deep in the weeds, I'm not an a d a lawyer, uh, but under the a d a, the Americans with Disabilities Act, um, you, you could, in terms of employment or in housing, uh, you could say that an addiction was a condition or a disability, but if that individual was using any kind of substance while, uh, employed, then the employer could rely upon that to terminate them. And so these new protections, I think, are broader than that, uh, protection that was available under the A D A. And I think it'll be really interesting to see how that bears out. We don't have any, any regulations yet. This is still, uh, as I mentioned, the the CARES Act was the, the statutory changed two 90 d d um, I mentioned the, the, the courts and, and the restrictions there, but there's also anti-discrimination in ex in gaining access to the courts. And so the court system cannot impose a barrier for an individual, uh, to, to, uh, receive any kind of, uh, or, or to, uh, you know, uh, start a, a new action or whatever the, the situation might be. The courts can, no, can, well, I shouldn't say no longer, they cannot, uh, discriminate, uh, against an individual. And then any kind of, uh, benefit or social services, um, that, uh, the federal, state or, or municipal governments may provide, those cannot be, uh, restricted and, and the individuals cannot be discriminated against in, in, with respect to, uh, to, to those services that they might, uh, receive. It's, it's, it's going to be interesting because it does, it, it, it, it brings about the thought of, okay, how does this really, uh, bear out once these new regulations are created? How, what do those regulations look like? How does that discrimination prohibition, uh, actually, you know, take, take effect. Um, the historically part two has been a criminal statute that's enforceable by, by the US attorney. And so, um, there hasn't been any, uh, criminal enforcement, uh, to speak of. Uh, but there have been, uh, cases involving the interpretation of the statute and of, and of the regulations. This changes it. The, the, the, the CARES Act amendment basically folds enforcement of part two in this, into the same type of structure that HIPAA is. And that includes fines, penalties, uh, that are very specified and, and, uh, steps that can be taken to limit, uh, and, and, uh, mitigate those kinds of, of claims. Uh, there isn't a private right of action under hipaa, and there isn't a private right of action under part two, although evidence you, you could utilize it, I guess is evidence of, of a violation of a, a standard, uh, in order to bring a lawsuit. Um, so those are, those are kind of the big, uh, areas. Um, you know, the, uh, the, the, the, the ACT itself that modified the CARES Act amendment that modified the, the statute did contain some, some guidance, some thoughts and considerations of Congress, um, in terms of when this, this, these, these changes might apply. Um, but, but one of the, the biggest things really that, uh, that I think the, the ACT does and, and, and it lasts, but not least, is that it did align, uh, part two to a great extent with, uh, with hipaa. And so, um, in terms of sharing information, consent is still required, and, uh, it appears that there will never be a change to that requirement. So under hipaa, uh, you mentioned T P O treatment, payment healthcare operations does not require consent by the patient in order to engage in those processes. Under part two, there is still a requirement that they're get there, that the program or provider get that initial consent. And once consent is obtained, then information can be shared in accordance with HIPAA to other covered entities, programs, uh, et cetera. So there's the ability to share that information more freely under kind of the, the protections of HIPAA with other, uh, covered entities, which are healthcare providers, essentially health plans and, and clearinghouses. Um, but there's, there's still that, that initial consent. And so there's, there's kind of a, there, there still remains a limitation, uh, with respect to how that information might be shared outside of that process. Um, there would still need to be a separate consent in order to, to, uh, have that information flow outside of, of, uh, a standard treatment payment or healthcare operation situation. It wouldn't open up, uh, the disclosure of the information to all of the HIPAA exceptions. Uh, so HIPAA has a number, uh, as you probably know very well, Lloyd, that there's a number of exceptions great, that HIPAA doesn't require, obviously any consent requirements, uh, but what the healthcare provider or the health plan may do with that information. There's a, there's a large number, you know, we have legal proceedings. You have, uh, uh, for purposes of, of reporting child abuse and neglect. Um, the, the, the list goes on. Those exceptions do not apply, uh, to, to part two, even under the new statute. So there's still going to be kind of this dual, uh, system of, of, of, of maintaining that information. Um, so it, it, it will open things up to create a greater flow of information, I think, for, for the, the treatment and the payment and operational purposes. Uh, but we'll still have, uh, kind of a two-tier or two track, uh, system for how that, that information is maintained,
Speaker 2:How it gets maintained. So there'll still be some operational implications and such is the, yeah. Um, now that the statute has been changed, is it back on SAMHSA's shoulders to come back and and provide the regulatory guidance?
Speaker 3:Yeah, yeah. The, the changes won't, uh, won't be, uh, uh, uh, published yet. There will be, uh, a notice of proposed rulemaking that's supposed to take place later this year. Um, I have not seen anything on the horizon, no indications of, of anything being, uh, put together yet. Um, uh, but that doesn't mean, mean something couldn't happen, obviously with the change in the administration. Uh, there may be some, some differing, um, thoughts on this. And so obviously SAMSA is well within, its, its, uh, uh, you know, discretion and, and, uh, in order to, to decide how broadly it will propose those regulations, uh, that will be issued.
Speaker 2:So as we, um, wrap up our conversation today, anything else for our colleagues to have on their radar? Obviously, it sounds like looking for that proposed rule, I assume there's a comment period, like most of the, the processes and then everybody waits with dated breath for the final rule to drop to see what was taken into consideration and, and not any parting words that our colleagues should have kind of at the forefront of their minds.
Speaker 3:Well, I, that's, that's a, that's a great question. I, I, I got into behavioral healthcare, uh, through my, my background in health information and, and privacy and, and confidentiality. And I think really that's going to be the issue as we move forward is, is we're making changes to part two under these, these statutory and regulatory revisions. We've got hipaa and there were some changes made to HIPAA more recently as well. Uh, but now that the, the focus may actually, uh, be a little more difficult to track in terms of each state's statute or regulation or, or, or a case law that may apply that restricts the flow of that information, uh, otherwise. And so, uh, you know, stay tuned to, to find out how that's going to be impacted. Uh, you know, most states have specific requirements with respect to mental health information, which is treated differently than addiction information. And so, uh, those are currently in place and, and, uh, each will have to be addressed depending upon, uh, you know, how things, uh, proceed on the federal level. I think it, it really, it ties in very well with, with the, the covid shift to, to telehealth and other types of healthcare delivery models, uh, because these considerations have to be taken into consideration when you're, when you're, you know, uh, planning and, and delivering that healthcare. So yes, stay tuned.
Speaker 2:Well, Judd, I have enjoyed our conversation. Thank you for joining me today, and I hope our listeners have benefited from this discussion. It definitely is a front and center topic, and we covered a lot.
Speaker 3:Happy to do so. It was great to work with you, Lori. Thank you.