On August 2, 2019, DOE published a notice in the Federal Register soliciting public comment on its RFI to help DOE determine whether to amend standards for RCWs. 84 FR 37794. Comments were originally due on September 3, 2019. On August 2, 2019, DOE received a comment from Association of Home Appliance Manufacturers (AHAM) requesting a 30 day comment period extension. 1 DOE has reviewed the request and considered the benefit to stakeholders in providing additional time to review the RFI and gather information/data that DOE is seeking. Accordingly, DOE has determined that an extension of the comment period is appropriate, and is hereby extending the comment period by 30 days, until October 3, 2019.

On July 16, 2019, DOE published a notice of proposed rulemaking (NOPR) in the Federal Register soliciting public comment on its grant of a petition for rulemaking and a proposed rule to establish a new product class for dishwashers with a cycle time for the normal cycle of less than one hour from washing through drying. 84 FR 33869. Comments were originally due on September 16, 2019. On August 9, 2019, DOE received a comment from Association of Home Appliance Manufacturers (AHAM) requesting a 60 day comment period extension. 1 DOE has reviewed the request and considered the benefit to stakeholders in providing additional time to review the NOPR and gather information/data that DOE is seeking.

Accordingly, DOE has determined that an extension of the comment period is appropriate, and is hereby extending the comment period by 30 days, until October 16, 2019. Given stakeholders' previous opportunities to comment on the petition when it was initially published on April 24, 2018 (83 FR 17768), DOE feels that the additional 30 days is adequate time for industry members to respond to the NOPR.

I. Policy Objective

The policy objective of the proposed rule is to remove unnecessary and duplicative regulations in order to simplify them and improve the public's understanding of them. Thus, the FDIC is proposing to rescind the regulations in 12 CFR part 390, subpart M, entitled Deposits (part 390, subpart M).

As discussed below, the FDIC takes the view that no revision to other existing regulations is necessary. This approach would simplify and streamline the FDIC's regulations by removing unnecessary provisions that are adequately provided for in other existing statutes and regulations.

The Dodd-Frank Act, signed into law on July 21, 2010, provided for a substantial reorganization of the regulation of State and Federal savings associations and their holding companies. 1 Beginning July 21, 2011, the transfer date established by section 311 of the Dodd-Frank Act, 2 the powers, duties, and functions formerly performed by the OTS were divided among the FDIC, as to State savings associations, the Office of the Comptroller of the Currency (OCC), as to Federal savings associations, and the Board of Governors of the Federal Reserve System (FRB), as to savings and loan holding companies. Section 316(b) of the Dodd-Frank Act  3 provides the manner of treatment for all orders, resolutions, determinations, regulations, and other advisory materials that have been issued, made, prescribed, or allowed to become effective by the OTS. The section provides that if such materials were in effect on the day before the transfer date, they continue in effect and are enforceable by or against the appropriate successor agency until they are modified, terminated, set aside, or superseded in accordance with applicable law by such successor agency, by any court of competent jurisdiction, or by operation of law.

Pursuant to section 316(c) of the Dodd-Frank Act, 4 on June 14, 2011, the FDIC's Board of Directors (Board) approved a “List of OTS Regulations to be Enforced by the OCC and the FDIC Pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act.” This list was published by the FDIC and the OCC as a Joint Notice in the Federal Register on July 6, 2011. 5

Although § 312(b)(2)(B)(i)(II) of the Dodd-Frank Act  6 granted the OCC rulemaking authority relating to both State and Federal savings associations, nothing in the Dodd-Frank Act affected the FDIC's existing authority to issue regulations under the Federal Deposit Insurance Act (FDI Act)  7 and other laws as the “appropriate Federal banking agency” or under similar statutory terminology. Section 312(c)(1) of the Dodd-Frank Act  8 revised the definition of “appropriate Federal banking agency” contained in § 3(q) of the FDI Act, 9 to add State savings associations to the list of entities for which the FDIC is designated as the “appropriate Federal banking agency.” As a result, when the FDIC acts as the appropriate Federal banking agency (or under similar terminology) for State savings associations, as it does here, the FDIC is authorized to issue, modify, and rescind regulations involving such associations, as well as for State nonmember banks and insured State-licensed branches of foreign banks.

As noted above, on June 14, 2011, operating pursuant to this authority, the Board issued a list of regulations of the former OTS that the FDIC would enforce with respect to State savings associations. On that same date, the Board reissued and redesignated certain regulations transferred from the former OTS. These transferred OTS regulations were published as new FDIC regulations in the Federal Register on August 5, 2011. 10 When the FDIC republished the transferred OTS regulations as new FDIC regulations, it specifically noted that its staff would evaluate the transferred OTS rules and might later recommend incorporating the transferred OTS regulations into other FDIC regulations, amending them, or rescinding them, as appropriate. 11

One of the regulations transferred to the FDIC from the OTS was former 12 CFR 557.20, concerning the maintenance of deposit records by State savings associations. 12 That provision was transferred to the FDIC and now comprises part 390, subpart M. The OTS had issued § 557.20 as part of a streamlining of its regulations in 1997. 13 At that time, the OTS regulations included several specific deposit recordkeeping requirements, and the OTS sought to replace those with one provision. In the associated NPR, the OTS explained that “[a]s part of its reinvention effort, OTS is endeavoring to eliminate regulations that are outdated or micromanage thrift operations. For example, OTS proposes to replace several specific deposit-related recordkeeping requirements with a general recordkeeping regulation that is tied more closely to safety and soundness.”  14

The FDIC has conducted a careful review and comparison of part 390, subpart M and other Federal regulations and statutes concerning the maintenance of deposit records at State savings associations. As discussed in Part III of this Supplementary Information section, the FDIC proposes to rescind part 390, subpart M, because the FDIC considers the provisions contained in part 390, subpart M to be unnecessary in light of the applicability of other provisions of Federal statutes and regulations.

The following is a description of existing statutes and regulations that would provide for complete and accurate recordkeeping of deposits and account transactions at State savings associations, obviating the need for a new regulation or amendment of existing regulations upon rescission of part 390, subpart M. Accordingly, the FDIC proposes that §§ 390.230 and 390.231, part 390, subpart M, be rescinded as unnecessary, redundant of, or otherwise duplicative of the provisions of law delineated in 12 U.S.C. 1817(a)(9)); 31 CFR 1020.410(c)(2); 12 CFR part 364, Appendix A II; 12 CFR 330.1(e); and 12 CFR 1005, each discussed individually below.

Section 390.230 simply states that subpart M “applies to the deposit activities of State savings associations.” There is no substantively similar provision in the FDIC's regulations, nor is one necessary. Accordingly, the FDIC proposes that section 390.230 be rescinded.

Former OTS § 557.20, as modified by the FDIC in transferred § 390.231, provided general information on what records should be maintained by State savings associations on their deposit activities. Existing statutes and regulations that are applicable to State savings associations (discussed in greater detail below) already require the maintenance of accurate records of deposits and transactions by State savings associations.

Section 7(a)(9) of the FDI Act  15 provides that “the Corporation shall take such action as may be necessary to ensure that—(A) each insured depository institution maintains; and (B) the Corporation receives on a regular basis from such institution, information on the total amount of all insured deposits, preferred deposits, and uninsured deposits at the institution.” In issuing regulations under that statutory provision, the FDIC has stated that the agency “has a right and a duty” under § 7(a)(9) to require the maintenance of accurate deposit account records and that “requiring covered institutions to maintain complete and accurate records regarding the ownership and insurability of deposits . . . will facilitate the FDIC's prompt payment of deposit insurance and enhance the ability to implement the least costly resolution of these institutions.”  16 Due to the requirements for accurate recordkeeping pursuant to its existing statutory authority, the FDIC takes the position that no new regulation will be needed upon the rescission of part 390, subpart M.

Section 1020.410(c)(2) of title 31, Code of Federal Regulations (CFR), requires banks (defined to include savings associations)  18 to maintain certain records, including “[e]ach statement, ledger card or other record on each deposit or share account, showing each transaction in, or with respect to, that account.” This rule specifically requires that such records be maintained at State savings associations, rather than the merely suggestive language included in part 390, subpart M.

In 1995, the FDIC published 12 CFR 364 as a final rule with an appendix that implements section 39(a) of the FDI Act  20 regarding standards for safety and soundness (Appendix A). 21 The OCC, the FRB, and the OTS also issued their versions of Appendix A. 22 The FDIC's Appendix A II (Operational and Managerial Standards) provides that an institution should have internal controls and information systems that are appropriate to the size of the institution and the nature, scope, and risk of its activities and that provide for, among other things: “timely and accurate financial, operational and regulatory reports.” An Appendix B (regarding information security) was also published to implement § 39 of the FDI Act. 23 Section 364.101 of part 364 provides that Appendix A and Appendix B apply to all insured State nonmember banks, State-licensed insured branches of foreign banks, and State savings associations. FDIC-supervised institutions are required to file quarterly Reports of Condition. 24 In addition, the accounting principles applicable to reports or statements that insured depository institutions file with the Federal banking agencies are required to be uniform and consistent with generally accepted accounting principles. 25

Taken together, part 364 and appendix A constitute the FDIC's long-standing expectations for all prudently managed insured depository institutions, but leave specific methods of achieving these objectives to each institution. Specifically, they provide a framework for sound corporate governance and the supervision of operations designed to prompt an institution to identify emerging problems and correct deficiencies before capital becomes impaired. Pursuant to § 39(e) of the FDI Act, 26 an FDIC-supervised institution's failure to meet the standards may cause the FDIC to require the institution to submit a safety and soundness compliance plan, and if the institution does not comply with its plan, the FDIC will issue an order to correct safety and soundness deficiencies. 27 Hence, in order to accurately report their financial condition, including deposit liabilities, and to meet applicable safety and soundness criteria, insured depository institutions, including State savings associations, must keep accurate and up-to-date records of account transactions and balances.

Part 330 of the FDIC's regulations governs the criteria for deposit insurance coverage at insured depository institutions, including insured State savings associations. Section 330.3(h) of part 330 states that deposit insurance coverage is “a function of the deposit account records of the insured depository . . . which, in the interest of uniform national rules for deposit insurance coverage, are controlling for purposes of determining deposit insurance coverage.” Further, § 330.1(e) defines the term “deposit account records” to include documents such as “account ledgers . . . and other books and records of the insured depository institution . . . which relate to the insured depository institution's deposit taking function.” This existing regulation on criteria for deposit insurance would also require State savings associations to maintain records of their deposit transactions, eliminating the need for part 390, subpart M.

Regulation E, 29 issued by the Bureau of Consumer Financial Protection, relates to electronic fund transfers at financial institutions, including any savings association. 30 It states that “[f]or an account to or from which electronic fund transfers can be made, a financial institution shall send a periodic statement for each monthly cycle in which an electronic fund transfer has occurred; and shall send a periodic statement at least quarterly if no transfer has occurred.”  31 Thus, in order to comply with existing Regulation E, a State savings association must be capable of generating periodic statements for each of its deposit accounts, whether or not electronic transfers are made from that account, again serving the intended purpose of part 390, subpart M.

Accordingly, as explained in the analysis above, the FDIC proposes to remove §§ 390.230 and 390.231, subpart M because these sections are unnecessary, redundant of, or otherwise duplicative of the safety and soundness and other standards described above.

As discussed in part III of this Supplementary Information, the FDIC's part 390, subpart M addresses the maintenance of records of deposit transactions and activities for State savings associations. To remove unnecessary and redundant regulations, one of the stated policy goals of the FDIC, the FDIC proposes to rescind part 390, subpart M as unnecessary and redundant of other applicable statutes and regulations. Under the proposal, subpart M would be rescinded and that subpart reserved for future use.

As explained in detail in Section III of this Supplemental Information section, certain OTS regulations transferred to the FDIC by the Dodd-Frank Act relating to records of deposit transactions and activities are either unnecessary or effectively duplicate existing regulations. This proposal would eliminate one of those transferred OTS regulations.

As of March 31, 2019, the FDIC supervises 3,465 insured depository institutions, of which 39 (1.1%) are State savings associations. 32 The proposed rule primarily would affect regulations that govern State savings associations.

As explained previously, the proposed rule would remove §§ 390.230 and 390.231, subpart M, because these sections are unnecessary, redundant of, or otherwise duplicative of other statutes and regulations, including those relating to safety and soundness. Because these regulations are redundant, rescinding them will not have any substantive effects on FDIC-supervised institutions.

The FDIC invites comments on all aspects of this analysis. In particular, would the proposed rule have any costs or benefits to covered entities that the FDIC has not identified?

The FDIC has considered alternatives to the proposed rule but believes that the proposed amendments represent the most appropriate option for covered institutions. As discussed previously, the Dodd-Frank Act transferred certain powers, duties, and functions formerly performed by the OTS to the FDIC. The FDIC's Board reissued and redesignated certain transferred regulations from the OTS, but noted that it would evaluate them and might later incorporate them into other FDIC regulations, amend them, or rescind them, as appropriate. The FDIC has evaluated the existing regulations relating to the maintenance of deposit account records. The FDIC considered the status quo alternative of retaining the current regulations, but did not choose to do so. The FDIC believes it would be procedurally complex for FDIC-supervised institutions to continue to refer to these separate sets of regulations, and therefore proposes to amend and streamline them in accordance with this proposed rulemaking.

The FDIC invites comments on all aspects of this proposed rulemaking. In particular, the FDIC requests comments on the following questions:

1. Are the provisions of 12 CFR parts 330; 364, Appendix A; and 1005 and 31 CFR part 1020 sufficient to provide consistent and effective requirements related to the maintenance of records of deposit account activities at State savings associations for which the FDIC is the appropriate Federal banking agency? Please provide examples, data, or otherwise substantiate your answer.

2. What negative impacts, if any, can you foresee in the FDIC's proposal to rescind part 390, subpart M?

3. Are existing statutory and regulatory requirements relating to the maintenance of records of account transactions and deposits sufficient to ensure the safety and soundness of insured State savings associations? Please provide examples, data, or otherwise substantiate your answer.

4. Please provide any other comments you may have on the proposal.

Written comments must be received by the FDIC not later than September 25, 2019.

In accordance with the requirements of the Paperwork Reduction Act of 1995 (PRA), 33 the FDIC may not conduct or sponsor, and the respondent is not required to respond to, an information collection unless it displays a currently valid Office of Management and Budget (OMB) control number.

The proposed rule would rescind and remove from FDIC regulations part 390, subpart M. The proposed rule will not create any new or revise any existing collections of information under the PRA. Therefore, no information collection request will be submitted to the OMB for review.

The Regulatory Flexibility Act (RFA) requires that, in connection with a notice of proposed rulemaking, an agency prepare and make available for public comment an initial regulatory flexibility analysis that describes the impact of the proposed rule on small entities. 34 However, a regulatory flexibility analysis is not required if the agency certifies that the rule will not have a significant economic impact on a substantial number of small entities, and publishes its certification and a short explanatory statement in the Federal Register , together with the rule. The Small Business Administration (SBA) has defined “small entities” to include banking organizations with total assets of less than or equal to $550 million. 35 Generally, the FDIC considers a significant effect to be a quantified effect in excess of 5 percent of total annual salaries and benefits per institution, or 2.5 percent of total noninterest expenses. The FDIC believes that effects in excess of these thresholds typically represent significant effects for FDIC-supervised institutions. For the reasons provided below, the FDIC certifies that the proposed rule, if adopted in final form, would not have a significant economic impact on a substantial number of small banking organizations. Accordingly, a regulatory flexibility analysis is not required.

As of March 31, 2019, the FDIC supervised 3,465 insured depository institutions, of which 2,645 are considered small banking organizations for the purposes of RFA. The proposed rule primarily affects regulations that govern State savings associations. There are 38 State savings associations considered to be small banking organizations for the purposes of the RFA. 36

As explained previously, the proposed rule would remove §§ 390.230 and 390.231, part 390, subpart M, because these sections are unnecessary, redundant of, or otherwise duplicative of other statutes and regulations, including safety and soundness standards. Therefore, rescinding subpart M would not have any substantive effects on small FDIC-supervised institutions.

Based on the information above, the FDIC certifies that the proposed rule would not have a significant economic impact on a substantial number of small entities. The FDIC invites comments on all aspects of the supporting information provided in this RFA section. In particular, would this rule have any significant effects on small entities that the FDIC has not identified?

Section 722 of the Gramm-Leach-Bliley Act  37 requires each Federal banking agency to use plain language in all of its proposed and final rules published after January 1, 2000. As a Federal banking agency subject to the provisions of this section, the FDIC has sought to present the proposed rule to rescind part 390, subpart M in a simple and straightforward manner. The FDIC invites comments on whether the proposal is clearly stated and effectively organized, and how the FDIC might make the proposal easier to understand.

The Riegle Community Development and Regulatory Improvement Act of 1994 (RCDRIA) requires that each Federal banking agency, in determining the effective date and administrative compliance requirements for new regulations that impose additional reporting, disclosure, or other requirements on insured depository institutions, consider, consistent with principles of safety and soundness and the public interest, any administrative burdens that such regulations would place on depository institutions, including small depository institutions, and customers of depository institutions, as well as the benefits of such regulations. In addition, new regulations and amendments to regulations that impose additional reporting, disclosure, or other new requirements on insured depository institutions generally must take effect on the first day of a calendar quarter that begins on or after the date on which the regulations are published in final form. 38 The FDIC invites comments that further will inform its consideration of RCDRIA.

