HHS Proposes Rules to Make Part 2 Regulations and HIPAA Consistent
January 12, 2023
By: Robert A. Anderson and Alexandria M. Foster
The U.S. Department of Health and Human Services (“HHS”), through the Substance Abuse and Mental Health Services Administration (“SAMHSA”), recently announced proposed changes to the protection of substance use disorder patient records under 42 CFR Part 2 (“Part 2”). Part 2 regulations govern the confidentiality of patient records created by federally assisted programs for substance use disorder treatment. HHS’s proposed rule has two objectives: (i) to increase care coordination among providers; and (ii) increase confidentiality protections for disclosure of patient records.
Providers who treat substance use disorder are bound by different state and federal privacy laws regarding permitted use and disclosure of treatment records. The variations between these laws, specifically Part 2 and HIPAA, can inhibit the sharing of information between providers, and consequently, patient care. These legal complexities can also create compliance issues for providers navigating regulatory schemes. In response to these issues, the proposed rule incorporates provisions of the Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”) that require greater alignment between Part 2 and HIPAA. HHS Assistant Secretary for Mental Health and Substance Use and the leader of SAMSHA stated, “[b]ringing Part 2 requirements into closer alignment with HIPAA will support more effective coordination for people accessing care. At the same time, the proposed rule mitigates the discrimination and stigma that we know too often people with substance use disorders experience.”
The proposed rule includes substantial changes to Part 2, which include:
- Allowing Part 2 programs to use and disclose Part 2 records under a single prior patient consent for all future uses and disclosures for treatment, payment, and health care operations
- Permitting the redisclosure of Part 2 records as permitted by HIPAA by Part 2 programs, covered entities, and business associates
- Prohibiting the use and disclosure of Part 2 records in civil, criminal, administrative, or legislative proceedings
- Expanding patient rights under Part 2 regarding a right to: (i) an accounting of disclosures; and (ii) request restrictions on disclosures for treatment, payment, and health care operations
- Applying the HITECH Act and the HIPAA breach notification rule to breaches involving Part 2 records
- Modifying the Part 2 confidentiality notice requirements to align with HIPAA’s Notice of Privacy Practices
The proposed rule is open to public comments until January 31, 2023. HHS has encouraged health care providers, health plans, health care professional associations, patients, and other stakeholders to submit comments, which can be done here. For questions regarding these proposed changes to Part 2, or other health care privacy and security related issues, please contact Robert A. Anderson, Alexandria M. Foster, or your regular Krieg DeVault healthcare attorney.
Disclaimer. The contents of this article should not be construed as legal advice or a legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult with counsel concerning your situation and specific legal questions you may have.
Practices
Industries
January 12, 2023
By: Robert A. Anderson and Alexandria M. Foster
The U.S. Department of Health and Human Services (“HHS”), through the Substance Abuse and Mental Health Services Administration (“SAMHSA”), recently announced proposed changes to the protection of substance use disorder patient records under 42 CFR Part 2 (“Part 2”). Part 2 regulations govern the confidentiality of patient records created by federally assisted programs for substance use disorder treatment. HHS’s proposed rule has two objectives: (i) to increase care coordination among providers; and (ii) increase confidentiality protections for disclosure of patient records.
Providers who treat substance use disorder are bound by different state and federal privacy laws regarding permitted use and disclosure of treatment records. The variations between these laws, specifically Part 2 and HIPAA, can inhibit the sharing of information between providers, and consequently, patient care. These legal complexities can also create compliance issues for providers navigating regulatory schemes. In response to these issues, the proposed rule incorporates provisions of the Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”) that require greater alignment between Part 2 and HIPAA. HHS Assistant Secretary for Mental Health and Substance Use and the leader of SAMSHA stated, “[b]ringing Part 2 requirements into closer alignment with HIPAA will support more effective coordination for people accessing care. At the same time, the proposed rule mitigates the discrimination and stigma that we know too often people with substance use disorders experience.”
The proposed rule includes substantial changes to Part 2, which include:
- Allowing Part 2 programs to use and disclose Part 2 records under a single prior patient consent for all future uses and disclosures for treatment, payment, and health care operations
- Permitting the redisclosure of Part 2 records as permitted by HIPAA by Part 2 programs, covered entities, and business associates
- Prohibiting the use and disclosure of Part 2 records in civil, criminal, administrative, or legislative proceedings
- Expanding patient rights under Part 2 regarding a right to: (i) an accounting of disclosures; and (ii) request restrictions on disclosures for treatment, payment, and health care operations
- Applying the HITECH Act and the HIPAA breach notification rule to breaches involving Part 2 records
- Modifying the Part 2 confidentiality notice requirements to align with HIPAA’s Notice of Privacy Practices
The proposed rule is open to public comments until January 31, 2023. HHS has encouraged health care providers, health plans, health care professional associations, patients, and other stakeholders to submit comments, which can be done here. For questions regarding these proposed changes to Part 2, or other health care privacy and security related issues, please contact Robert A. Anderson, Alexandria M. Foster, or your regular Krieg DeVault healthcare attorney.
Disclaimer. The contents of this article should not be construed as legal advice or a legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult with counsel concerning your situation and specific legal questions you may have.