HHS Proposes New Protections for Patients With Substance Use Challenges

WASHINGTON — The U.S. Department of Health and Human Services has proposed changes to federal regulations governing the confidentiality of medical records related to substance abuse disorders.

According to department officials, the proposed changes to Confidentiality of Substance Use Disorder Patient Records under 42 CFR part 2 (“Part 2”) would both increase coordination among treatment providers and further prevent disclosure of these records to avoid discrimination in treatment.

“Varying requirements of privacy laws can slow treatment, inhibit care, and perpetuate negative stereotypes about people facing substance use challenges,” HHS Secretary Xavier Becerra said in a written statement.

“This proposed rule would improve coordination of care for patients receiving treatment while strengthening critical privacy protections to help ensure individuals do not forego life-saving care due to concerns about records disclosure,” he added.

This Notice of Proposed Rulemaking would implement provisions of Section 3221 of the Coronavirus Aid, Relief, and Economic Security Act that, among other things, require HHS to bring Part 2 into greater alignment with certain aspects of the Health Insurance Portability and Accountability Act of 1996 Privacy, Breach Notification, and Enforcement Rules.

“HHS understands how critical it is for patients to better align the Part 2 rules and program with HIPAA,” said Office for Civil Rights Director Melanie Fontes Rainer in a written statement.

“This proposed rule helps decrease burdens on patients and providers, improves coordination and increases access to care and treatment, while protecting confidentiality of treatment records,” Rainer said.

Part 2 currently imposes different requirements for SUD treatment records protected by Part 2 than the HIPAA Privacy Rule, which can create barriers to information sharing by patients and among health care providers and create dual obligations and compliance challenges for regulated entities.

That led Congress to require that privacy protections for this program be more closely aligned with the HIPAA Privacy rule.

The proposed rule from HHS outlines several important changes that can help safeguard the health and outcomes of individuals with SUD and create greater flexibility for information sharing envisioned by Congress in its passage of Section 3221 of the CARES Act.

Proposed changes include:

• Permitted use and disclosure of Part 2 records based on a single patient consent given once for all future uses and disclosures for treatment, payment and health care operations.
• Permitted redisclosure of Part 2 records in any manner permitted by the HIPAA Privacy Rule, with certain exceptions.
• New patient rights under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule.
• Expanded prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative and legislative proceedings.
• New HHS enforcement authority, including the imposition of civil money penalties for violations of Part 2.
• Updated breach notification requirements to HHS and affected patients.
• Updated HIPAA Privacy Rule Notice of Privacy Practices requirements to address uses and disclosures of Part 2 records and individual rights with respect to those records.

A fact sheet on the changes can be found here. 

Dan can be reached at [email protected] and at https://twitter.com/DanMcCue