Under § 2222 of the Economic Growth and Regulatory Paperwork Reduction Act of 1996 (EGRPRA), the FDIC is required to review all of its regulations at least once every 10 years, in order to identify any outdated or otherwise unnecessary regulations imposed on insured institutions. 39 The FDIC, along with the other Federal banking agencies, submitted a Joint Report to Congress on March 21, 2017, (EGRPRA Report) discussing how the review was conducted, what has been done to date to address regulatory burden, and further measures that will be taken to address issues that were identified. As noted in the EGRPRA Report, the FDIC is continuing to streamline and clarify its regulations through the OTS rule integration process. By removing outdated or unnecessary regulations, such as part 390, subpart M, this rule complements other actions the FDIC has taken, separately and with the other Federal banking agencies, to further the EGRPRA mandate.

For the reasons stated in the preamble, the Federal Deposit Insurance Corporation proposes to amend 12 CFR 390 as follows:

The FAA invites you to send any written relevant data, views, or arguments about this proposal. Send your comments to an address listed under the ADDRESSES section. Include “Docket No. FAA-2019-0609; Product Identifier 2019-NM-054-AD” at the beginning of your comments. The FAA specifically invites comments on the overall regulatory, economic, environmental, and energy aspects of this NPRM. The FAA will consider all comments received by the closing date and may amend this NPRM based on those comments.

The FAA will post all comments received, without change, to http://www.regulations.gov, including any personal information you provide. The FAA will also post a report summarizing each substantive verbal contact received about this NPRM.

The EASA, which is the Technical Agent for the Member States of the European Union, has issued EASA AD 2019-0076, dated March 29, 2019 (“EASA AD 2019-0076”) (also referred to as the Mandatory Continuing Airworthiness Information, or “the MCAI”), to correct an unsafe condition for all Airbus SAS Model A350-941 airplanes. The MCAI states:

EASA AD 2019-0076 describes procedures for modification of the girt bar retention mechanism of the affected doors.

This material is reasonably available because the interested parties have access to it through their normal course of business or by the means identified in the ADDRESSES section.

This product has been approved by the aviation authority of another country, and is approved for operation in the United States. Pursuant to a bilateral agreement with the State of Design Authority, the FAA has been notified of the unsafe condition described in the MCAI referenced above. The FAA is proposing this AD because the agency evaluated all the relevant information and determined the unsafe condition described previously is likely to exist or develop in other products of the same type design.

This proposed AD would require accomplishing the actions specified in EASA AD 2019-0076 described previously, as incorporated by reference, except for any differences identified as exceptions in the regulatory text of this AD.

In the FAA's ongoing efforts to improve the efficiency of the AD process, the FAA worked with Airbus and EASA to develop a process to use certain EASA ADs as the primary source of information for compliance with requirements for corresponding FAA ADs. As a result, EASA AD 2019-0076 will be incorporated by reference in the FAA final rule. This proposed AD would, therefore, require compliance with the provisions specified in EASA AD 2019-0076, through that incorporation, except for any differences identified as exceptions in the regulatory text of this proposed AD. Using common terms that are the same as the heading of a particular section in the EASA AD does not mean that operators need comply only with that section. For example, where the AD requirement refers to “all required actions and compliance times,” compliance with this AD requirement is not limited to the section titled “Required Action(s) and Compliance Time(s)” in the EASA AD. Service information specified in EASA AD 2019-0076 that is required for compliance with EASA AD 2019-0076 will be available on the internet at http://www.regulations.gov by searching for and locating Docket No. FAA-2019-0609 after the FAA final rule is published.

The FAA estimates that this proposed AD affects 12 airplanes of U.S. registry. The FAA estimates the following costs to comply with this proposed AD:

Title 49 of the United States Code specifies the FAA's authority to issue rules on aviation safety. Subtitle I, section 106, describes the authority of the FAA Administrator. Subtitle VII: Aviation Programs, describes in more detail the scope of the Agency's authority.

The FAA is issuing this rulemaking under the authority described in Subtitle VII, Part A, Subpart III, Section 44701: General requirements. Under that section, Congress charges the FAA with promoting safe flight of civil aircraft in air commerce by prescribing regulations for practices, methods, and procedures the Administrator finds necessary for safety in air commerce. This regulation is within the scope of that authority because it addresses an unsafe condition that is likely to exist or develop on products identified in this rulemaking action.

This proposed AD is issued in accordance with authority delegated by the Executive Director, Aircraft Certification Service, as authorized by FAA Order 8000.51C. In accordance with that order, issuance of ADs is normally a function of the Compliance and Airworthiness Division, but during this transition period, the Executive Director has delegated the authority to issue ADs applicable to transport category airplanes and associated appliances to the Director of the System Oversight Division.

The FAA has determined that this proposed AD would not have federalism implications under Executive Order 13132. This proposed AD would not have a substantial direct effect on the States, on the relationship between the national Government and the States, or on the distribution of power and responsibilities among the various levels of government.

For the reasons discussed above, I certify this proposed regulation:

1. Is not a “significant regulatory action” under Executive Order 12866;

2. Will not affect intrastate aviation in Alaska; and

3. Will not have a significant economic impact, positive or negative, on a substantial number of small entities under the criteria of the Regulatory Flexibility Act.

Accordingly, under the authority delegated to me by the Administrator, the FAA proposes to amend 14 CFR part 39 as follows:

The Postal Service proposes to amend 39 CFR part 265 to improve clarity and to more closely align the regulations with both the relevant guidance from the Department of Justice's Office of Information Policy and the relevant statute, 5 U.S.C. 552(a)(4)(A)(iii). The portion of the regulations being amended concerns fee waivers. Generally speaking, fees for a FOIA request will be waived “if disclosure of the information is in the public interest because it is likely to contribute significantly to public understanding of the operations or activities of the government and is not primarily in the commercial interest of the requester.” 5 U.S.C. 552(a)(4)(A)(iii). The guidance from the Department of Justice elucidates a six-factor test from this rule—two of which of which relate to the commercial interest of the requester. The amendment to 39 CFR 265.9(j)(3)(i) clarifies that the first commercial interest factor is to determine whether a commercial interest exists. The amendment to 39 CFR 265.9(j)(3)(ii) incorporates the balancing test from the statute as the second part of the commercial interest factor, along with adding a presumption concerning news media requesters.

For the reasons stated in the preamble, the Postal Service proposes to amend 39 CFR chapter I as follows:

Inspection of Public Comments: All comments received before the close of the comment period are available for viewing by the public, including any personally identifiable or confidential business information that is included in a comment. We post all comments received before the close of the comment period on the following website as soon as possible after they have been received: http://www.regulations.gov . Follow the search instructions on that website to view public comments.

The Confidentiality of Substance Use Disorder Patient Records regulations (42 CFR part 2) implement section 543 of the Public Health Service Act, 42 United States Code (U.S.C.) 290dd-2, as amended by section 131 of the Alcohol, Drug Abuse and Mental Health Administration Reorganization Act (ADAMHA Reorganization Act), Public Law, 102-321 (July 10, 1992). The regulations were originally issued to prevent access to patient records for the treatment of substance use disorder, in a time when there was not broader privacy and data security standard for health data Under the regulations, a “substance use disorder” is a defined term, which refers to a cluster of cognitive, behavioral, and physiological symptoms indicating that an individual continues using a substance despite significant substance-related problems such as impaired control, social impairment, risky use, and pharmacological tolerance and withdrawal. For the purposes of part 2, this definition does not include tobacco or caffeine use.

The regulations were first promulgated as a final rule in 1975 (40 FR 27802) and amended thereafter in 1987 (52 FR 21796) and 1995 (60 FR 22296). On February 9, 2016, SAMHSA published a notice of proposed rulemaking (NPRM) (81 FR 6988) (the “2016 proposed rule”), inviting comment on proposals to update the regulations, to reflect the development of integrated health care models and the growing use of electronic platforms to exchange patient information, as well as the breadth of laws and regulatory actions implemented since 1975, that more broadly protect patient data, as patients and as consumers. At the same time, consistent with the statute, we (note that throughout this proposed rule, “we” refers to SAMHSA) wished to preserve confidentiality protections it establishes for patient identifying information from covered programs because persons with substance use disorders may encounter significant discrimination or experience other negative consequences if their information is improperly disclosed.

In response to public comments, on January 18, 2017, SAMHSA published a final rule (82 FR 6052) (the “2017 final rule”), providing for greater flexibility in disclosing patient identifying information within the health care system, while continuing to protect the confidentiality of substance use disorder patient records. SAMHSA concurrently issued a supplemental notice of proposed rulemaking (SNPRM) (82 FR 5485) (the “2017 proposed rule”) to solicit public comment on additional proposals. In response to public comments, SAMHSA subsequently published a final rule on January 3, 2018 (83 FR 239) (the “2018 final rule”) that provided greater clarity regarding payment, health care operations, and audit or evaluation-related disclosures, and provided language for an abbreviated prohibition on re-disclosure notice.

In both the 2017 and 2018 final rules, SAMHSA signaled its intent to continue to monitor implementation of 42 CFR part 2, and to explore potential future rulemaking to better address the complexities of health information technology, patient privacy, and interoperability, within the constraints of the statute. The emergence of the opioid crisis, with its catastrophic impact on individuals, families, and caregivers, and corresponding clinical and safety challenges for providers, has highlighted the need for thoughtful updates to 42 CFR part 2. The laws and regulations governing the confidentiality of substance abuse records were originally written out of concern for the potential for misuse of those records against patients in treatment for a SUD, thereby undermining trust and leading individuals with substance use disorders not to seek treatment. As observed in the 1983 proposed rule, the purpose of 42 CFR part 2 is to ensure that patients receiving treatment for a substance use disorder in a part 2 program “are not made more vulnerable to investigation or prosecution because of their association with a treatment program than they would be if they had not sought treatment” (48 FR 38763).

In recent years, the devastating consequences of the opioid crisis have resulted in an unprecedented spike in overdose deaths related to both prescription and illegal opioids including heroin and fentanyl, 1 as well as correspondingly greater pressures on the SUD treatment system, and heightened demand for SUD treatment services. This proposed rule proposes changes to the regulation that SAMHSA believes would better align with the needs of individuals with SUD and of those who treat these patients in need, and help facilitate the provision of well-coordinated care, as while ensuring appropriate confidentiality protection for persons in treatment through part 2 programs.

Balancing the concerns noted above, SAMHSA proposes several changes to the regulations at 42 CFR part 2 (part 2). First, we propose to amend language throughout the regulation to clarify several aspects of the applicability and disclosure requirements. Specifically, in Section III.B., Applicability, SAMHSA proposes to amend § 2.12 to clearly state in the regulatory text that the recording of information about a SUD and its treatment by a non-part 2 entity does not, by itself, render a medical record subject to the restrictions of 42 CFR part 2, provided that the non-part 2 entity segregates any specific SUD records received from a part 2 program (either directly, or through another lawful holder). SAMHSA believes this proposed language would encourage part 2 programs and non-part 2 providers to deliver better and safer coordinated care, while also protecting the confidentiality of individuals seeking such care. SAMHSA explains this proposal more fully in Section III.B.

In addition, SAMHSA proposes several changes to 42 CFR part 2, consistent with the proposed policy described above. Specifically, in Section III.A., Definitions, we propose to amend and clarify the definition of “Records” in § 2.11, in a manner that aligns with the proposed revision to § 2.12 described above. And in Section III.D., Prohibition on Re-disclosure, SAMHSA proposes to amend the standard written notice in § 2.32, to clarify the disclosure and re-disclosure limits under 42 CFR part 2.

Additionally, SAMHSA seeks to reduce barriers to care coordination for patients with SUD, in Section III.F., Disclosure to Prevent Multiple Enrollments, by proposing to amend § 2.34 to allow non-opioid treatment providers ( e.g., non-part 2 providers who nevertheless manage care for patients with SUD from time to time) to access central registries. In Section III.G., Disclosure to Prescription Drug Monitoring Programs, SAMHSA proposes to add new § 2.36 to permit opioid treatment programs (OTPs) to disclose dispensing and prescribing data, as required by applicable state law, to prescription drug monitoring programs (PDMPs), subject to patient consent. As noted above, patient safety is of paramount importance, and many drugs prescribed and dispensed by non-OTPs could have life-threatening and even deadly consequences if not properly coordinated with those prescribed and dispensed by OTPs. Therefore, SAMHSA believes it necessary for both OTPs and non-OTPs to report, and to access, prescription drug records in central registries and PDMPs, and to monitor dosing accordingly.

SAMHSA also makes several proposals that specifically decrease burden for patients accessing care, without compromising patient confidentiality. First, in Section III.C., Consent Requirements, SAMHSA proposes to amend § 2.31, to allow patients to consent to the disclosure of their information to a wide range of entities, without naming the specific individual receiving this information on behalf of a given entity; special instructions would apply with respect to consents for disclosure of information to information exchanges and research institutions. We believe this proposal would give patients the ability to apply for and access federal, state, and local resources and benefits more easily, ( e.g., social security benefits; local sober living or halfway house programs). Second, in Section III.H., Medical Emergencies, SAMHSA proposes to amend to § 2.51 to allow disclosure of patient information to another part 2 program or other SUD treatment provider during State or Federally declared natural and major disasters. SAMHSA believes this proposal would reduce the burden of disclosure requirements both for patients to receive, and for clinicians to provide, care that may not be otherwise feasible during natural and major disasters, ensuring that patients can continue to receive on-going and appropriate care.

In Section III.E., Disclosures Permitted with Written Consent, SAMHSA proposes amendments to § 2.33 to expressly allow disclosure to specified entities and individuals for 17 types of payment and health care operational activities. Although SAMHSA believes these activities were already permitted by the regulation, we have received feedback from stakeholders that there remains some confusion on these points. Therefore, we believe it necessary to more clearly state this regulatory permission in the regulatory text, to avoid any further confusion. SAMHSA also proposes amendments to § 2.53 (Audit and Evaluation) together with clarifying guidance, under Section III.J. The amendments to § 2.53 would help to resolve confusion about permitted types of disclosures to and from federal, state and local governmental agencies and to and from third-party payers, for the purpose of audit and evaluation, among other changes. They would also allow patient identifying information to be disclosed to federal, state, and local agencies, and the contractors, subcontractors, and legal representatives of such agencies in the course of conducting audits or evaluations mandated by statute or regulation, if those audits or evaluations cannot be carried out using de-identified information. Likewise, in section III.I., Research, SAMHSA proposes to allow research disclosures of part 2 patient data by a HIPAA covered entity to individuals and organizations who are neither HIPAA covered entities, nor subject to the Common Rule, for the purpose of conducting scientific research. SAMHSA believes this change will better align the requirements of part 2, the Common Rule, and the Privacy Rule around the conduct of research on human subjects, and will help to streamline duplicative requirements for research disclosures under part 2 and the Privacy Rule in some instances. SAMHSA is also proposing to amend section § 2.52 (Research) to clarify that research disclosures may be made to members of the workforce of a HIPAA covered entity for purposes of employer-sponsored research, as well as to permit research disclosures to recipients who are covered by FDA regulations for the protection of human subjects in clinical investigations (at 21 CFR part 50).

In Section III.K., Orders Authorizing Use of Undercover Agents and Informants, SAMHSA proposes to revise our policies in § 2.67 for the placement of undercover agents and informants within a part 2 program, to provide more clarity regarding the permitted time period for placement pursuant to court order.

Finally, SAMHSA provides the following guidance on how employees, volunteers and trainees of part 2 facilities should handle communications using personal devices and accounts, especially in relation to § 2.19 concerning disposition of records by discontinued programs. In § 2.11, the current regulation defines “Records” to include information relating to a patient that could include email and texts. In § 2.19, the regulation codifies the requirements for disposition of records from a discontinued part 2 program. These requirements state that records which are electronic must be “sanitized” within one year of the discontinuation of the part 2 program. This sanitization must render the patient identifying information non-retrievable in accordance with § 2.16 (security for records). Read together, current §§ 2.11, 2.16, and 2.19 could be interpreted to mean that, if an individual working in a part 2 program receives a text or email from a patient on his or her personal phone which he or she does not use in the regular course of their employment in the part 2 program, and this part 2 program is discontinued, the personal device may need to be sanitized. Depending on the policies and procedures of the part 2 program, this sanitization may render the device no longer useable to that individual. SAMHSA clarifies that this interpretation is not the intent of the regulations.

Although SAMHSA does not encourage patient communication through personal email and cell phones, it recognizes that patients may make contact through the personal devices or accounts of an employee (or volunteer or trainee) of a part 2 program, even if the employee (or volunteer or trainee) does not use such device or account in the regular course of their employment in the part 2 program. In such instances, SAMHSA wishes neither to convey that these devices become part of the part 2 record, nor that, if the part 2 program is discontinued, these devices must be sanitized. Instead, SAMHSA clarifies that, in the case that patient contact is made through an employee's (or volunteer's or trainee's) personal email or cell phone account which he or she does not use in the regular course of business for that part 2 program, the employee should immediately delete this information from his or her personal account and only respond via an authorized channel provided by the part 2 program, unless responding directly from the employee's account is required in order to protect the best interest of the patient. If the email or text contains patient identifying information, the employee should forward this information to such authorized channel and then delete the email or text from any personal account. These authorized channels are then subject to the normal standards of sanitization under §§ 2.16 and 2.19 and any other applicable federal and state laws. SAMHSA believes that this process will both protect the employee's personal property and the confidentiality of the patient's records if the patient makes such unauthorized contact.

