People eligible for both Medicare and Medicaid experience co-occurring substance use disorders and chronic pain at rates as much as six times higher than Medicare-only beneficiaries or Medicaid-only adults with disabilities, which puts them at higher risk for opioid misuse or addiction. Health plans serving dually eligible individuals play a key role in treatment and recovery by providing care management for their members, who may be receiving services from multiple sources. However, the legal restrictions under 42 CFR Part 2 and its underlying statute — which protect patient confidentiality by regulating the ability of substance use disorder treatment providers to share patient information — make it challenging for plans to provide good care management.
Recently, the health plans participating in Promoting Integrated Care for Dual Eligibles (PRIDE) — a national initiative led by the Center for Health Care Strategies and supported by The Commonwealth Fund — asked two national experts, Robert Belfort and Alexander Dworkowitz of Manatt, Phelps & Phillips, LLP, about how health plans can work within the law to get the information needed to help members with opioid use disorder while maintaining confidentiality. Following are responses from these two experts to questions posed by PRIDE plans* about information-sharing challenges they have faced.
Disclaimer: The information in this blog post is for educational purposes only. Health plans and providers should consult their own legal advisors.
Information Sharing for Grant Oversight
Q: Health Plan A funded a county agency that provides detoxification services to develop a more integrated withdrawal management model for its dually eligible members. The county agency will not provide the plan with any information on its members using detoxification services (e.g., name, date of birth, dates of program entry and discharge, etc.), citing 42 CFR Part 2. How can the plan work within existing laws and regulations to obtain the information it needs to evaluate the impact of these new services on its members?
A: The plan should be able to access this member information. 42 CFR Part 2 contains an exception (42 CFR Section 2.53) for providers to share information for audit and evaluation purposes with any entity that is a third-party payer or otherwise provides financial assistance to the provider. The plan and the Part 2 provider would need to adhere to the requirements for that exception (e.g., maintain and destroy information consistent with Part 2, comply with limitations and rules, etc.).
If the county does not agree to the plan’s exception request under Section 2.53, the plan could suggest the use of a third-party vendor to create a de-identified data set using a coded link between the provider’s data and the plan’s data. A provision under the rule allows for “qualified service organizations” (42 Section 2.11) that are vendors to Part 2 providers to receive information if, by doing so, they are solely carrying out a function on behalf of the Part 2 provider. The provider would sign an agreement with the vendor to make the vendor a qualified service organization and business associate of the provider, and the plan would sign an agreement with the vendor to allow the vendor to act as a business associate of the plan.
Another possible mechanism to ensure the plan’s ability to access information would have been if it had sought — at the outset of the grant — an exception to 42 CFR Part 2 for research purposes (42 CFR Section 2.52). This exception allows the sharing of information by Part 2 providers with HIPAA-covered entities as long as certain requirements are met (e.g., the research protocol is approved by an independent review agency, patients authorize the release of their information, etc.).
Patient Consent for Information Sharing
Q: Health Plan B would like to share information about its members who are in treatment for substance use disorders with primary care physicians to provide better coordination and communication around members’ care. To do this, the plan would need to confirm that the Part 2 treatment providers have a patient’s signed consent form on file permitting information release. How can the plan encourage substance use disorder providers to collect and keep patient consent forms on file?
A: Information sharing for care coordination purposes is more complicated than for oversight — there is no exception to Part 2 rules for care coordination as there is for audit/evaluation or research. A 2017 update to 42 CFR Part 2 allows — in certain circumstances involving electronic exchanges — for the use of consent forms that do not name all information recipients, but the requirement to obtain patient consent for purposes of treatment and care coordination remains in place.
