On February 5, the Department of Health and Human Services (“HHS”) proposed changes to the Confidentiality of Alcohol and Drug Abuse Patient Records regulations (42 CFR Part 2) “to facilitate information exchange within new health care models while addressing the legitimate privacy concerns of patients seeking treatment for a substance use disorder.” While HHS is proposing to modernize this archaic regulation so that providers can share information to better support, integrate and coordinate patient care, which would otherwise require patient consent to disclose, the revised regulation will have little benefit to substance abuse providers treating patients in Florida.
Many substance abuse providers are under the mistaken assumption that if they satisfy the requirements of HIPAA that they can disclose protected health information concerning a patient receiving treatment for a substance abuse disorder. There are two other laws, however – Florida Statute 397.501 and 42 CFR Part 2 (the “Code”) – that also govern the circumstances under which such information can be disclosed and which are much more restrictive than HIPAA. While it is positive news that HHS is seeking to modify the Code with respect to sharing patient information to align with advances in the U.S. health care delivery system, without a parallel change to Florida law and without both Florida law and the Code being modified to include other disclosure provisions, substance abuse providers will continue to have burdensome restrictions that frustrate their business purposes and the treatment of patients.
The proposed revisions to the Code are a sign that the government understands that laws need to adapt to changes in technology and health care delivery models. However, the regulators have failed to account for the surge in nationwide mergers and acquisitions of federally assisted and non-federally assisted treatment providers. The landscape in the substance abuse area is robust, but the laws stifle the ability for investors in Florida to conduct proper due diligence if the seller has not de-identified its patient data.
The heightened interest in the substance abuse market by investors came shortly after laws were passed giving treatment for mental health disorders payment parity with physical disorders. Since potential investors may not necessarily be experts in the mental health industry, and some sellers may not be sophisticated health care systems, they are unaware of the laws that limit the disclosure of such substance abuse information. Investors will not be able to freely conduct due diligence given these restrictive laws. De-identifying patient information is one way that such restrictions can be eased, but many substance abuse providers do not de-identify their patient data and de-identifying such information during the sale process can not only be costly and cause delays, but there are also restrictions on the seller being able to retain a third party to de-identify such information.
Unfortunately, the law is not vague or forgiving. Therefore, providers need to urge regulators to extend the proposed amendments to Florida law and to include reasonable laws that would allow the disclosure of such protected health information in connection with a sale, merger or consolidation.