In the current regulation, “Records” is defined to mean “any information, whether recorded or not, created by, received, or acquired by a part 2 program relating to a patient.” In the 2017 final rule, SAMHSA noted that some commenters expressed confusion regarding what is considered unrecorded information (82 FR 6068); it, therefore, added parenthetical examples in an effort to clarify. But with the exception of these parenthetical examples, the basic definition for “records” under part 2 has remained the same since the 1987 final rule.

In a subsequent section of this proposed rule (III.B.) on “Applicability” (at § 2.12), SAMHSA discusses a proposed change to the restriction on disclosures under part 2, which would serve to clarify some record-keeping activities of non-part 2 providers that fall outside the scope of 42 CFR part 2. As explained in section III.B., the proposed change is needed to facilitate communication and coordination between part 2 programs and non-part 2 providers, and to ensure that appropriate communications are not hampered by fear among non-part 2 providers of inadvertently violating part 2, as a result of receiving and reading a protected SUD patient record and then providing care to the patient.

SAMHSA proposes here to make a conforming amendment to the § 2.11 definition of “records,” by adding, at the end of the first sentence of the definition, the phrase, “provided, however, that information conveyed orally by a part 2 program to a non-part 2 provider for treatment purposes with the consent of the patient does not become a record subject to this part in the possession of the non-part 2 provider merely because that information is reduced to writing by that non-part 2 provider. Records otherwise transmitted by a part 2 program to a non-part 2 provider retain their characteristic as a “record” subject to this part in the possession of the non-part 2 provider, but may be segregated by that provider.”

The effect of this proposed amendment would be to incorporate a very limited exception to the definition of “records,” such that a non-part 2 provider who orally receives a protected SUD record from a part 2 program may subsequently engage in an independent conversation with her patient, informed by her discussion with the part 2 provider, and record SUD information received from the part 2 program or the patient, without fear that her own records thereafter would become covered by part 2. As discussed below in the proposed revisions to the “Applicability” section of part 2 (at § 2.12), the intent of these proposed clarifications is to better facilitate coordination of care between non-part 2 providers and part 2 programs, and to resolve lingering confusion among non-part 2 providers about when and how they can capture SUD patient care information in their own records, without fear of those records being subject to the confidentiality requirements of part 2.

In the 1987 final rule, SAMHSA broadly established that the restrictions on disclosure under 42 CFR part 2 would apply to any alcohol and drug abuse information obtained by a federally assisted alcohol or drug abuse program. As explained in 1987, by limiting the applicability of 42 CFR part 2 to specialized programs—that is, to those programs that hold themselves out as providing and which actually provide alcohol or drug abuse diagnosis, treatment, and referral for treatment—the aim was to simplify the administration of the regulations, but without significantly affecting the incentive to seek treatment provided by the confidentiality protections. Limiting the applicability of 42 CFR part 2 to specialized programs was intended to lessen the adverse economic impact of the regulations on a substantial number of facilities which provide SUD care only as incident to the provision of general medical care. The exclusion of hospital emergency departments and general medical or surgical wards from coverage was not seen as a significant deterrent to patients seeking assistance for alcohol and drug abuse. SAMHSA's experience in the more than 30 years since 1987 has been consistent with this expectation.

The 2017 final rule elaborated on this policy, by establishing that the disclosure restrictions on SUD patient records would extend to individuals or entities who receive such records either from a part 2 program or from another lawful holder. See 42 CFR 2.12(d)(2)(i)(C). As explained in the 2017 final rule, a “lawful holder” of patient identifying information is an individual or entity who has received such information as the result of a part 2-compliant patient consent, or as a result of one of the exceptions to the consent requirements in the statute or implementing regulations (82 FR 6068). Thus, the effect of the 2017 rule was to expand the scope of application for part 2 confidentiality, by ensuring that records initially created by a part 2 program would remain protected under 42 CFR part 2 throughout a chain of subsequent re-disclosures, even into the hands of a downstream recipient not itself a part 2 program. The reason for the 2017 change was, once again, to avoid any deterrent effect on patients seeking specialized SUD care through part 2 treatment programs, by virtue of the patient records from those programs losing their part 2 confidentiality protection following a disclosure downstream to other “lawful holder” recipients of those records (81 FR 6997).

Although that policy was established in the 2017 final rule, specifically in § 2.12(d)(2)(i)(C), there remains some confusion within the provider community about what information collected by non-part 2 entities is (or is not) covered by the part 2 restrictions on re-disclosure. When SAMHSA expanded the reach of the Applicability provision in 2017, the intent was not to change the policy established in the 1987 rulemaking, nor to make the records of non-part 2 entities (such as some primary care providers) directly subject to 42 CFR part 2, simply because information about SUD status and treatment might be included in those records. Rather, the intent underlying the 2017 provision was to clarify the applicability of 42 CFR part 2 in a targeted manner, so that records initially created under the protection of part 2 would continue to be protected following disclosure to downstream recipients. In doing so, SAMHSA sought to encourage individuals to enter into SUD treatment through part 2 programs, by strengthening the confidentiality protection for records that originate from those programs. Implicit in SAMHSA rulemaking since 1987 has been the pursuit of a balance of policy interests: On the one hand, consistent with the Congressionally stated purpose of the drug abuse confidentiality statute, to encourage entry into SUD treatment by ensuring that the records of treatment through a part 2 program would not be publicly disclosed, and on the other hand, to reduce the adverse impact of part 2 burdens on general medical care providers and facilities and on patient care.

In the wake of the nation's opioid epidemic and continuing trends related to alcohol use disorder and cannabis use disorder, it has become increasingly important for primary care providers and general medical facilities not covered by 42 CFR part 2 to be able to carry out treatment and health care operations that sometimes involve creating new records that mention SUD status and care. Such records and activities are not covered by 42 CFR part 2. However, coordination of care between part 2 programs and non-part 2 providers would involve the disclosure of SUD records and information by the former to the latter. Under the current 42 CFR part 2 regulation, such disclosures of records by a part 2 program to a non-part 2 provider do not render all subsequent records on SUD caretaking activity undertaken by the non-part 2 provider subject to the part 2 regulation. For example, when a non-part 2 provider is directly treating her own patient, and creates a record based on her own patient contact that includes SUD information, then that record is not covered by part 2.

Nevertheless, SAMHSA recognizes that there may be significant confusion or misunderstanding as to the applicability of part 2 rules to non-part 2 providers. This results in increased burden on non-part 2 providers, and the potential for impaired coordination of care for patients, which could be life threatening, for example, if an affected patient has an opioid use disorder. Although the existing text of 42 CFR 2.12 (d)(2)(i)(C) on Applicability does not compel these results, SAMHSA's experience in recent years has demonstrated the need for clearer regulatory language, to better delineate the records of non-part 2 entities which are not covered by the 42 CFR part 2 rules.

Based on the above considerations, SAMHSA proposes to add a new subsection (d)(2)(ii) to § 2.12, to better clarify that a non-part 2 treating provider's act of recording information about a SUD and its treatment would not make that record subject to 42 CFR part 2. SUD records received by that non-part 2 entity from a part 2 program are subject to part 2 restrictions on redisclosure of part 2 information by lawful holders, including redisclosures by non-part 2 providers. However, the records created by the non-part 2 provider in its direct patient encounter(s) would not be subject to part 2, unless the records received from the part 2 program are incorporated into such records. Segregation of any part 2 records previously received from a part 2 program can be used to ensure that new records ( e.g., a treatment note based on a direct clinical encounter with the patient) created by non-part 2 providers during their own patient encounters would not become subject to the part 2 rules.

SAMHSA believes that this addition would further clarify the 2017 revisions, by affirming that the independent record-keeping activities of non-part 2-covered entities remain outside the coverage of 42 CFR part 2, despite such providers' (segregated) possession, as lawful holders, of part 2-covered records. The part 2 disclosure restrictions only apply to SUD patient records originating with part 2 providers. Such part 2 originating records are subject to the part 2 limitations on use and disclosure as they move through the hands of other “lawful holders” and part 2 programs. Even where part 2 does not apply to a patient record created by a non-part 2 provider following a direct patient encounter, that record will nevertheless be subject to the HIPAA Privacy Rule.

One means by which non-part 2 treating providers could benefit from the above proposal would be through the segregated storage of part 2-covered SUD records received from a part 2 program or other lawful holder. In the context of a paper record received from a part 2 program, the proposed requirement could be met by the “segregation” or “holding apart” of these records; in the context of electronic records from a part 2 program, the proposed requirement could be met by logical “segmentation” of the record in the electronic health record (EHR) system in which it is held. As under the current rule, when a non-part 2 entity receives a protected SUD record from a part 2 program or other lawful holder, the received record is subject to the heightened confidentiality requirements under part 2. “Segregating” the received record, whether by segmenting it or otherwise labeling or holding it apart, would allow the recipient entity to identify and keep track of a record that requires heightened protection.

Under both the proposal and the current text of part 2, the lawful holder recipient entity remains subject to part 2 re-disclosure restrictions with regard to the part 2 record, whether or not the recipient entity is able to segregate it. But “segregating” allows the recipient entity both to keep track of the part 2 records, and readily distinguish them from all the other patient records that the entity holds which are not subject to part 2 protection. As mentioned above, “segregating” the part 2 record may involve physically holding apart any part 2-covered records from the recipient's other records, which would be quite feasible in the case of a received paper record or an email attachment containing such data. Alternately, “segregating” can involve electronic solutions, such as segmenting an electronic SUD patient record received from a part 2 program by use of a Data Segmentation for Privacy (DS4P) compliant EHR platform, in which segmentation is carried out electronically based on the standards of DS4P architecture (discussed further below). Either of these methods for “segregating” part 2 covered records is a satisfactory way for the recipient entity to keep track of them, and to distinguish them from all the other patient records that the entity holds which are not subject to part 2 protection. We note that “segregating” a received part 2 record does not require the use of a separate server for holding the received part 2 records. We do not intend this rule to result in the creation of separate servers or health IT systems for part 2 documents. Our policy is intended to be consistent with existing technical workflows for data aggregation, storage, and exchange.

One concern that this proposal raises is the possibility that a non-part 2 provider might transcribe extensively from a part 2 record without having a clinical purpose for doing so. This, however, is not the intent of the proposal. Briefly, the intent is to allow a non-part 2 provider to receive SUD information about a patient from a part 2 program, and then to engage in a treatment discussion with that patient, informed by that information, and then be able to create her own treatment records including SUD content, without the latter becoming covered by part 2. This level of flexibility is needed in order to improve coordination of care efforts, and to save lives. It is not SAMHSA's intent to encourage a non-part 2 provider to abuse the rules, by transcribing extensively from a conversation with a part 2 program or from a received part 2 record when creating her own records, without having a clinical purpose for doing so.

In the 2017 final rule, SAMHSA responded to several public comments about data segmentation issues connected to 42 CFR part 2. We acknowledged then that although significant challenges exist for data segmentation of SUD records within some current EHR systems, SAMHSA has led the development of use- case discussions related to the technical implementation of the Data Segmentation for Privacy (DS4P) standard and recently contributed to the development of the FHIR implementation guide for Consent2Share. 2 We believe that DS4P and Consent2Share are important tools to advance the needs of part 2 providers and providers across the care continuum. SAMHSA recognizes and encourages the further development of DS4P standards, and the adoption by providers of EHR systems that meet those standards. The current proposal for revising § 2.12 does not, however, impose on non-part 2 entities any new requirement for data segmentation as a practice, nor does it establish any new standards or requirements for EHR technology. SAMHSA considered including, in this proposed rule, the policy option of defining “segmented” and “segmentation” under 42 CFR part 2, in order to offer greater clarity about what these terms mean under the rule. We decided not to do so, however, since a formal definition of segmentation might have unforeseen technical ramifications for EHR and HIE systems implementation in the future. In addition, SAMHSA believes this policy should be flexible, to allow providers with different operational standards and capabilities to implement the policy with regard to segregation or segmentation in the least burdensome way to their practices, while still maintaining confidentiality of patient records subject to part 2. Nevertheless, using health IT to support data segmentation for privacy and consent management is one path that a provider could use to support their effort to meet part 2 requirements including those described in this proposed rule.

In addition to the proposed revision to 42 CFR 2.12(d) above, SAMHSA proposes conforming changes to the regulatory text of several other sections of 42 CFR 2.12, to provide further clarification of the applicability of part 2 restrictions on patient records.

In § 2.12(a), SAMHSA proposes to change the text to reflect that the restrictions on disclosure apply to “any records,” rather than to “any information, whether recorded or not.” We also propose a conforming change to § 2.12(a)(ii), to indicate that the restrictions of this part apply to any records which “contain drug abuse information obtained . . .” or “contain alcohol abuse information obtained . . .” Taken together, these changes are congruent with the amendment to § 2.12(d) and help to make it clear that part 2 applies to “records” (as defined under § 2.11).

In § 2.12(e)(3), SAMHSA proposes to change the text to reflect that the restrictions on disclosure apply to the recipients “of part 2-covered records,” rather than to the recipients “of information.” This proposed change is congruent with the proposed amendment to § 2.12(d) and would help to make explicit that downstream restrictions on re-disclosure by non-Part 2 entities are tied to protected records which originate from a part 2 program in the first instance. SAMHSA believes that this proposed conforming change is important, because it would further establish that the re-disclosure burden for non-part 2 entities ties specifically to the protected records that they receive from a part 2 program, and not to any other records that the non-part 2 entity creates by itself, regardless of whether the latter might include some SUD-related content.

In § 2.12(e)(4), SAMHSA likewise proposes a conforming change to the text, by adding language to reflect that a diagnosis prepared by a part 2 program for a patient who is neither treated by nor admitted to that program, nor referred for care elsewhere, is nevertheless covered by the regulations in this part. The proposed change to the regulatory text is for clarity, to ensure that this section could not be misread as applying directly to the activities of a non-part 2 entity or provider.

Similarly, and congruent with the above conforming changes, SAMHSA is also proposing to modify the definition of “Records” in § 2.11 as discussed in Section III.A. above and to modify and streamline the language in § 2.32 as discussed in Section III.D. below. Readers are referred to those sections of the proposed rule for specifics on those proposals and the rationales for such proposed policies.

In the 2017 final rule, SAMHSA made several changes to the consent requirements at § 2.31, to facilitate the sharing of information within the health care context, while ensuring the patient is fully informed and the necessary confidentiality protections are in place. Among those changes, SAMHSA amended the written consent requirements regarding identification of the individuals and entities to whom disclosures of protected information may be made (82 FR 6077). Specifically, SAMHSA adopted a framework for disclosures to entities that made several distinctions between recipients that have a treating provider relationship with the patient, and recipients that do not. Under the current rules at § 2.31(a)(4), if the recipient entity does not have a treating provider relationship with the patient whose information is being disclosed and is not a third-party payer, such as an entity that facilitates the exchange of health care information or research institutions, the written consent must include the name of the entity and one of the following: “ the name(s) of an individual participant(s); the name(s) of an entity participant(s) that has a treating provider relationship with the patient whose information is being disclosed; or a general designation of an individual or entity participant(s) or class of participants that must be limited to a participant(s) who has a treating provider relationship with the patient whose information is being disclosed. ” As stated in the 2017 final rule, SAMHSA wants to ensure that patient identifying information is only disclosed to those individuals and entities on the health care team with a need to know this sensitive information (82 FR 6084). SAMHSA, accordingly, limited the ability to use a general designation in the `to whom' section of the consent requirements to those individuals or entities with a treating provider relationship to the patient at issue.

Since the 2017 final rule was published, SAMHSA has learned that some patients with substance use disorders may want part 2 programs to disclose protected information to entities for reasons including eligibility determinations and seeking non-medical services or benefits from governmental and non-governmental entities ( e.g., social security benefits, local sober living or halfway house programs). Because these entities lack a treating provider relationship with the patient, the current rules preclude them from being designated by name to receive the information, unless they are third-party payers, or the patient knows the identity of the specific individual who would receive the information on behalf of the benefit program or service provider. In addition, many of these entities may not be able to identify a specific employee to receive application information, and instead are likely to encourage patients to contact them or apply online, such that information is submitted to the organization rather than to a specific person. SAMHSA has heard that many patients have encountered frustration and delays in applying for and receiving services and benefits from, and in authorizing part 2 providers to release their information to, entities providing such services and benefits, by virtue of the inability to designate these entities by organization name only on the written consent for disclosure of part 2 information. It is not SAMHSA's intent to limit patients' ability to consent to the disclosure of their own information. We wish, rather, to empower patients to consent to the release and use their health information in whatever way they choose, consistent with statutory and regulatory protections designed to ensure the integrity of the consent process.

Therefore, SAMHSA proposes to amend the current regulations to clarify that patients may consent to disclosures of part 2 information to organizations without a treating provider relationship. We propose to amend § 42 CFR 2.31(a)(4)(i), which currently requires a written consent to include the names of individual(s) to whom a disclosure is to be made. The amendment would insert the words “or the name(s) of the entity(-ies)” to that section, so that a written consent must include the name(s) of the individual(s) or entity(-ies) to whom or to which a disclosure is to be made. SAMHSA believes that this language aligns more closely with the wording of the regulation before the January 2017 final rule changes and would alleviate problems caused by the inability to designate by name an individual recipient at an entity. For example, if a patient wants a part 2 program to disclose impairment information to the Social Security Administration for a determination of benefits, such patient would only need to authorize this agency on the “to whom” section of the consent form, rather than identify a specific individual at the agency to receive such information.

