On Monday, the U.S. Department of Health and Human Services, through the Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA), announced proposed changes to the Confidentiality of Substance Use Disorder (SUD) Patient Records under 42 CFR part 2 (“Part 2”), which protects patient privacy and records regarding treatment for substance use challenges from unauthorized disclosures.
Specifically, today’s proposed regulation strengthens cooperation among clinicians in the treatment of substance use disorders and increases patient safeguards regarding the disclosure of medical data to prevent treatment discrimination.
According to Secretary Xavier Becerra, the varying requirements of privacy laws can prolong treatment, impede care, and reinforce unfavorable preconceptions about those with substance use disorders. “This proposed rule would improve coordination of care for patients receiving treatment while reinforcing vital privacy protections to guarantee that individuals do not avoid life-saving care owing to worries about record disclosure.”
This Notice of Proposed Rulemaking (NPRM) would implement provisions of Section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), which, among other things, require HHS to bring Part 2 into greater alignment with certain HIPAA Privacy, Breach Notification, and Enforcement Rules.
Melanie Fontes Rainer, director of the OCR, stated that HHS recognizes the importance of aligning the Part 2 rules and program with HIPAA for the benefit of patients. This proposed regulation reduces costs on patients and providers, enhances coordination, and expands access to care and treatment, all while safeguarding the privacy of treatment information.
Miriam E. Delphin-Rittmon, Ph.D., the HHS Assistant Secretary for Mental Health and Substance Use and the CEO of SAMHSA, stated, “One of SAMHSA’s top priorities is to make excellent treatments and recovery supports for SUD more available to all Americans.” “Bringing Part 2 regulations more into sync with HIPAA will facilitate more effective care coordination for those gaining access to care.”
Simultaneously, the proposed rule mitigates the discrimination and stigma that we know people with SUDs suffer all too frequently.” Part 2 currently imposes different criteria for SUD treatment records protected by Part 2 than the HIPAA Privacy Rule, which can create hurdles to information sharing among patients and health care providers, as well as dual obligations and compliance issues for regulated entities.
Congress, therefore, mandated that the privacy protections for this program be more closely aligned with the HIPAA Privacy Rule. The proposed rule released today details a number of significant modifications that can assist protect the health and outcomes of individuals with SUD and enable greater flexibility for information sharing, as envisioned by Congress in Section 3221 of the CARES Act. Changes proposed include:
- Permitted use and disclosure of Part 2 records based on a single patient consent given once for all future treatment, payment, and health care operations uses and disclosures.
- Permitted redisclosure of Part 2 records in any manner allowed by the HIPAA Privacy Rule, with a few exclusions.
- The HIPAA Privacy Rule also grants new patients rights under Part 2 to receive an accounting of disclosures and to request restrictions on specific disclosures.
- Expanded restrictions on the disclosure and use of Part 2 records in civil, criminal, administrative, and legislative procedures.
- New enforcement authorities for HHS, including the ability to impose civil monetary penalties for violations of Part 2.
- Updated rules for breach notification to HHS and affected patients.
- Updated HIPAA Privacy Rule Notice of Privacy Practices requirements to address uses and disclosures of Part 2 records as well as individual rights with regard to such records.