Individual providers may not appreciate, as the plan can, how difficult it is to coordinate a member’s care across multiple providers without the patient’s consent to share information. Assuming that Part 2 providers are part of the plan’s contracted network, the plan could consider imposing requirements on them to try to obtain patient consent under its network contracts. While a plan cannot mandate that providers actually obtain patients’ consent for information sharing, the plan could supply the providers with a model form, require that the providers ask patients to provide consent, and then require that copies of any executed consent forms be returned to the plan. If a Part 2 provider did not comply with these conditions, the plan could impose penalties or exclude the provider from its network.
Ideally, the consent form would grant permission to the provider to share information not just with the plan, but also with the individual’s primary care provider and specific hospitals or mental health clinics that also regularly provide services to that individual. However, plans should appreciate the administrative burden that this would place on providers, and could help by pre-filling consent forms to list all the member’s known providers as potential recipients of information.
Another option is for the plan to reach out directly to members to obtain their consent. Consent does not have to be obtained by Part 2 program itself as long as the consent includes all the required elements (FAQ Number 11).
Information Sharing for Care Management
Q: Health Plan C’s care management team sometimes receives calls directly from members who are having a mental health crisis or learns that members have been seen in the emergency department for an overdose. The care team would like to share this information with the members’ substance use disorder treatment providers, but believes that 42 CFR Part 2 prevents it from doing so. Can this information be shared?
A: In general, the information sharing restrictions in 42 CFR Part 2 only apply to programs (42 Section 2.11) that hold themselves out as providing substance use disorder treatment. The health plan and its staff would not be subject to Part 2, nor would the emergency department of a general hospital — even though it may provide some treatment for substance use disorders — because it does not specifically hold itself out as providing these services. The plan’s care management staff can share information about members who the staff know are under care for substance use disorders with the substance use disorder treatment providers; however, the substance use treatment providers cannot share information with the health plan for care coordination purposes without the individual’s signed written consent.
Incentives for Information Sharing
Q: Health Plan D struggles with how to provide good care management to members after their discharge from a county-based detoxification program, because the program will not tell the plan when members are in treatment. The plan has tried to obtain consent for information sharing directly from members, but since most of its care management activities are done telephonically, this has been difficult. What are the plan’s options?
A: One approach is to contact the detoxification program, and: (a) ask it to seek the individual’s consent if he or she is indeed being treated there; and (b) if consent is obtained, to contact the health plan. The health plan does not ask the detoxification provider to confirm or deny if it is treating the individual. Thus, the program can do this without violating Part 2.
Another option would be to take the contracting-based approach described in the response to Plan B’s question. Health plans can try to incentivize Part 2 providers to obtain their patients’ consent for information sharing. This is more difficult when the plan does not pay for the substance use disorder treatment services — that is in states in which substance use disorder treatment is carved out of Medicaid managed care contracts.
When plans do pay for these services, they have more leverage with providers. It is possible to create a value-based payment arrangement in which the plan would provide a bonus to substance use disorder treatment providers that accomplish certain goals (e.g., reduce hospital readmissions; ensure patients keep appointments with primary care physicians; etc.). This type of arrangement might motivate a provider to obtain patient consents that would facilitate care coordination.
The issues with 42 CFR Part 2 faced by the Medicare-Medicaid Plans and Dual Eligible Special Needs Plans in the PRIDE project are likely also encountered by other types of plans serving other populations. The information-sharing strategies discussed here may be useful in providing good care management for all health plan enrollees with opioid use disorder.
*The PRIDE plans include BlueCare Plus Tennessee (Tennessee), CareOregon (Oregon), CareSource (Ohio), Commonwealth Care Alliance (Massachusetts), Health Plan of San Mateo (California), Independent Care Health Plan (iCare) (Wisconsin), UCare (Minnesota), UPMC for Life Dual (Pennsylvania) and VNSNY CHOICE Health Plans (New York).
Robert Belfort and Alexander Dworkowitz are the authors of Overcoming Data-Sharing Challenges in the Opioid Epidemic: Integrating Substance Use Disorder Treatment in Primary Care, jointly published in July 2018 by the California Health Care Foundation and Manatt.