SAMHSA proposes to remove § 2.31(a)(4)(ii) and (iii)(A), and redesignate current § 2.31(a)(4)(iii)(B) as § 2.31(a)(4)(ii). SAMHSA also proposes to amend the newly redesignated § 2.31(a)(4)(ii), so that it applies only to entities that facilitate the exchange of health information ( e.g., health information exchanges (HIEs)) or research institutions. The proposed amendment would provide that, if the recipient entity is an entity that facilitates the exchange of health information or is a research institution, the consent must include the name of the entity and one of the following: (1) The name(s) of an individual or entity participant(s); or (2) a general designation of an individual or entity participant(s) or class of participants, limited to a participant(s) who has a treating provider relationship with the patient whose information is being disclosed. As stated in the January 2017 final rule (82 FR 6084), for entities that facilitate the exchange of health information or are research institutions, SAMHSA wants to ensure that patient identifying information is only disclosed to those individuals and entities on the health care team with a need to know this sensitive information. Therefore, in instances where information is disclosed to entities that facilitate the exchange of health information or research institutions, SAMHSA will continue to limit the ability to use a general designation ( e.g., “all my treating providers”) in the “to whom” section of the consent requirements to those individuals or entities with a treating provider relationship.

As discussed in Section III.B. above, in the 2017 final rule, SAMHSA clarified that the disclosure restrictions on SUD patient records would extend to individuals or entities who receive such records either from a part 2 program or from another lawful holder. We further emphasized this clarification in the notice requirements in § 2.32. Under § 2.32, each disclosure made with a patient's consent must contain a written statement notifying the recipient of the applicability of 42 CFR part 2 to any re-disclosure of the protected record. In the 2017 final rule, SAMHSA noted that the prohibition on re-disclosure provision only applies to information from the record that would identify, directly or indirectly, an individual as having been diagnosed, treated, or referred for treatment for a substance use disorder by a part 2-covered provider. The prohibition still allows other health-related information shared by the part 2 program to be re-disclosed, if permissible under the applicable law (82 FR 6089).

SAMHSA has heard from the provider community that this section of the regulation has prompted downstream, non-part 2 providers to manually redact portions of their disclosure data files that identify a patient as having or having had a substance use disorder. This activity is operationally burdensome and not the intent of the 2017 final rule. As noted in Section III.B. above, SAMHSA proposes to modify the regulations such that the recording of information about a SUD and its treatment by a non-part 2 entity is permitted and does not constitute records that have been redisclosed under part 2 (and, thus, subjected to part 2 protections), provided that any specific SUD records received from a part 2 program or other lawful holder are segregated or segmented. Therefore, a downstream entity would not need to redact SUD information in its records, provided that the original record received from the part 2 program or other lawful holder is segregated or segmented.

To ensure that downstream entities are aware that they do not need to redact information in their files if they have means of identifying the part 2-covered data ( e.g., by segregating or segmenting the files received from the part 2 program), as proposed above, SAMHSA proposes to modify and streamline the notice language in § 2.32(a)(1), to remove the superfluous language that has contributed to confusion regarding the restrictions on re-disclosures. Specifically, we propose to remove “information in” and “that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person,” from the current notice language established in the regulation. Additionally, SAMHSA has added language to specifically state that only the record is subject to the prohibition on re-disclosure in § 2.32, unless further disclosure either is expressly permitted by written consent of the individual whose information is being disclosed in the record or is otherwise permitted by 42 CFR part 2.

In the 2018 final rule (83 FR 241), SAMHSA clarified at § 2.33(b), the scope and requirements for permitted disclosures by a lawful holder to contractors, subcontractors, and legal representatives, for the purpose of payment and certain health care operations. In the 2017 proposed rule, SAMHSA proposed to include a list of 17 specific types of permitted payment and health care operations (82 FR 5487).

Based on the numerous comments received requesting additions or clarifications to the list, as well as concerns that the changes occurring in the health care payment and delivery system could rapidly render any list of activities included in the regulatory text outdated, SAMHSA decided not to include the list of 17 activities in the regulation text in the 2018 final rule, and, instead, decided to include a list of the types of permitted activities in the preamble of the 2018 final rule. SAMHSA stated in the 2018 final rule that we included this list of activities in the preamble in order to make clear that it is an illustrative rather than exhaustive list of the types of payment and health care operations activities that would be acceptable to SAMHSA (83 FR 241). By removing the list from the regulatory text, SAMHSA intended for other appropriate payment and health care operations activities to be permitted under § 2.33 as the health care system continues to evolve.

Since the 2018 final rule was published, SAMHSA has learned that including an illustrative list of permissible activities in the preamble rather than in the text of the regulation did not fully clarify the circumstances under which part 2 information could be further disclosed under § 2.33. Specifically, stakeholders may believe that a particular activity is not permissible unless it is explicitly identified within the regulatory text. Therefore, to clear up any remaining confusion, SAMHSA proposes to amend § 2.33(b) to expressly include the illustrative list of permissible activities that was contained in the preamble of the 2018 final rule (83 FR 243). It is important to note, as was noted in the preamble to the 2018 final rule, that this list is illustrative rather than exhaustive.

Specifically, examples of permissible activities that SAMHSA considers to be payment and health care operations activities to be added under § 2.33(b) include:

• Billing, claims management, collections activities, obtaining payment under a contract for reinsurance, claims filing and related health care data processing;

• Clinical professional support services ( e.g., quality assessment and improvement initiatives; utilization review and management services);

• Patient safety activities;

• Activities pertaining to:

○ The training of student trainees and health care professionals;

○ The assessment of practitioner competencies;

○ The assessment of provider and/or health plan performance; and/or

○ Training of non-health care professionals;

• Accreditation, certification, licensing, or credentialing activities;

• Underwriting, enrollment, premium rating, and other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits, and/or ceding, securing, or placing a contract for reinsurance of risk relating to claims for health care;

• Third-party liability coverage;

• Activities related to addressing fraud, waste and/or abuse;

• Conducting or arranging for medical review, legal services, and/or auditing functions;

• Business planning and development, such as conducting cost management and planning-related analyses related to managing and operating, including formulary development and administration, development or improvement of methods of payment or coverage policies;

• Business management and/or general administrative activities, including management activities relating to implementation of and compliance with the requirements of this or other statutes or regulations;

• Customer services, including the provision of data analyses for policy holders, plan sponsors, or other customers;

• Resolution of internal grievances;

• The sale, transfer, merger, consolidation, or dissolution of an organization;

• Determinations of eligibility or coverage ( e.g., coordination of benefit services or the determination of cost sharing amounts), and adjudication or subrogation of health benefit claims;

• Risk adjusting amounts due based on enrollee health status and demographic characteristics; and

• Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges.

In the 2017 final rule, SAMHSA modernized § 2.34 by updating terminology and revising corresponding definitions. Section 2.34 permits consensual disclosure of patient records to a withdrawal management or maintenance treatment program within 200 miles of a part 2 program. After receiving comments, we retained the specificity of “200 miles” to prevent multiple enrollments that could result in patients receiving multiple streams of SUD treatment medications, which in turn may increase the likelihood of an adverse event or of diversion (82 FR 6094).

Central registries, defined in § 2.11, do not exist in all states, and the defining parameters for the operation of the registries vary somewhat across states and across part 2 programs. However, in the context of the opioid epidemic, recent experience has demonstrated that it is important for all providers who work with SUD patients, including non-opioid treatment program (non-OTP) providers, to have access to the information in the central registries, for the purpose of helping prevent duplicative patient enrollment for opioid use disorder treatment. Access to central registry information is also needed by non-OTP providers to fully inform their decisions when considering appropriate prescription drugs, including opioids, for their patients.

Methadone is a long-acting opioid used to treat opioid use disorders and for pain that, when used at levels higher than recommended for an individual patient, can lead to low blood pressure, decreased pulse, decreased respiration, seizures, coma, or even death. When used as a part of a supervised medication assisted treatment (MAT) program, methadone is a safe and effective treatment for SUD, including OUD. Methadone is a long acting opioid, subject to accumulation when its metabolism is inhibited. Its effects may be potentiated by certain other drugs with which it may have pharmacodynamic interactions, so the medication is specifically tailored to each individual patient and must be used exactly as prescribed. Exceeding the specific dosing can lead to dangerous side effects and potential overdose. Other medications, including other SUD treatments, such as buprenorphine, as well as other medication including other opioids, benzodiazepines, HIV medications, certain antipsychotics and anti-depressants, also have the potential to interact dangerously with methadone.

Buprenorphine products are also long-acting opioid formulations approved by the Food and Drug Administration (FDA) for treatment of opioid use disorder, subject to limitations, which can be dispensed at OTPs, and in outpatient settings. While buprenorphine is demonstrated to exhibit a ceiling effect on respiratory depression in persons with opioid tolerance, it has significant opioid effects in those without tolerance which can contribute to adverse events including opioid overdose. Both of these long acting opioids (methadone and buprenorphine) have potential drug interactions with other medications that could lead to adverse events, including drug toxicity and opioid overdose.

These realities underscore the reason it is important for a prescriber to check central registries, when possible, to assure that it is appropriate to prescribe the contemplated opioid therapies for a particular individual. The ability to query a central registry regarding any duplicative enrollment in similar treatment can also be crucial to effective care, and to ensuring patient safety. Similarly, to avoid opioid-related adverse events, it is imperative that prescribing clinicians be aware of any opioid therapy that may be in current use by a patient prior to making further medication prescribing decisions.

Under the current language of § 2.34(a), a part 2 program may seek a written patient consent in order to disclose treatment records to a central registry. In turn, the recipient central registry may only disclose-patient contact information for the purpose of preventing multiple enrollments under § 2.34(b). Currently, under § 2.34(c), the central registry may only disclose when asked by a “member program” whether an identified patient is enrolled in another member program.

SAMHSA proposes to expand the scope of § 2.34 to make non-OTP providers with a treating provider relationship with the patient eligible to query a central registry to determine whether the specific patient is already receiving opioid treatment through a member program to prevent duplicative enrollments and prescriptions for excessive opioids, as well as to prevent any adverse effects that may occur as a result of drug interactions with other needed medications. Specifically, SAMHSA proposes to amend § 2.34(b) to include the use of central registry information to coordinate care with a non-part 2 program. In addition, we propose to add a new subsection (d) to specifically permit non-member treating providers to access the central registries. Previous subsection (d) will be re-designated as subsection (e).

SAMHSA believes that disclosures by central registries to non-OTP treating providers will help to ensure patient safety, and to prevent duplicative treatment plans and medications or medication doses that could place a patient receiving SUD treatment at risk.

For the reasons above, SAMHSA proposes to amend § 2.34(b) and (d) to allow non-OTP providers that have a treating relationship to the patient to access the central registries to inquire about that patient.

A prescription drug monitoring program (PDMP) is a statewide electronic database that collects, analyzes, and makes available prescription data on controlled substances prescribed by practitioners and non-hospital pharmacies. 3 Forty-nine states, St. Louis County, Missouri  4 and the District of Columbia have legislatively mandated the creation of PDMPs. Most states had developed their own PDMP prior to the current opioid crisis; however, few prescribers accessed them. 5 As opioid use disorder rates, overdoses and deaths increased significantly since 1999, the majority of states began requiring health professionals to check the state's PDMP  6 before prescribing controlled substances to patients. Currently, 41 states require physicians to use their state's PDMP to analyze prescription history prior to writing a prescription for opioids or other controlled substances. 7 Studies have shown that states that have implemented such a requirement have seen declines in overall opioid prescribing, drug-related hospitalizations, and overdose deaths. 8

Most PDMPs track prescription drug information on Schedule II-V controlled medications. Pharmacies must submit the prescription data required by their state's PDMP, depending on the state's statutory requirements. More robust PDMP programs have been associated with greater reductions in prescription opioid overdoses. 9 As noted above, this data allows providers to ensure that a patient is not receiving multiple prescriptions and to enhance patient care and patient safety.

Presently, OTPs are not required to report methadone or buprenorphine dispensing to their states' PDMP. In our 2011 guidance letter, SAMHSA encouraged OTP staff to access PDMPs, but stated that OTPs could not disclose patient identifying information to a PDMP unless an exception applies, consistent with the federal confidentiality requirements. 10 SAMHSA no longer believes this policy is advisable in light of the current public health crisis arising from opioid use, misuse, and abuse. In the past 10 years, there has been a substantial increase in prescription drug misuse, admissions to substance use facilities, emergency department visits and opioid-related deaths. 11 The omission of OTP data from a PDMP can lead to potentially dangerous adverse events for patients who may receive duplicate or potentially contraindicated prescriptions as part of medical care outside of an OTP, thereby placing them at risk for adverse events, including possible overdose or even fatal drug interactions.

SAMHSA believes that permitting part 2 programs, including OTPs, and lawful holders to enroll in PDMPs and submit the dispensing data for controlled substances required by states currently for other prescribed, controlled substances would allow for greater patient safety, better patient treatment, and better care coordination among the patient's providers. Therefore, SAMHSA proposes to add a new section § 2.36, permitting OTPs and other lawful holders to report the required data to their respective state PDMPs when dispensing medications. The proposed rule would require part 2 providers to obtain written consent from the patient whose identifying information will be disclosed prior to making such reports. This update is consistent with the proposal under § 2.34(c) to allow non-OTPs to query central registries to prevent duplicate enrollment.

SAMHSA acknowledges that this proposal may raise concerns about law enforcement access to PDMPs, particularly in those states in which PDMPs are operated by a law enforcement agency. However, individuals are not limited to OTPs when seeking OUD treatment. Prescriptions written for OUD opioid pharmacotherapy by non-OTP providers are already recorded in the state PDMP. By implication, PDMPs operated by law enforcement agencies are already receiving some patient data related to SUD treatment. Although the current proposal might expand that practice, it would not create it. And because the disclosure of SUD patient records by OTPs would be made contingent on written patient consent, any negative impact on patient confidentiality seems likely to be small. By contrast, the omission from PDMPs of dispensing and prescribing data from OTPs presents serious safety risks for SUD patients. While the reporting of patient data to a PDMP by an OTP would make it possible for law enforcement, prescribers, and pharmacies with access to a PDMP to determine that a specific patient had received services at a specific OTP, law enforcement would still require a court order meeting the requirements of 42 U.S.C. 290dd-2(c) to access the covered records of that patient or any other patient served at the OTP. SAMHSA believes that allowing for OTP reporting to PDMPs further enhances PDMPs as a tool to help prevent prescription drug misuse and opioid overdose, while providing more complete and accurate data. In turn, more robust PDMP data is imperative for prescribers and providers to make better and more accurate patient care decisions while increasing patient safety and assuring appropriate care.

Under § 2.51, disclosures of substance use disorder treatment records without patient consent are permitted in a bona fide medical emergency. Although not a defined term under part 2, a “bona fide medical emergency” most often refers to the situation in which an individual requires urgent clinical care to treat an immediately life-threatening condition ( e.g., heart attack, stroke, overdose, etc.), and in which it is infeasible to seek the individual's consent to release of relevant, sensitive SUD records prior to administering potentially life-saving care. SAMHSA proposes to amend this section to address the impact of major  12 and natural disasters, declared by state or federal authorities, on access to substance use treatment and services, in addition to the more common situation of an individual experiencing a “bona fide medical emergency.”

Disasters ( e.g., hurricanes, wildfires) can present unique challenges for patients with substance use disorders, and for their treating providers. These events may disrupt the usual access to services and medications across a geographic region. As a result, patients may be required to seek treatment at facilities or with providers who do not have full access to their records.

When access to, or operation of, substance use disorder treatment facilities and services are disrupted on a regional basis in the wake of a disaster like a hurricane or wildfire, many patients become unable to access care through their usual providers, while many providers may be unable to follow usual consent-based procedures in order to obtain and/or release records for large numbers of patients. Thus, the disclosure requirements of 42 CFR part 2 may be too burdensome in these instances. For example, in the case of a hurricane, normal policies and procedures for obtaining consent according to §§ 2.31 and 2.32 may not be operational. At the same time, the inability of SUD patients to access needed care through their usual providers (or other providers) that have access to part 2-protected records concerning their condition, may constitute or lead to medical emergencies. As a result of these factors, SAMHSA believes that it is necessary—and consistent with its statutory authority—to include natural and major disasters within the meaning of medical emergency for which there would be an exception to the requirement of consent for disclosure of part 2 records. In this NPRM, such an exception is proposed.

SAMHSA underscores that consent should still be obtained if at all feasible, but appropriate care should be the priority in these often-devastating scenarios and an exception should be allowed. Thus, SAMHSA proposes to revise § 2.51(a) to facilitate expedient access to care for patients with SUDs during natural and major disasters. Specifically, SAMHSA proposes to authorize, under § 2.51(a), a part 2 program to disclose patient identifying information to medical personnel, without patient consent, as needed in the event of a natural or major disaster to deliver effective ongoing substance use disorder services to patients in such disasters. Specifically, SAMHSA proposes that this medical emergency exception would apply only when a state or federal authority declares a state of emergency as a result of a disaster and the part 2 program is closed and unable to provide services or obtain the informed consent of the patient as a result of the disaster, and would immediately be rescinded once the part 2 program resumes operations.

SAMHSA recognizes the need for researchers to use SUD-related data to advance scientific research, particularly in light of the national opioid epidemic. SAMHSA supports the conduct of scientific research on SUD care, and has worked to allow researchers appropriate access to healthcare data relating to SUD, while maintaining appropriate confidentiality protections for patients.

Under 42 CFR 2.52, part 2 programs are permitted to disclose patient identifying information for research, without patient consent, under limited circumstances. In the 2017 Final Rule, SAMHSA made several changes to the research exception at § 2.52, including permitting the disclosure of data by lawful holders (as well as by part 2 programs) to qualified personnel for the purpose of conducting scientific research.

