On December 2, 2022, the U.S. Department of Health and Human Services (“HHS”), through the Office for Civil Rights (“OCR”) and the Substance Abuse and Mental Health Services Administration (“SAMHSA”), issued a proposed rule to implement statutory amendments enacted by Section 3221 of the 2020 Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”). Specifically, the proposed rule would harmonize certain provisions of the Confidentiality of Substance Use Disorder Patient Records under 42 C.F.R. Part 2 (“Part 2”) with the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations (collectively, “HIPAA”).
Section 3221 of the CARES Act amended several provisions of the statute underlying the Part 2 regulations to better align Part 2 with HIPAA. For example, as amended, the statute permits an individual’s substance use disorder records regulated by Part 2 (“SUD Records”) to be used and disclosed in accordance with a single prior consent and allows HIPAA covered entities and their business associates to disclose SUD Records for treatment, payment, and health care operations in accordance with HIPAA when an individual has provided consent to the disclosure of his/her SUD Records. Prior to the changes made by the CARES Act, the disclosure of SUD Records required a specific, written consent for each proposed disclosure, and it was permissible to disclose SUD Records without consent only in limited circumstances (e.g., medical emergency or court order). As a result, entities subject to both HIPAA and Part 2 were required to follow different, more restrictive procedures for the disclosure of SUD Records than for the disclosure of other protected health information (“PHI”).
The CARES Act required HHS to engage in rulemaking to implement various statutory changes. Specifically, the proposed rule would modify Part 2 in accordance with the CARES Act by:
- Generally allowing for the redisclosure of SUD Records in the same manner permitted by the HIPAA Privacy Rule (i.e., allowing for a single consent to suffice for Part 2 covered entities as it relates to further disclosures of SUD Records for treatment, payment, and health care operations), though the proposed rule requires any disclosures of SUD Records to non-HIPAA covered entities or business associates be pursuant to contractual or legally equivalent restrictions on the recipient’s use and disclosure of SUD Records in accordance with those permissible under Part 2;
- Giving individuals a right to an accounting of and restriction on disclosures of SUD Records, in accordance with the rights individuals have under HIPAA with respect to their PHI;
- Expanding the prohibition on the use and disclosures of SUD Records in civil, criminal, administrative, and legislative proceedings against patients unless patient consent or a court order is issued;
- Applying the same civil and criminal penalties to violations of Part 2 as apply to violations of HIPAA (e.g., the imposition of civil monetary penalties);
- Applying the same breach notification standards to breaches of SUD Records as apply to breaches of PHI in accordance with the HIPAA Breach Notification Rule;
- Modifying the requirements for a Part 2 patient confidentiality notice to more closely align with the requirements and content of a HIPAA Notice of Privacy Practices (“NPP”); and
- Aligning the requirements for a valid written consent under Part 2 with the requirements for a valid HIPAA authorization under the Privacy Rule.
The proposed rule would also modify the HIPAA Privacy Rule to require covered entities that receive and maintain SUD Records—and thus must comply with Part 2 requirements for these records—to modify their NPPs to reference patients’ rights with respect to SUD Rrecords. For example, impacted covered entities would be required to disclose the uses and disclosures of SUD Records that are permitted or required without an authorization.
The CARES Act also contained certain antidiscrimination provisions related to SUD Records that HHS intends to implement as part of a separate rulemaking process.
Comments on the proposed rule are due by January 31, 2023.