New Proposed Rule to Implement the Bipartisan CARES Act Legislation
Today, the U.S. Health and Human Services Department, through the Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA), announced proposed changes to the Confidentiality of Substance Use Disorder (SUD) Patient Records under 42 CFR part 2 (“Part 2”), which protects patient privacy and records concerning treatment related to substance use challenges from unauthorized disclosures. Specifically, today’s proposed rule increases coordination among providers in treatment for substance use challenges and increases protections for patients concerning records disclosure to avoid discrimination in treatment.
“Varying requirements of privacy laws can slow treatment, inhibit care, and perpetuate negative stereotypes about people facing substance use challenges,” said Secretary Xavier Becerra. “This proposed rule would improve coordination of care for patients receiving treatment while strengthening critical privacy protections to help ensure individuals do not forego life-saving care due to concerns about records disclosure.”
This Notice of Proposed Rulemaking (NPRM) would implement provisions of Section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) that, among other things, require HHS to bring Part 2 into greater alignment with certain aspects of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Breach Notification, and Enforcement Rules.
“HHS understands how critical it is for patients to better align the Part 2 rules and program with HIPAA,” said OCR Director Melanie Fontes Rainer. “This proposed rule helps decrease burdens on patients and providers, improves coordination and increases access to care and treatment, while protecting confidentiality of treatment records.”
“One of SAMHSA’s priorities is working to make effective treatments and recovery supports for SUD more accessible to all Americans,” said Miriam E. Delphin-Rittmon, Ph.D., the HHS Assistant Secretary for Mental Health and Substance Use and the leader of SAMHSA. “Bringing Part 2 requirements into closer alignment with HIPAA will support more effective coordination for people accessing care. At the same time, the proposed rule mitigates the discrimination and stigma that we know too often people with SUDs experience.”
Part 2 currently imposes different requirements for SUD treatment records protected by Part 2 than the HIPAA Privacy Rule, which can create barriers to information sharing by patients and among health care providers and create dual obligations and compliance challenges for regulated entities. That’s why Congress required that privacy protections for this program be more closely aligned with the HIPAA Privacy rule. Today’s proposed rule outlines several important changes that can help safeguard the health and outcomes of individuals with SUD and create greater flexibility for information sharing envisioned by Congress in its passage of Section 3221 of the CARES Act. Proposed changes include:
- Permitted use and disclosure of Part 2 records based on a single patient consent given once for all future uses and disclosures for treatment, payment, and health care operations.
- Permitted redisclosure of Part 2 records in any manner permitted by the HIPAA Privacy Rule, with certain exceptions.
- New patient rights under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule.
- Expanded prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings.
- New HHS enforcement authority, including the imposition of civil money penalties for violations of Part 2.
- Updated breach notification requirements to HHS and affected patients.
- Updated HIPAA Privacy Rule Notice of Privacy Practices requirements to address uses and disclosures of Part 2 records and individual rights with respect to those records.
HHS encourages all stakeholders, including patients and their families, health insurance issuers, health care providers, health care professional associations, consumer advocates, and state and local government entities, to submit comments through regulations.gov.
Public comments on the NPRM are due 60 days after publication of the NPRM in the Federal Register. The NPRM may be viewed or downloaded at: https://www.federalregister.gov/public-inspection/2022-25784/confidentiality-of-substance-use-disorder-patient-records.
A fact sheet may be found at: https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/hipaa-part-2/index.html.