Currently § 2.52 allows the disclosure of patient identifying information for research purposes without patient consent, if the recipient of the patient identifying information is a HIPAA-covered entity or business associate, and has obtained and documented authorization from the patient, or a waiver or alteration of authorization, consistent with the HIPAA Privacy Rule at 45 CFR 164.508 or 164.512(i) or the recipient is subject to the HHS regulations regarding the protection of human subjects under the Common Rule. (45 CFR part 46).

Since the 2017 Final Rule, SAMHSA has become aware that limiting research disclosures under § 2.52, to only HIPAA-covered entities or institutions subject to the Common Rule, 13 may make it more difficult for some legitimate stakeholders to obtain data from SUD treatment records, for the purpose of conducting scientific research. For example, under the current provisions of § 2.52, the disclosure by a lawful holder of SUD records for the purpose of research to a State agency without a part 2 patient consent may be barred, given that most State agencies are neither HIPAA-covered entities nor directly subject to the Common Rule. It is not SAMHSA's intention or policy to make it more burdensome for these sorts of stakeholders to carry out scientific research. SAMHSA would like to more closely align the requirements of 42 CFR 2.52 (disclosures for the purpose of research), with the currently analogous provisions on research under the HIPAA Privacy Rule (45 CFR 164.512(i)) and the Common Rule, in order to minimize any conflict or duplication in the requirements for consent to disclosure of records for the purpose of research. Therefore, SAMHSA is proposing to modify the text of § 2.52(a), in order to allow research disclosures of part 2 data from a HIPAA covered entity or business associate to individuals and organizations who are neither HIPAA covered entities, nor subject to the Common Rule, provided that any such data will be disclosed in accordance with the HIPAA Privacy Rule at 45 CFR 164.512(i). This change will align the requirements of part 2 with the Privacy Rule around the conduct of research on human subjects. SAMHSA believes this change to § 2.52(a) is needed, in order to allow an appropriate range of stakeholders to conduct scientific and public health research on SUD care and SUD populations.

In addition, SAMHSA is proposing two additional changes to the text of § 2.52(a). First, SAMHSA is proposing to add new § 2.52(a)(1)(iii), in order to clarify that research disclosures may be made to members of the workforce of a HIPAA covered entity for purposes of employer-sponsored research, where that covered entity requires all research activities carried out by its workforce to meet the requirements of either the Privacy Rule and/or Common Rule, as applicable. Second, SAMHSA is also proposing to add new § 2.52(a)(1)(iv), to permit research disclosures to recipients who are covered by FDA regulations for the protection of human subjects in clinical investigations (at 21 CFR part 50), subject to appropriate documentation of compliance with FDA regulatory requirements, and pursuant to authority under the Food, Drugs and Cosmetics Act. In both instances, these proposals would help to align the part 2 requirements for research disclosures of SUD data, with analogous requirements for the conduct of research on human subjects that may apply under other federal regulations in specific circumstances.

Current regulations at §§ 2.53(a), (b), and (c) describe the circumstances under which specified individuals and entities may access patient identifying information in the course of an audit or evaluation. Section 2.53(a) governs the disclosure of patient identifying information for audits and evaluations that do not involve the downloading, forwarding, copying, or removing of records from the premises of a part 2 program or other lawful holder. In these instances, information may be disclosed to individuals and entities who agree in writing to comply with the limitations on disclosure and use in § 2.53(d) and who perform the audit or evaluation on behalf of one of the following: A federal, state, or local governmental agency that provides financial assistance to or is authorized to regulate a part 2 program or other lawful holder; an individual or entity which provides financial assistance to a part 2 program or other lawful holder; a third-party payer covering patients in a part 2 program; or a quality improvement organization (QIO) performing a utilization or quality control review. The regulations permit disclosure to contractors, subcontractors, or legal representatives performing audits and evaluations on behalf of certain individuals, entities, third-party payers, and QIOs described directly above. At § 2.53(a)(2), the regulations also allow part 2 programs or other lawful holders to determine that other individuals and entities are qualified to conduct an audit or evaluation of the part 2 program or other lawful holder. In these instances, patient information may be disclosed during an on-premises review of records, as long as the individuals and entities agree in writing to comply with the limitations on disclosure and use in § 2.53(d).

Section 2.53(b) of the regulation governs the copying, removing, downloading, or forwarding of patient records in connection with an audit or evaluation performed on behalf of government agencies, individuals, and entities described in 42 CFR 2.53(b)(2), which are identical to the agencies, individuals, and entities described in § 2.53(a)(1) above. In these audits, records containing patient identifying information may be copied or removed from the premises of a part 2 program or other lawful holder, or downloaded or forwarded to another electronic system or device from the part 2 program's or other lawful holder's electronic records, by an individual or entity who agrees to the records maintenance standards and disclosure limitations outlined in § 2.53(b)(1)(i)-(iii).

Additionally, patient identifying information may be disclosed to individuals and entities who conduct Medicare, Medicaid, or CHIP audits or evaluations as set forth in § 2.53(c).

SAMHSA understands there is confusion about § 2.53 as it applies to several specific situations, and therefore proposes to make the following changes to the regulations to improve clarity about what is permissible under these sections. SAMHSA also proposes to update part 2 regulatory language related to quality improvement organizations (QIO) to align with current QIO regulations.

First, some stakeholders have voiced frustration that part 2 programs have been unwilling or unable to disclose patient records that may be needed by federal, state, and local agencies, to better serve and protect patients with SUD. For example, a state Medicaid Agency or state or local health department may need to know about specific types of challenges faced by patients receiving opioid therapy treatment, such as co-occurring medical or psychiatric conditions, or social and economic factors that impede treatment or recovery. An agency may need this kind of information to recommend or mandate improved medical care approaches; to target limited resources more effectively to care for patients; or to adjust specific Medicaid or other program policies or processes related to payment or coverage to facilitate adequate coverage and payment. Government agencies may also wish to know how many patients test positive for a new and harmful illicit drug, and how part 2 programs are actually treating those patients, as an input to agency decisions aimed at improving quality of care. For example, agencies may wish to modify requirements for part 2 programs, educate or provide additional oversight of part 2 providers, and/or update corresponding payment or coverage policies. Third-party payers covering patients in a part 2 program may have similar objectives for obtaining part 2 information.

Current regulations allow part 2 programs to share information for the purposes described above in two ways, using either de-identified or identifiable information. Only SUD records containing patient identifying information are subject to part 2 protections, and therefore a part 2 program or other lawful holder may share non-identifiable information with government agencies (federal, state and local) for many types of activities.

SAMHSA encourages the use of de-identified or non-identifiable information whenever possible. However, it may be time consuming, labor intensive, or technologically difficult for part 2 programs to create, and for government agencies to obtain quickly, data that does not contain part 2 identifying information. It may be too cumbersome or cost prohibitive for part 2 programs to provide the kind of data necessary in a de-identified format. It also may be challenging for part 2 programs to provide information quickly in more urgent situations, without potentially diverting resources away from patient care.

Patient identifying may also be used to help agencies and third-party payers improve care in certain circumstances. Under current regulations at § 2.53(a) and (b), federal, state, and local government agencies that have the authority to regulate or that provide financial assistance to part 2 programs, and third-party payers with covered patients in part 2 programs, may receive patient identifying information in the course of conducting audits or evaluations. Additionally, patient identifying information may be disclosed to individuals and entities to conduct Medicare, Medicaid, or CHIP audits or evaluations under § 2.53(c). Thus, a Medicaid agency may evaluate the part 2 providers that participate in its Medicaid program; a state health department may audit the facilities it licenses pursuant to its regulatory authority; and a health plan may review part 2 programs that serve its enrollees.

The current regulations do not define audit and evaluation, nor do they direct the manner in which evaluations are carried out, as noted by § 2.2(b)(2). Nevertheless, SAMHSA believes that the concept of audit or evaluation is not restricted to reviews that examine individual part 2 program performance. They may also include periodic reviews of part 2 programs to determine if there are any needed actions at an agency level to improve care and outcomes across the individual part 2 programs the agency regulates or supports financially. Likewise, audits or evaluations may include reviews to determine if there are needed actions at a health plan level to improve care and outcomes for covered patients in part 2 program. In other words, audits or evaluations may be conducted with a goal to identify additional steps agencies or third-party payers should be taking to support the part 2 programs and their patients. This includes reviews that allow agencies or third-party payer entities to identify larger trends across part 2 programs, in order to respond to emerging areas of need in ways that improve part 2 program performance and patient outcomes.

SAMHSA proposes to clarify that under § 2.53, government agencies and third-party payer entities would be permitted to obtain part 2 records without written patient consent to periodically conduct audits or evaluations for purposes such as identifying agency or health plan actions or policy changes aimed at improving care and outcomes for part 2 patients ( e.g., provider education, recommending or requiring improved health care approaches); targeting limited resources more effectively to better care for patients; or adjusting specific Medicaid or other insurance components to facilitate adequate coverage and payment. These agencies and third-party payers are required to abide by the restrictions on disclosure and other relevant confidentiality requirements outlined in § 2.53. Additionally, SAMHSA does not believe it is generally necessary to conduct these types of audits or evaluations on a routine or ongoing basis. Rather, we would generally expect that they would be performed periodically, unless they are required by applicable law or other compelling circumstances exist, such as unique cases in which an oversight agency determines there is a need for ongoing review. Information disclosed for the purpose of a program audit or evaluation may not be used to directly provide or support care coordination. As stated previously (83 FR 243), SAMHSA believes it is important to maintain patient choice in disclosing information to health care providers with whom patients have direct contact. Agencies or health plans could, for example, use information from the aggregated results of part 2 program evaluations to determine that a new benefit or payment category is needed in order to facilitate better care coordination.

The preamble to the 2017 final rule noted that the authorizing statute for part 2 does not provide a general exception to the consent requirement for disclosure of SUD records, for the purpose of sharing records with public health officials (82 FR 6079). Furthermore, the preamble also noted that SAMHSA does not have the statutory authority to authorize routine disclosure of part 2 information for public health purposes (82 FR 6079). SAMHSA emphasizes that audits or evaluations using aggregated data for such purposes described above are distinct from a broader public health exception. Specifically, under current regulations, part 2 programs may share information with the agencies that have the authority to regulate or provide financial support to the part 2 program, in order to safeguard or improve the care and outcomes for current and future patients in those programs, or to ensure the integrity of the funding program and the appropriate use of financial support by the part 2 program. A broader public health exception would conceivably enable part 2 programs to share identifiable information with any public health agency, regardless of its relationship with the part 2 program, for many types of purposes ( e.g., preventative efforts aimed at a wider population).

To clarify allowable program evaluation activities using patient identifying information, SAMHSA proposes to redesignate current §§ 2.53(c) and (d) as §§ 2.53(e) and (f), respectively, and insert a new § 2.53(c) titled: “ Activities Included.” Proposed new paragraph § 2.53(c)(1) would specify that audits or evaluations may include periodic activities to identify actions that an agency or third-party payer entity can make, such as changing its policies or procedures to improve patient care and outcomes across part 2 programs; targeting limited resources more effectively; or determining the need for adjustments to payment policies for the care of patients with SUD. This change would clarify that disclosures of patient records by a part 2 program to an agency or third-party payer entity are permitted for these purposes without patient consent, pursuant to this section.

Second, SAMHSA has received feedback that stakeholders are unclear about whether § 2.53 allows federal, state, and local government agencies and third-party payers to have access to patient information for activities related to reviews of appropriateness of medical care, medical necessity, and utilization of services. As described above, the current regulations allow information to be disclosed to certain federal, state, and local governmental agencies and third-party payers for audit or evaluation purposes, as long as they agree to specific restrictions outlined in the regulations to limit disclosure or use of the records and preserve patient confidentiality. While neither the statute nor the regulations define audit or evaluation, these terms should and do include audits or evaluations to review whether patients are receiving appropriate services in the appropriate setting. Assessing whether a part 2 program provides appropriate care is a necessary part of any comprehensive part 2 program audit or evaluation. Government agencies may be charged with conducting such reviews for licensing or certification purposes or to ensure compliance with federal or state laws, as may private not-for-profit entities granted authority under the applicable statutes or regulations to carry out such work in lieu of the agencies. Third-party payers also have a stake in the programmatic integrity, as well as the clinical quality, of the part 2 programs that serve the patients they cover. Therefore, SAMHSA proposes to insert a new § 2.53 (c)(2) that clarifies audit and evaluations under this section may include, but are not limited to, reviews of appropriateness of medical care, medical necessity, and utilization of services. Stakeholders are also referred to § 2.33, which allows disclosure of information for payment and/or health care operations activities with a patient's consent.

Third, stakeholders have expressed confusion about whether part 2 programs may disclose information for audit or evaluation purposes to the larger health care organizations in which they operate. For example, Medicare Condition of Participation regulations at 42 CFR 482.21 require individual hospitals to conduct quality assessment and performance improvement (QAPI) programs that reflect the complexity of each hospital's organization and services, and which involve all hospital departments and services. QAPI programs are ongoing, hospital-wide, data-driven efforts that focus on addressing high-risk, high-volume or problem prone areas that affect health outcomes, patient safety, or quality of care.

The part 2 regulations provide ample leeway for part 2 programs to share information within their larger health care organizations for these and other types of evaluations. Under § 2.53(a)(2), part 2 programs may determine that individuals or entities within their health care organizations are qualified to conduct audits and evaluations and may share information pursuant to such reviews. Additionally, § 2.12(c)(3) states that, “The restrictions on disclosure in the regulations in this part do not apply to communications of information between or among personnel having a need for the information in connection with their duties that arise out of the provision of diagnosis, treatment, or referral for treatment of patients with substance use disorders if the communications are:

(i) Within a part 2 program; or

(ii) Between a part 2 program and an entity that has direct administrative control over the program.” The phrase “direct administrative control” refers to the situation in which a substance use disorder unit is a component of a larger behavioral health program or of a general health program.”

In order to eliminate any remaining misunderstanding, however, SAMHSA proposes to expand the regulatory language to explicitly clarify that this type of information sharing is permitted under the regulations. Specifically, we propose to add language to § 2.53(a)(2) to state that, “Auditors may include any non-part 2 entity that has direct administrative control over the part 2 program or lawful holder.” Additionally, SAMHSA proposes to include similar language in new subsection (b)(2)(iii). We believe that the proposed changes will help to clarify that in these situations, identifiable patient diagnosis or treatment information can be shared with personnel from an entity with direct administrative control over the part 2 program, where those persons, in connection with their audit or evaluation duties, need to know the information.

Fourth, while the regulations at §§ 2.53(a)(1)(ii) and (b)(2)(ii) specifically delineate that information may be disclosed to quality improvement organizations performing utilization or quality control reviews, these provisions do not explicitly include other types of entities that are responsible for quality assurance. For example, the regulations for audit and evaluation do not describe entities, such as health care organization accrediting or certification bodies, that may need to review patient records to evaluate whether a part 2 program meets quality and safety standards. To ensure that stakeholders understand that disclosure to these types of organizations is permitted, SAMHSA proposes to insert a new § 2.53(d) stating, “ Quality Assurance Entities Included. Entities conducting audits or evaluations in accordance with §§ 2.53(a) and (b) may include accreditation or similar types of organizations focused on quality assurance.”

Additionally, SAMHSA understands that some federal, state, and local government agencies face challenges in meeting statutory or regulatory mandates that require them to conduct audits or evaluations involving part 2 information. For example, the Centers for Medicare & Medicaid Services conducts risk adjustment data validation in connection with the risk adjustment program it is required to operate in accordance with section 1343 of the Patient Protection and Affordable Care Act, 42 U.S.C. 18063 and implementing regulations. Under risk adjustment data validation, health insurance issuers are lawful holders of part 2 identifying information and may be required to provide it to CMS or its contractors. Therefore, SAMHSA is proposing to insert a new § 2.53(g) to permit patient identifying information to be disclosed to federal, state, and local government agencies, as well as their contractors, subcontractors, and legal representatives of such agencies, in the course of conducting audits or evaluations mandated by statute or regulation, if those audits or evaluations cannot be carried out using de-identified information.

In addition to these changes, SAMHSA proposes to update language related to quality improvement organizations. Specifically, at §§ 2.53(a)(1)(ii) and (b)(2)(ii), it proposes to amend the language to align it with the current QIO regulations.

Under the 1975 final rule, the placement of undercover agents or informants in a part 2 program was largely prohibited, other than as specifically authorized by a court order for the purpose of investigating a part 2 program, or its agents or employees, for allegations of serious criminal misconduct. At the time the 1975 final rule was promulgated, it was noted that, although the use of undercover agents and informants in treatment programs was ordinarily to be avoided, there occasionally arise circumstances where their use may be justified (42 FR 27809). More narrowly, it was noted that the authorizing statute, by itself, did not forbid the use of undercover agents or informants, and that the express statutory prohibition against direct disclosure of patient records is nevertheless subject to the power of the courts to authorize such disclosures under 42 U.S.C. 290dd-2(b)(2)(C). Building on these statutory considerations, it was concluded that the power to regulate the placement of undercover agents and informants is limited, and that the importance of criminal investigation of part 2 programs offers a legitimate policy basis for allowing the placement of undercover agents or informants in such programs, given a showing of good cause in specific instances. As explained in the preamble to the 1975 final rule, experience has demonstrated that medical personnel, no matter how credentialed, can engage in the illicit sale of drugs on a large scale, and that the use of undercover agents and informants is normally the only effective means of securing evidence sufficient to support a successful prosecution in such instances. Based on over 40 years of experience since then, SAMHSA believes it is still the case that medical personnel sometimes engage in the illicit sale or transfer of drugs, and that a process for authorizing undercover agents is important to ensure the safety of patients in these part 2 programs.

Under the 1975 final rule, a 60-day time limitation with regard to the placement of undercover agents and informants in a part 2 program was imposed, with the opportunity for an applicant to seek an extension of the court order, for a total of up to 180 days (42 FR 27821). In the 1987 final rule, that period of placement for undercover agents and informants pursuant to a court order was extended to 6 months. This policy limitation was codified at § 2.67(d)(2).

Based on consultation with DOJ, the current policy is burdensome on, and overly restrictive of, some ongoing investigations of part 2 programs. Specifically, DOJ has stated that a typical undercover operation can often last longer than 6 months, and that 12 months is a more realistic timeframe for such operations. Therefore, SAMHSA proposes to amend § 2.67(d)(2), to extend the period for court-ordered placement of an undercover agent or informant to 12 months, while authorizing courts to further extend a period of placement through a new court order.

In addition, DOJ has stated that the current regulation text is ambiguous regarding when the 6-month, or, as proposed, 12-month period, should start and stop, in determining whether a court-order period of placement has elapsed. SAMHSA considered multiple policy options regarding the tolling of the time period for an undercover placement. We considered having the time period begin on the date of the issuance of the court order. Alternatively, SAMHSA also considered having the time period begin on the date of placement of the undercover agent. In consultations with DOJ, SAMHSA has found that there is often a lag of time between the court order and the placement of the agent, for many reasons. Therefore, starting the time period when the court order is issued could significantly curtail the length of time an agent can be undercover at a part 2 program. Furthermore, starting the time period based on date of placement of the agent would provide greater clarity and predictability to law enforcement about exactly how long an agent or informant is allowed to be in the field, since the agent is aware of the date his or her placement began, but may not be aware of the date of the court order. Thus, SAMHSA proposes to amend § 2.67(d)(2), to clarify that the proposed 12-month time period starts when an undercover agent is placed, or an informant is identified, in the part 2 program.

Under the Paperwork Reduction Act of 1995 (PRA), agencies are required to provide a 60-day notice in the Federal Register and solicit public comment before a collection of information requirement can be approved by the Office of Management and Budget (OMB) for review and approval. Currently, the information collection is approved under OMB Control No. 0930-0092. The collection of information in this proposed rule has been submitted to OMB for review under section 3507(d) of the PRA, and any public comments on this collection of information should be directed to the Office of Information and Regulatory Affairs of OMB, Attention: Desk Officer for SAMHSA.

In order to fairly evaluate whether changes to an information collection should be approved by OMB, section 3506(c)(2)(A) of the PRA requires that SAMHSA solicit comment on the following issues: (a) Whether the information collection is necessary and useful to carry out the proper functions of the agency; (b) The accuracy of the agency's estimate of the information collection burden; (c) The quality, utility, and clarity of the information to be collected; and (d) Recommendations to minimize the information collection burden on the affected public, including automated collection techniques.

Under the PRA, the time, effort, and financial resources necessary to meet the information collection requirements referenced in this section are to be considered in rule making. SAMHSA explicitly seeks, and will consider, public comment on our assumptions as they relate to the PRA requirements summarized in this section.

This proposed rule includes changes to information collection requirements, that is, reporting, recordkeeping or third-party disclosure requirements, as defined under the PRA (5 CFR part 1320). Some of the provisions involve changes from the information collections set out in the previous regulations. Below, SAMHSA briefly discusses each proposal and whether such proposal includes changes to information collection requirements.

In section III.A. of this proposed rule, SAMHSA proposes to modify the existing definition of “Records” in § 2.11 to conform with other proposed revisions in this proposed rule. See section III.A. for further information about this proposal. SAMHSA does not believe this proposal will result in any change in collection of information requirements since unrecorded information is, by its nature, not collected.

In section III.B. of this proposed rule, SAMHSA proposes to amend § 2.12 to clarify in that section that non-part 2 entities may record SUD treatment about a patient in its own records without triggering part 2 provided that such providers are able to differentiate their records from those received from a part 2 program and part 2 records received from lawful holders. See section III.B. for further information about this proposal. As stated in that section, SAMHSA proposes new regulatory text to clarify existing policies; thus, SAMHSA does not propose to change any collection of information requirements. Furthermore, we believe that the clarification represents standard practice in many, if not all, part 2 programs and among other lawful holders. That is, non-part 2 entities are already either segregating or segmenting any SUD records received from a part 2 program or deciding not to do so, based on their standard operations. This proposal would merely clarify that if the non-part 2 entity does, in fact, segregate or segment these records, the recording of information about a SUD and its treatment by a non-part 2 entity does not by itself render a medical record subject to the restrictions of 42 CFR part 2. Thus, SAMHSA does not believe this proposal would result in any changes in collection of information requirements.

In section III.C. of this proposed rule, SAMHSA proposes to amend § 2.31, to allow patients to consent to disclosure of their information to entities, without naming the specific individual receiving this information on behalf of a given entity. See section III.C. for further information about this proposal. This proposal may result in providers needing to update their standard consent forms to allow for certain disclosures to such entities; that additional burden is discussed in the Regulatory Impact Analysis, below. SAMHSA believes this proposal may result in part 2 program disclosing more information to certain entities. We discuss this additional burden, in total, with the additional collection of information requirements that may result from the proposals in sections III.I., and III.J, below.

In section III.D. of this proposed rule, SAMHSA proposes to modify and streamline the language in § 2.32(a)(1), to remove the superfluous language that has contributed to confusion regarding the restrictions on re-disclosure. See section III.D. for further information about this proposal. Since part 2 providers are already required, upon disclosure, to provide a written statement notifying the recipient of the applicability of 42 CFR part 2 to any re-disclosure of the protected record, consistent with the prior revisions to part 2, including the 2017 final rule (82 FR 6106), SAMHSA does not believe this proposed modification of the language would result in any changes in collection of information requirements.

In section III.E. of this proposed rule, SAMHSA proposes to specify in regulatory text an illustrative list of 17 permitted activities under § 2.33. SAMHSA is also proposing to add to § 2.33 that other payment and/or health care operations activities not expressly prohibited under this provision are also allowed. See section III.E. for further information about this proposal. As noted in that section, SAMHSA has previously stated that these activities are permitted (83 FR 241); this proposed language would only further clarify this previously finalized policy. Therefore, SAMHSA does not believe this proposal would result in any changes in collection of information requirements.

In section III.F. of this proposed rule, SAMHSA proposes to expand the scope of § 2.34(d) to make non-OTP providers with a treating provider relationship eligible to query a central registry with their patient's consent to determine whether a patient is already receiving treatment through a member program to prevent duplicative enrollments and prescriptions for methadone or buprenorphine, as well as to prevent any adverse effects with other prescribed medications. See section III.F. for further information about this proposal. Based on SAMHSA's research, the policies and procedures governing central registries vary widely by each state; in fact, many states do not have central registries in place. Because of this lack of information, it is not possible to estimate either the number of additional queries which central registries may receive as a result of this proposal or the time or effort required to answer these queries. Therefore, it is difficult to estimate any additional collection of information requirements which may result from this proposal. Instead, SAMHSA requests that central registries and providers that would query central registries provide comments on any additional information collection requirements this proposal would cause and any resulting burden.

In section III.G. of this proposed rule, SAMHSA proposes to add a new § 2.36 permitting part 2 programs to report any data for controlled substances dispensed or prescribed to patients to PDMPs, as required by the applicable state law. See section III.G. for further information about this proposal. SAMHSA anticipates that this proposal may result in additional burden for part 2 programs choosing to report to PDMPs in two ways. If a part 2 program chooses to report to a PDMP, the program will need to update its consent forms to request consent for disclosure to PDMPs. That burden is discussed in the Regulatory Impact Analysis, below. The second part of the proposal permits part 2 programs to report any data for controlled substances dispensed to patients to PDMPs, as required by the applicable state law. To estimate the additional collection of information requirements associated with this proposal, SAMHSA used the average number of opiate treatment admissions from SAMHSA's 2014-2016 Treatment Episode Data Set (TEDS) as the estimate of the number of clients treated on an annual basis by part 2 programs (531,965). Although not all programs would need to report this information under state law or may choose to do so, SAMHSA has used this number to be conservative and comprehensive of any future burden if states require reporting in the future. TEDS “comprises data that are routinely collected by States in monitoring their individual substance abuse treatment systems. In general, facilities reporting TEDS data are those that receive State alcohol and/or drug agency funds (including Federal Block Grant funds) for the provision of substance abuse treatment.”  14 Although TEDS does not represent all of the admissions to part 2 programs, as reporting varies by state, SAMHSA believes it represents the vast majority of admissions. Conservatively, we assumed that each of these clients would consent to the re-disclosure of their information to PDMPs and would be dispensed medication required to be reported to a PDMP. SAMHSA assumes that part 2 programs, based on other state and federal requirements, already are required to query PDMP databases; therefore, SAMHSA does not include registration and infrastructure costs in this estimate. For example, several states require medical directors of OTPs to query their respective state PDMPs at minimum intervals, including IN, MN, MI, ND, NC, RI, TN, VT, WA, and WV. 15 Based on discussions with providers, SAMHSA also estimates that, in addition to an initial update to the PDMP database for existing patients, the PDMP database would typically need to be accessed and updated quarterly for each patient, on average. Likewise, based on discussion with providers, SAMHSA believes accessing and reporting to the database would take approximately 2 minutes per patient, resulting in a total annual burden of 8 minutes (4 database accesses/updates × 2 minutes per access/update) or 0.133 hours annually per patient. For the labor costs associated with this activity, SAMHSA used the average wage rate of $23.04  16 per hour for substance abuse and behavioral disorder counselors (multiplied by two to account for benefits and overhead costs) to estimate a total burden in year 1 for the initial update of the PDMP database of $817,098 (531,965 clients × 2 minutes (0.033 hrs) per access/update × $46.08/hr) and an annual burden in each year of $3,268,391 (531,965 clients × 0.133 hours × $46.08/hr). Therefore, we estimate that this proposal will result in an additional cost of $4,085,489 ($817,098 + $3,268,391), as reflected in Table 1, below.

In section III.H. of this proposed rule, SAMHSA proposes an addition to § 2.51 to allow disclosure of patient information during natural and major disasters. See section III.H. for further information about this proposal. Because this proposal by its very nature does not require additional consent requirements or other paperwork, SAMHSA does not believe this proposal would result in any changes in collection of information requirements. Providers, under their own policies and procedures or other laws, may need to keep track of the disclosures made, which, could require additional paperwork. Such requirements, however, are not discussed in this rule, nor does SAMHSA have any way of estimating them, as policies and procedures may vary across providers.

In section III.I., and section III.J. of this proposed rule, SAMHSA proposes to amend § 2.52 and § 2.53 to allow certain disclosures without patient consent. First, in section III.I. of this proposed rule, SAMHSA proposes to modify the text of § 2.52(a) in order to allow research disclosures of part 2 data from a HIPAA covered entity or business associate to individuals and organizations who are neither HIPAA covered entities, nor subject to the Common Rule, provided that any such data will be disclosed in accordance with the HIPAA Privacy Rule. See section III.I. for further information about this proposal. Second, SAMHSA proposes to clarify allowed disclosures for audit and evaluation purposes under § 2.53 for activities undertaken by a federal, state, or local governmental agency or third-party payer to improve the delivery of care, to target limited resources more effectively and/or to determine the need for adjustments to payment policies for the care of patients with SUD. SAMHSA also proposes language to clarify that (1) audits and evaluations may include reviews of appropriateness of medical care, medical necessity, and utilization of services; (2) part 2 programs may disclose information, without consent, to non-part 2 entities that have direct administrative control over such part 2 programs; and (3) entities conducting audits or evaluations in accordance with §§ 2.53(a) and (b) may include accreditation or similar types of organizations focused on quality assurance. Further, SAMHSA proposes to permit patient identifying information to be disclosed to government agencies in the course of conducting audits or evaluations mandated by statute or regulation, if those audits or evaluations cannot be carried out using de-identified information. Finally, SAMHSA is proposing to update language related to QIOs. See section III.J. for further information about these proposals. As stated in that section, SAMHSA believes that the regulations already permit audits and evaluations for reviews of appropriateness of medical care, medical necessity, and utilization of services. Likewise, SAMHSA also believes that the current regulations permit disclosure to a non-part 2 entity with direct administrative control over a part 2 program and to accreditation and similar organizations. Therefore, although SAMHSA proposes language to clarify any confusion that may exist, it believes that these activities are already permitted and that they would not, therefore, result in any new collection of information requirements or any other burden. It also believes updating the QIO language would not create new collection of information requirements or increase burden. As noted above, SAMHSA also proposes to allow patient identifying information to be disclosed to government agencies and third-party payers periodically to identify needed actions at the agency or payer level, and to contractors hired by health insurance issuers and government agencies in the course of conducting audits or evaluations mandated by statute or regulation, if those audits and evaluations cannot be carried out using de-identified information. In section III.C of this proposed rule, SAMHSA also proposes to allow disclosure to entities with patient consent. SAMHSA believes that the proposals in sections III.C., I, and J, may result in additional collection of information requirements, as part 2 programs may be asked to disclose information to agencies and entities as a result of these proposals. Although SAMHSA is not able to anticipate the increase in these disclosures, to estimate the potential cost, we first estimated the number of potentially impacted part 2 programs based on the anticipated number of requests for a disclosure in a calendar year. SAMHSA used the average number of substance abuse treatment admissions from SAMHSA's 2014-2016 TEDS (1,658,732) as the number of patients treated annually by part 2 programs. SAMHSA then estimated that part 2 programs would need to disclose average of 15 percent of these records (248,810) as a result of these proposals. We then estimated that 10 percent or 24,881 (248,810 × 10%) of impacted part 2 programs would use paper records to comply with these requests for disclosure reports while the remaining 90% or 223,929 (248,810 × 90%) would use a health IT system. For part 2 programs using paper records, SAMHSA expects that a staff member would need to gather and aggregate the information from paper records, and manually track disclosures; for those part 2 programs with a health IT system, we expect records and tracking information would be available within the system.

SAMHSA assumed medical record technicians would be the staff with the primary responsibility for compiling the information for a list of disclosures from both paper records and health IT systems. The average hourly rate for medical record and health information technicians is $21.16. 17 In order to account for benefits and overhead costs associated with staff time, we multiplied the hourly wage rate by two for a total average hourly wage rate of $42.32. Absent any existing information on the amount of time associated with producing a list of disclosures, SAMHSA assumed it would take a medical record technician 4 hours, on average, to produce the information from paper records at a cost of $169.28 (4 hours × $42.32/hr) and 0.25 hours, on average, to produce information from a health IT system at a cost of $10.58 (0.25 hours × $42.32/hr). Finally, SAMHSA assumes that agencies will request that these disclosures be made on secure, online databases, and would not require notification via email or first class mail, thus resulting in no additional cost to transmit this information. Based on these assumptions, SAMHSA estimates that this proposal would result in an additional cost of $6,581,025 {(24,881 requests × $169.28 per request) + (223,929 requests × $10.58 per request)}, as reflected in Table 1, below.

In section III.K. of this proposed rule, SAMHSA proposes to amend § 2.67 to extend the period for court-ordered placement of an undercover agent or informant to 12 months, while authorizing courts to further extend a period of placement through a new court order. In that section, SAMHSA also proposes to explicitly state when the 12-month period begins to run. See section III.K. for further information about this proposal. The requirements of the Paperwork Reduction Act do not apply “During the conduct of a Federal criminal investigation or prosecution, or during the disposition of a particular criminal matter” (5 CFR 1320.4(a)(1)), or to information collections by the federal judiciary or state courts (5 CFR 1320.3(a)), except in the rare case that those information collections and conducted or sponsored by an executive branch department (5 CFR 1320.3(a)).

Below, SAMHSA summarizes the estimated cost of the change in collection of information requirements discussed above.

Because of the large number of public comments SAMHSA anticipates receiving on this Federal Register document, it will not be able to acknowledge or respond to them individually. SAMHSA will consider all comments received by the date and time specified in the DATES section of this proposed rule. When SAMHSA proceeds with a subsequent document, it will respond to the comments in the preamble to that document.

This proposed rule is necessary to update the Confidentiality of Substance Use Disorder Patient Records regulations at 42 CFR part 2 to respond to the emergence of the opioid crisis, with its catastrophic impact on patients and corresponding clinical and safety challenges for providers. The goal of this proposed rule is to clarify existing requirements in 42 CFR part 2 and reduce barriers to information sharing to ensure appropriate care and patient safety.

As noted in the tables below, SAMHSA believes that the proposed policies in this proposed rule, if finalized, would result in some near-term non-recurring and annual recurring financial burdens. We have weighed these potential burdens against the potential benefits, and believe, on balance, the potential benefits outweigh any potential costs. Specifically, the proposals in this rule are meant to allow providers to better understand the needs of their patients by clarifying the requirements under part 2 and to break down barriers to information sharing among part 2 programs and other providers. SAMHSA believes this information sharing would benefit patients because both part 2 programs and other providers would be able to more fully understand the patient's health history and avoid dangerous and even lethal adverse drug events. In addition, these proposals are also intended to protect and empower patients by giving them more control over their consent and control of their records, for example, by allowing them to consent to disclosure to entities, should they so choose. Furthermore, in drafting these proposals, SAMHSA was cognizant of privacy concerns and specifically drafted these proposals to protect the privacy of patients; for example, the proposal regarding OTP provider disclosure to PDMPs requires the consent of the patient. SAMHSA believes that increasing patient safety and the empowerment of patients would lead to better health outcomes, therefore balancing any burdens discussed below and any remaining privacy concerns. ÷

SAMHSA has examined the impacts of this rule as required by Executive Order 12866 on Regulatory Planning and Review (September 30, 1993), Executive Order 13563 on Improving Regulation and Regulatory Review (January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 1980, Pub. L. 96-354), section 1102(b) of the Social Security Act, section 202 of the Unfunded Mandates Reform Act of 1995 (March 22, 1995; Pub. L. 104-4), Executive Order 13132 on Federalism (August 4, 1999) and the Congressional Review Act (5 U.S.C. 804(2)), and Executive Order 13771 (Reducing and Controlling Regulatory Costs). Executive Orders 12866 and 13563 direct agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits (including potential economic, environmental, public health and safety effects, distributive impacts, and equity). Section 3(f) of Executive Order 12866 defines a “significant regulatory “action” as an action that is likely to result in a rule: (1) Having an annual effect on the economy of $100 million or more in any 1 year, or adversely and materially affecting a sector of the economy, productivity, competition, jobs, the environment, public health or safety, or state, local or tribal governments or communities (also referred to as “economically significant”); (2) creating a serious inconsistency or otherwise interfering with an action taken or planned by another agency; (3) materially altering the budgetary impacts of entitlement grants, user fees, or loan programs or the rights and obligations of recipients thereof; or (4) raising novel legal or policy issues arising out of legal mandates, the President's priorities, or the principles set forth in the Executive Order. A regulatory impact analysis must be prepared for major rules with economically significant effects ($100 million or more in any 1 year). This rule does not reach the economic threshold and thus, is not considered a major rule to which Executive Orders 12866 or 13771 apply.

The RFA requires agencies to analyze options for regulatory relief of small businesses. For purposes of the RFA, small entities include small businesses (including independent contractors), nonprofit organizations, and small governmental jurisdictions. Individuals and states are not included in the definition of a small entity. The proposed rule would allow patients to consent to disclosure of their information to entities; permit part 2 programs to report data for controlled substances dispensed to patients to PDMPs with patient consent; and allow part 2 programs to comply with disclosure requests from federal, state, or local governmental agencies, third-party payers and researchers. These proposals will result in additional reporting burden as well as near-term non-recurring and annual recurring regulatory impacts to part 2 programs. As shown in Table 2 and as discussed in the Collection of Information Requirements (Section IV), we estimate the average cost impact per substance abuse treatment admission for staff training, updates to consent forms, and disclosures to agencies will be $4.09 in year 1 ($6,782,493 ÷ 1,658,732 patients) and $3.97 in years 2 through 10 ($6,581,025 ÷ 1,658,732 patients). For opiate treatment patients, we also estimate the average cost impact for disclosure to PDMPs to be $7.68 per patient in year 1 ($4,085,489 ÷ 531,965 patients) and $6.14 in years 2 through 10 ($3,268,391 ÷ 531,965 patients). When this is added to the costs for staff training, updates to consent forms, and disclosures to agencies, the aggregate cost impact per opiate treatment admission is $11.77 in year 1 and $10.11 in years 2 through 10. While we are unable to determine how many part 2 programs qualify as small businesses based on the minimum threshold for small business size of $38.5 million ( https://www.sba.gov/federal-contracting/contracting-guide/size-standards ), we believe that on a per-patient basis, this proposed rule will not significantly affect part 2 treatment programs of any size. SAMHSA has not prepared an analysis for the RFA because it has determined, and the Secretary certifies, that this rule, if finalized as proposed, would not have a significant economic impact on a substantial number of small entities.

As further described in section IV., above, when estimating the total costs associated with changes to the 42 CFR part 2 regulations, SAMHSA estimated costs related to collection of information for the proposed changes to §§ 2.31, 2.52, 2.53, and (new) 2.36. In addition, we estimate that there may be additional burden related to updating consent forms as a result of the proposals in §§ 2.31 and (new) 2.36. In section III.C. of this proposed rule, SAMHSA proposes to amend § 2.31, to allow patients to consent to disclosure of their information to entities, without naming the specific individual receiving this information on behalf of a given entity. In section III.G. of this proposed rule, SAMHSA proposes to add a new § 2.36, permitting part 2 programs to report to PDMPs; patients must consent to disclosure before this reporting can occur. See sections III.C. and III.G. for further information about these proposals. These proposals may result in providers needing to update their standard consent forms to allow for certain disclosures. As stated in the 2016 proposed rule (81 FR 7009 through 7010), based from a 2008 study from the Mayo Clinic Health Care Systems, 18 the reported cost to update authorization forms was $0.10 per patient. Adjusted for inflation, 19 costs associated with updating the patient consent forms in 2019 would be $0.12 per patient (2018 dollars). SAMHSA used the average number of substance abuse treatment admissions from SAMHSA's 2014-2016 TEDS (1,658,732) as an estimate of the number of clients treated on an annual basis by part 2 programs. Therefore, the total cost burden associated with updating the consent forms to reflect the updated 42 CFR part 2 regulations is estimated to be a one-time cost of $199,048 (1,658,732 * $0.12), as reflected in Table 2, below. Further, the proposal to amend § 2.31 is likely to result in a decrease in the number of consents to disclosures that patients must make, due to the ability to consent to entities without naming a specific individual. Because of a lack of data regarding the number of consents patients have made to multiple individuals within the same entity which would become duplicative as a result of the proposed amendment, we are unable to quantify the reduction in burden related to the expected reduction in the number of required consents.

In prior proposed rules ( e.g., 81 FR 7009), SAMHSA estimated one hour of training per staff to achieve proficiency in the 42 CFR part 2 regulations. SAMHSA assumes that training associated with the new requirements discussed in this proposed rule can be accomplished within the existing one hour of training, therefore we are not proposing any additional costs for training counseling staff.

With regard to training materials, SAMHSA will assume responsibility for updating and distributing training materials in year 1 at no cost to part 2 programs. A 2017 study by the Association for Talent Development determined the average time to develop training materials for one hour of classroom instruction is 38 hours. 20 Because we assume that SAMHSA will be updating rather than developing training materials, we estimate the time for training development to be one-half that of developing new materials, or 19 hours and would be performed by an instructor with experience in healthcare at the average wage rate of $63.71 per hour for a health specialty teacher  21 and multiplied the average wage rate by 2 in order to account for benefits and overhead costs. Based on these assumptions, the updating of training materials is estimated to cost $2,421 (19 hours × $127.42/hour). SAMHSA estimates that the updates to consent forms (§§ 2.31 and 2.36) would be one-time costs the first year the final rule would be in effect and would not carry forward into future years. Staff training costs other than those associated with updating training materials are assumed to be ongoing annual costs to part 2 programs, also beginning in the first year that the final rule is in effect. Costs associated with disclosing information to PDMPs (§ 2.36) and agencies (§ 2.53) are assumed to be ongoing annual costs to part 2 programs.

In section III.K. of this proposed rule, SAMHSA proposes to amend § 2.67 to extend the period for court-ordered placement of an undercover agent or informant to 12 months, while authorizing courts to further extend a period of placement through a new court order. In that section, SAMHSA also proposes to explicitly state when the 12-month period begins to run. See section III.K. for further information about this proposal. Since the requirements for seeking this court order would be the same, and the proposal would merely be extending the time of the court order, SAMHSA does not believe this proposal will result in any additional regulatory burden.

Based on the above, SAMHSA estimates in the first year that the final rule would be in effect, the costs associated with the proposed updates to 42 CFR part 2 would be $10,867,982 as shown in Table 2. In years 2 through 10, SAMHSA estimates that costs would be $9,849,415. Over the 10-year period of 2019-2028, the total undiscounted cost of the proposed changes would be $99,512,721 in 2018 dollars. As shown in Table 3, when future costs are discounted at 3 percent or 7 percent per year, the total costs become approximately $85.0 million or $70.1 million, respectively. These costs are presented in the tables below.

In drafting this proposed rule, SAMHSA considered potential policy alternatives and, when possible, proposed the least burdensome alternatives. For example, in section III.B. of this proposed rule, we considered specifically proposing the technological and operational requirements required for segmenting records but decided to allow providers more latitude to define their best practices, understanding that specific requirements could pose more burden, specifically to small and rural providers. In section III.C. of this proposed rule, SAMHSA also considered only allowing patients to allow disclosure to state, federal, and local government entities that provide benefits. Instead, however, it decided to propose to allow patients to more broadly specify disclosure to entities, so that patients can more widely control their information. On balance, SAMHSA believes that the proposals in this rule most appropriately balance the often-competing interests of burden, privacy, and patient safety.

SAMHSA is proposing to amend 42 CFR part 2. With respect to our proposal to revise the regulations, SAMHSA does not believe that the proposal would have a significant impact. As discussed above, we are not preparing an analysis for the RFA because SAMHSA has determined, and the Secretary certifies, that this proposed rule would not have a significant economic impact on a substantial number of small entities. SAMHSA is not preparing an analysis for section 1102(b) of the RFA because it has determined, and the Secretary certifies, that this proposed rule would not have a significant impact on the operations of a substantial number of small rural hospitals. In addition, SAMHSA does not believe this rule imposes substantial direct effects on (1) states, including subdivisions thereof, (2) the relationship between the federal government and the states, or (3) the distribution of power and responsibilities among the various levels of government. Therefore, the requirements of Executive Order 13132 on federalism would not be applicable.

SAMHSA invites public comments on this section and requests any additional data that would help it to determine more accurately the impact on individuals and entities of the proposed rule. In accordance with the provisions of Executive Order 12866, this proposed rule has been reviewed by the Office of Management and Budget.

For the reasons set forth in the preamble, the Department of Health and Human Services proposes to amend 42 CFR part 2 to read as follows:

The revisions and additions read as follows:

The revisions and addition read as follows:

The revisions and additions read as follows:

Table of Contents I. Background II. Section-by-Section Analysis III. Regulatory Analyses and Notices I. Background

Recognizing a compelling need to strengthen the management and oversight of major capital projects, in the Surface Transportation and Uniform Relocation Assistance Act of 1987 (STURAA) (Pub. L. 100-17) (April 2, 1987), Congress authorized FTA's predecessor agency, the Urban Mass Transportation Administration (UMTA), to conduct oversight of major capital projects and to promulgate a rule for that purpose. The statute, now codified at 49 U.S.C. 5327, authorizes FTA to obtain the services of project management oversight contractors (PMOCs) to assist FTA in overseeing the expenditure of Federal financial assistance for major capital projects. Further, the statute requires FTA to promulgate a regulation that includes a definition of “major capital project” to identify the types of projects governed by the rule.

Accordingly, UMTA promulgated a rule for oversight of major capital projects on September 1, 1989, at 49 CFR part 633 (54 FR 36708). At that time, UMTA's capital programs were comparatively small, relative to today, totaling a little more than $2 billion annually. UMTA promulgated a regulation that defined “major capital project” as any project for the construction of a new fixed guideway or extension of an existing fixed guideway or a project involving the rehabilitation or modernization of an existing fixed guideway with a total project cost of $100 million or more. The rule limited covered projects to those receiving funds made available under sections 3, 9, or 18 of the Federal Mass Transit Act of 1964, as amended, 23 U.S.C. 103(e)(4), or section 14(b) of the National Capital Transportation Amendments of 1979. That rule is still in effect today.

By 2011, however, the annual dollar value of the Federal transit capital programs was nearly five times the level authorized under STURAA in 1987, and the number of active PMOC task orders was more than double the number in 1987. Furthermore, FTA funded a larger number of projects with a total cost of over one billion dollars that presented significant oversight challenges. Thus, on September 13, 2011, FTA published a Notice of Proposed Rulemaking (NPRM) (76 FR 56378) that proposed to enable FTA to identify more clearly the necessary management capacity and capability of a sponsor of a major capital project; spell out the many facets of project management that must be addressed in a project management plan; tailor the level of FTA oversight to the costs, complexities, and risks of a major capital project; set forth the means and objectives of risk assessments for major capital projects; and articulate the roles and responsibilities of FTA's PMOCs.

After the NPRM was published, however, the Moving Ahead for Progress in the 21st Century Act (MAP-21) (Pub. L. 112-141) (July 6, 2012) repealed the Fixed Guideway Modernization program, created the State of Good Repair program, and amended the Capital Investment Grants Program to add Core Capacity Improvement projects and streamline the New and Small Starts project development process. Moreover, MAP-21 shifted the initiation of project management oversight to the project development phase and removed the statutory requirement that recipients of financial assistance for projects with a total cost of $1 billion submit an annual financial plan. Given the fundamental changes to these competitive and formula capital programs, FTA withdrew the NPRM (78 FR 16460) to reexamine its proposed definition of major capital projects and its policy and procedures for risk assessment. Subsequently, the Fixing America's Surface Transportation (FAST) Act (Pub. L. 114-94) (December 4, 2015) further amended section 5327 to limit project management oversight to quarterly reviews, absent a finding that more frequent oversight was necessary, and mandated that the Secretary prescribe regulations outlining a process for at-risk recipients to return to quarterly reviews.

FTA has become much more knowledgeable about the risks inherent in major capital projects, having conducted its own risk assessments since 2005, witnessed some project sponsors' lack of management capacity and capability and appropriate project controls for some projects, and studied the reasons for cost and schedule changes on many major capital projects. Consequently, FTA now proposes to amend its project management oversight rule.

First, this proposed rule would change the applicability of the regulation by shifting the definition of a “major capital project” from one based on the type of project or total project cost to one based on both the amount of Federal financial assistance and the total project cost, which FTA views as a more appropriate benchmark than the type of project or total capital cost of a project alone. The current definition of a “major capital project” under 49 CFR 633.5 applies to all construction projects for new fixed guideways or extensions of existing fixed guideways, regardless of project cost, and to fixed guideway rehabilitation and modernization projects with total project costs over $100 million. The NPRM applies a project cost threshold to all fixed guideway capital projects. As a default, the proposed rule raises the total project cost threshold to $300 million or more and requires that the project receive $100 million or more in Federal investment to be subject to project management oversight. Under this default, the number of current projects undergoing project management oversight would decrease by forty-nine, out of a total of eighty-eight major capital projects under construction, allowing FTA to focus on higher-risk projects.

Second, as described in more detail below, the NPRM amends the regulation to bring it into compliance with recent statutory changes. The proposed rule limits project management oversight to quarterly reviews, absent a finding by FTA that a recipient requires more frequent oversight, and provides a process for such a recipient to return to quarterly reviews. Additionally, the rule applies project management oversight to major capital projects receiving Federal financial assistance under any provision of Federal law. The proposed changes would have no impact on safety.

This section proposes an update to reflect the mandate in 49 U.S.C. 5327(a) to perform program management oversight of major capital projects for public transportation under Chapter 53 of Title 49, United States Code, or any other provision of Federal law.

This section proposes an update to reflect the mandate in 49 U.S.C. 5327(a) that the regulation applies to recipients of Federal financial assistance undertaking a major capital project for public transportation under Chapter 53 of Title 49, United States Code, or any other provision of Federal Law.

This section sets forth the definitions of some key terms applicable to this rule. FTA proposes to establish a definition for “project development” and remove the definitions for “full funding agreement” and “FT Act.” Also, FTA proposes to amend the current definitions for “fixed guideway,” “major capital project,” “project management oversight,” and “recipient.”

The current definition of a “major capital project” under 49 CFR 633.5 applies to all construction projects for new fixed guideways or extensions of existing fixed guideways, regardless of project cost, and to rehabilitation and modernization projects with total project costs over $100 million. In this rule, FTA proposes to define a “major capital project” generally as a project to construct, expand, rehabilitate, or modernize a fixed guideway of $300 million or more that receives $100 million or more in Federal financial assistance. FTA believes it is more appropriate to apply the regulation to any given project based on the level of Federal investment in addition to total project cost, as opposed to the type of project or the total project cost alone. FTA further proposes that a project that does not meet the dollar-amount thresholds for the level of Federal investment and total project cost may be deemed a “major capital project” under certain circumstances.

This section would amend the definition of “fixed guideway” to add passenger ferries as a qualifying public transportation facility, to reflect amendments made by MAP-21 to the definition of “fixed guideway” under 49 U.S.C. 5302(7). FTA proposes to add a definition for “project development” to correspond with the MAP-21 requirement that oversight begins in this phase, as reflected in 49 U.S.C. 5327(d)(2)(A). The proposed changes to the remaining definitions, “project management oversight” and “recipient,” are simply for clarity.

This section would amend the current rule by omitting obsolete legal citations and extending the regulation to all major capital projects funded from any source under 49 U.S.C. Chapter 53 or any other Federal Law, as required under 49 U.S.C. 5327(a).

This section would make amendments for clarity and consistency with recent statutory changes. Per 49 U.S.C. 5327(d)(2)(A), project management oversight now begins during the project development phase unless the Secretary determines that it is more appropriate to begin the oversight during another phase of the project to maximize the transportation benefits and cost savings.

This section would make amendments for clarity.

This section would make amendments for clarity.

FTA proposes revising this section as it is no longer necessary to identify the administrative funding source (now in 49 U.S.C. 5338) for FTA to conduct project management oversight. Instead, this section would provide for an exclusion from the definition of “major capital project” for projects for which the Administrator determines that project management oversight would not benefit the Federal government or the recipient.

This section would make amendments for clarity and to reflect that oversight now begins during the project development phase of the project, as required under 49 U.S.C. 5327(a).

This section would make amendments for clarity.

The project management plan is critical to successful management of any major capital project, throughout the development and implementation of that project. The project management plan and its sub plans further enable the sponsor's staff to effectively manage the scope, budget, schedule, and quality of the project through a set of common objectives, while managing the safety and security of the public. This section would provide a summary to clarify that a project management plan is not one-size-fits-all, but rather is based on the complexity of the project. Further, as required under 49 U.S.C. 5327(a), FTA proposes adding three additional minimum elements to the plan: Periodic updates of the plan, the recipient's commitment to submit a quarterly project budget and schedule, and safety and security management. Additionally, based on industry best practice, FTA proposes adding the management of risks, contingencies, and insurance as an element of the plan.

FTA's review and approval of a project management plan seeks to verify that a sponsor has all the relevant capabilities and resources in place to ensure successful management of the project using available best practices. A project management plan is a dynamic management tool that requires periodic updates when a project transitions from one phase to another, or as a result of other changes, such as turnover in personnel. This section would continue the requirement for regular reporting and clarify other requirements aimed at improving the management of a major capital project. Specifically, FTA's proposed amendments would limit oversight to quarterly reviews, as opposed to monthly reviews, but provide for more frequent oversight when the recipient fails to meet the requirements of the project management plan and the project is at risk of materially exceeding the budget or falling behind schedule. This section also would add a process for at-risk and noncompliant projects undergoing more frequent oversight to return to quarterly reviews.

FTA proposes repealing this section. Instead, section 633.25 of this part, as amended, would provide sufficient flexibility to reflect FTA's practices. FTA may permit a recipient when developing a project management plan to incorporate applicable elements from a previously approved project management plan or to incorporate procedures that a recipient uses to manage other capital projects on a programmatic basis.

This proposed rule is expected to be an Executive Order 13771 deregulatory action. Details on the estimated cost savings of this proposed rule can be found in the rule's economic analysis.

Executive Orders 12866 and 13563 direct Federal agencies to assess all costs and benefits of available regulatory alternatives and, if regulation is necessary, to select regulatory approaches that maximize net benefits—including potential economic, environmental, public health and safety effects, distributive impacts, and equity. The proposed rule would amend the definition of a “major capital project” under 49 CFR part 633 by raising the total project cost threshold and adding a minimum Federal share, thereby reducing the number of public transportation projects subject to project management oversight. This action complies with Executive Orders 12866 and 13563 to improve regulation.

FTA has determined that this rulemaking is not a significant regulatory action within the meaning of Executive Order 12866 and within the meaning of DOT regulatory policies and procedures. FTA has examined the potential economic impacts of this rulemaking and has determined that this rulemaking is not economically significant because it will not result in an effect on the economy of $100 million or more. Additionally, this proposed rule would not have an impact on another agency and would not materially alter the budgetary impacts of entitlements, grants, user fees, or loan programs. This rule would not raise novel legal issues.

To calculate the benefits and annual cost savings from this proposed rule, FTA evaluated its project management oversight contracts for major capital projects from 2013 through 2018. This period was chosen to reflect changes to FTA's program management oversight procedures after MAP-21 was enacted in 2012. This period included a number of emergency relief program projects under 49 U.S.C. 5324 to repair significant damages to public transportation infrastructure resulting from Hurricane Sandy, which FTA also analyzed.

Using FTA's risk evaluation tool, FTA evaluated projects in construction during that period based on ten key risk factors to produce a risk score from 0-100. Projects were then assigned a risk range based on the calculated score, with low-risk projects in the range of 0-39, medium-risk projects from 40-55, and high-risk projects from 56-100. This evaluation indicated that a majority of high-risk projects, including eighteen of the twenty-two projects in the high-risk range, involved total project costs of over $300 million. While removing project management oversight from projects with total costs between $100 and $300 million may increase the risk of materially exceeding budget or falling behind schedule for some projects, there are currently only four high-risk projects in this range, and under the proposed rule, FTA may deem certain projects that do not meet the dollar-amount thresholds a “major capital project” to mitigate unacceptable risk. Additionally, reducing the number of lower-risk projects undergoing project management oversight will allow FTA to focus on higher-risk projects while yielding annual cost savings to FTA and its recipients.

FTA calculated the average total cost of oversight for projects in construction during that period that would not have qualified as major capital projects under the default threshold of this proposed rule. FTA estimates that an average of 38.3 projects annually, including emergency relief program projects, would no longer require additional oversight under the default threshold.

This proposed rule would reduce recipients' labor hours for oversight procedures, which include attending meetings, preparing quarterly reports and other requested documents, and accompanying contractors onto project construction sites. To estimate the potential cost savings for project sponsors, FTA staff examined the current projects in construction that would no longer qualify as major capital projects under the NPRM and estimated the level of effort required for oversight procedures. For two projects, FTA received input from recipients. Assuming variations in the level of effort based on the complexity of the project, FTA estimated that the labor hours required for recipients ranges from 1.7 to 2.3 times FTA's level of effort of approximately 39,477 hours per year for project management oversight procedures. Accordingly, FTA used an average factor of two and determined that the default threshold to qualify as a major capital project under the proposed rule would reduce the level of effort required for project sponsors by an average of 78,955 hours annually at a wage rate of $139.67 based on an average of the Bureau of Labor Statistics rate for Construction Managers and the PMOC loaded rate for contractors. This burden reduction would result in an annual cost savings to project sponsors of approximately $11 million.

In addition, the proposed rule would reduce the level of effort required under FTA's project management oversight contracts and yield corresponding cost savings to FTA. Removing oversight from an average of 38.3 projects annually would yield annual cost savings to FTA of approximately $8.1 million.

In compliance with the Regulatory Flexibility Act (Pub. L. 96-354; 5 U.S.C. 601-612), FTA has evaluated the likely effects of the proposals set forth in this NPRM on small entities, and has determined that the NPRM would not have a significant economic impact on a substantial number of small entities.

FTA has determined that this rule does not impose unfunded mandates, as defined by the Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4, March 22, 1995, 109 Stat. 48). This rule does not include a Federal mandate that may result in expenditures of $155.1 million or more in any 1 year (when adjusted for inflation) in 2012 dollars for either State, local, and tribal governments in the aggregate, or by the private sector. Additionally, the definition of “Federal mandate” in the Unfunded Mandates Reform Act excludes financial assistance of the type in which State, local, or tribal governments have authority to adjust their participation in the program in accordance with changes made in the program by the Federal Government. Federal public transportation law permits this type of flexibility.

Executive Order 13132 requires agencies to assure meaningful and timely input by State and local officials in the development of regulatory policies that may have a substantial direct effect on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government. FTA has analyzed this action in accordance with the principles and criteria contained in Executive Order 13132, and FTA determined that this action will not have a substantial direct effect or federalism implications on the States. FTA also determined that this action will not preempt any State law or regulation or affect the States' ability to discharge traditional State governmental functions.

The regulations effectuating Executive Order 12372 regarding intergovernmental consultation on Federal programs and activities apply to this proposed rulemaking.

Federal agencies must obtain approval from the Office of Management and Budget (OMB) for each collection of information they conduct, sponsor, or require through regulations. FTA has analyzed this rule under the Paperwork Reduction Act and determined that it does not impose additional information collection requirements for the purposes of the Act above and beyond existing information collection clearances from OMB.

NEPA requires Federal agencies to analyze the potential environmental effects of their proposed actions in the form of a categorical exclusion, environmental assessment, or environmental impact statement. This proposed rulemaking is categorically excluded under FTA's environmental impact procedure at 23 CFR 771.118(c)(4), which pertains to planning and administrative activities that do not involve or lead directly to construction, such as the promulgation of rules, regulations, and directives. FTA has determined that no unusual circumstances exist in this instance, and that a categorical exclusion is appropriate for this rulemaking.

FTA has analyzed this rule under Executive Order 12630, Governmental Actions and Interference with Constitutionally Protected Property Rights. FTA does not believe this rule effects a taking of private property or otherwise has taking implications under Executive Order 12630.

Executive Order 12898, Federal Actions to Address Environmental Justice in Minority Populations and Low-Income Populations, and DOT Order 5610.2(a) (77 FR 27534) require DOT agencies to achieve environmental justice (EJ) as part of their mission by identifying and addressing, as appropriate, disproportionately high and adverse human health or environmental effects, including interrelated social and economic effects, of their programs, policies, and activities on minority and/or low-income populations. The DOT Order requires DOT agencies to address compliance with the Executive Order and the DOT Order in all rulemaking activities. In addition, on July 17, 2014, FTA issued a circular to update its EJ Policy Guidance for Federal Transit Recipients ( www.fta.dot.gov/legislation_law/12349_14740.html ), which addresses administration of the Executive Order and DOT Order.

FTA has evaluated this rule under the Executive Order, the DOT Order, and the FTA Circular and has determined that this rulemaking will not cause disproportionately high and adverse human health and environmental effects on minority or low-income populations.

This action meets the applicable standards in sections 3(a) and 3(b)(2) of Executive Order 12988 (February 5, 1996), Civil Justice Reform, to minimize litigation, eliminate ambiguity, and reduce burden.

FTA has analyzed this proposed rulemaking under Executive Order 13045 (April 21, 1997), Protection of Children from Environmental Health Risks and Safety Risks. FTA certifies that this proposed rule will not cause an environmental risk to health or safety that might disproportionately affect children.

FTA has analyzed this action under Executive Order 13175 (November 6, 2000), and determined that it will not have substantial direct effects on one or more Indian tribes; will not impose substantial direct compliance costs on Indian tribal governments; and will not preempt tribal laws. Therefore, a tribal summary impact statement is not required.

FTA has analyzed this proposed rulemaking under Executive Order 13211, Actions Concerning Regulations That Significantly Affect Energy Supply, Distribution, or Use (May 18, 2001). FTA has determined that this action is not a significant energy action under the Executive Order, given that the action is not likely to have a significant adverse effect on the supply, distribution, or use of energy. Therefore, a Statement of Energy Effects is not requirement.

Anyone may search the electronic form of all comments received into any of FTA's dockets by the name of the individual submitting the comment, or signing the comment if submitted on behalf of an association, business, labor union, or any other entity. You may review USDOT's complete Privacy Act Statement published in the Federal Register on April 11, 2000, at 65 FR 19477-8.

This rulemaking is issued under the authority of 49 U.S.C. 5327, which requires the Secretary to conduct oversight of major capital projects and to promulgate a rule for that purpose that includes a definition of major capital project to delineate the types of projects governed by the rule.

A Regulation Identifier Number (RIN) is assigned to each regulatory action listed in the Unified Agenda of Federal Regulations. The Regulatory Information Service Center publishes the Unified Agenda in April and October of each year. The RIN set forth in the heading of this document can be used to cross-reference this action with the Unified Agenda.

In consideration of the foregoing, and under the authority of 49 U.S.C. 5327, the Federal Transit Administration proposes to amend 49 CFR chapter VI by revising part 633, as follows:

The Magnuson-Stevens Fishery Conservation and Management Act (Magnuson-Stevens Act) requires that each Regional Fishery Management Council submit any amendment it prepares to NMFS for review and approval, disapproval, or partial approval. The Magnuson-Stevens Act also requires that NMFS, upon receiving an amendment, immediately publish notification in the Federal Register that the amendment is available for public review and comment. The Council submitted its final version of Omnibus Deep-Sea Coral Amendment to NMFS for review on June 25, 2019. NMFS has declared a transmittal date of August 20, 2019. The Council has reviewed the Omnibus Deep-Sea Coral Amendment proposed rule regulations as drafted by NMFS and deemed them to be necessary and appropriate as specified in section 303(c) of the Magnuson-Stevens Act.

The coral protection zones included in this amendment were initially developed during 2010 and 2011 as part of the Council's Omnibus Essential Fish Habitat Amendment 2 (OHA2), finalized April 9, 2018 (83 FR 15240; April 9, 2018). In September 2012, the Council split the coral protection zones and associated management measures out of OHA2 into a separate omnibus amendment. On March 13 and 15, 2017, the Council held workshops in New Bedford, MA, and Portsmouth, NH, to discuss the coral zone boundaries, considering the canyon and slope zones on Georges Bank (broad zone) at the first meeting and the offshore Gulf of Maine zones at the second. On April 18, 2017, the Council chose preferred alternatives for the coral zones to go out to public hearing. The Council held public hearings throughout New England in May of 2017, and revisited its preferred alternatives at its June 2017 meeting. On June 22, 2017, the Council took final action on the Gulf of Maine portions of the amendment, but did not select final preferred alternatives for the broad coral protection zone on Georges Bank. Instead, the Council added a new alternative for analysis that was suggested during the public hearings. Finally, on January 30, 2018, the Council selected a final preferred alternative for the broad zone and adopted the Omnibus Deep-Sea Coral Amendment.

The Council submitted the Amendment to NMFS for initial review on December 21, 2018. Due to the lapse in Federal appropriations, NMFS's review of the document was delayed. The Council submitted a revised draft of the Amendment on June 25, 2019, for final review by NMFS, acting on behalf of the Secretary of Commerce.

The Council developed this action, and the measures described in this proposed rule, under the discretionary provisions for deep-sea coral protection in section 303(b) of the Magnuson-Stevens Act. This provision gives the Regional Fishery Management Councils the authority to:

(A) Designate zones where, and periods when, fishing shall be limited, or shall not be permitted, or shall be permitted only by specified types of fishing vessels or with specified types and quantities of fishing gear; and

(B) Designate such zones in areas where deep-sea corals are identified under section 408 (this section describes the deep-sea coral research and technology program), to protect deep-sea corals from physical damage from fishing gear or to prevent loss or damage to such fishing gear from interactions with deep-sea corals, after considering long-term sustainable uses of fishery resources in such areas.

Consistent with these provisions, the Council proposed the measures in the Omnibus Deep-Sea Coral Amendment. These measures are designed to identify and protect concentrations of corals in select areas and restrict the expansion of fishing effort into areas where corals are likely to be present. The measures also take into account long-term sustainable uses of fishery resources in the areas and the economic impacts to commercial fisheries. Measures recommended by the Council would:

• Establish a deep-sea coral protection area on the outer continental shelf in New England waters. It would complement the Frank R. Lautenberg Deep-Sea Coral Protection Area established by the Mid-Atlantic Fishery Management Council in Amendment 16 to the Atlantic Mackerel, Squid, and Butterfish Fishery Management Plan (81 FR 90246; December 14, 2016) as described in § 648.372. The area would run along the outer continental shelf in waters no shallower than 600 m and extend to the outer limit of U.S. Exclusive Economic Zone boundary to the east and north, and south to the intercouncil boundary as described in § 600.105(a);

• Restrict the use of bottom-tending commercial fishing gear within the designated deep-sea coral area, including: Bottom-tending otter trawls; bottom-tending beam trawls; hydraulic dredges; non-hydraulic dredges; bottom-tending seines; bottom longlines; pots and traps; and sink or anchored gillnets. The prohibition on these gears would protect deep-sea corals from interaction with and damage from bottom-tending fishing gear. Red crab pot gear would be exempt from the prohibition;

• Designate a coral protection area in an 8-mi 2 (21-km 2 ) area southwest of Mount Desert Rock, a small, rocky island off the eastern Maine coast, about 20 nm (37 km) south of Mount Desert Island, encompassing depths of 100-200 m. Vessels would be prohibited from fishing with bottom-tending mobile gear in this area. Bottom-tending mobile gear includes but is not limited to: Bottom-tending otter trawls; bottom-tending beam trawls; hydraulic dredges; non-hydraulic dredges; and seines (with the exception of a purse seine);

• Designate a coral protection area in a 31-mi 2 (79-km 2 ) area on the Outer Schoodic Ridge, roughly 25 nm (46 km) southeast of Mount Desert Island, encompassing depths of 104-248 m. Vessels would be prohibited from fishing in this area with the same bottom-tending mobile gears as identified in the Mount Desert Rock area;

• Establish provisions for vessels transiting through the coral protection areas;

• Designate the area around Jordan Basin in the Gulf of Maine as a dedicated habitat research area; and

• Expand framework adjustment provisions in the New England fishery management plans (FMP) for future modifications to the deep-sea coral protection measures.

The Magnuson-Stevens Act allows us to approve, partially approve, or disapprove measures recommended by the Council in an amendment based on whether the measures are consistent with the FMPs, plan amendment, the Magnuson-Stevens Act and its National Standards, and other applicable law. The Council develops policy for its fisheries and we defer to the Council on policy decisions unless those policies are inconsistent with the Magnuson-Steven Act or other applicable law. As such, we are seeking comment on whether measures in Omnibus Deep-Sea Coral Amendment are consistent with the FMPs, the Magnuson-Stevens Act and its National Standards, and other applicable law. Through this notice, NMFS seeks comments on Omnibus Deep-Sea Coral Amendment and its incorporated documents through the end of the comment period stated in the DATES section of this notice of availability (NOA). Following the publication of this NOA a rule proposing the implementation of measures in this amendment is anticipated to be published in the Federal Register for public comment. Public comments must be received by the end of the comment period provided in this NOA of the Omnibus Deep-Sea Coral Amendment to be considered in the approval/disapproval decision. All comments received by the end of the comment period on the NOA, whether specifically directed to the NOA or the proposed rule, will be considered in the approval/disapproval decision. Comments received after the end of the comment period for the NOA will not be considered in the approval/disapproval decision of the Omnibus Deep-Sea Coral Amendment.