Last month, the US Department of Health and Human Services (HHS) proposed regulations to change current rules regarding the protection of patient records in federally run substance use disorders (SUD) programs. Currently, these SUD rules differ from what is required under the Health Insurance Portability and Accountability Act (HIPAA) which has led to challenges in sharing information and obstacles to access services. The primary section for modification is Part 2 of Title 42 of the Code of Federal Regulations (Part 2).
Part 2 has been considered by some SUD advocates and providers as an impediment to providing services to patients. Part 2 was originally intended to provide protection from discrimination for patients who sought/received SUD treatment. The regulations applied to certain federally assisted programs and it required a patient’s written consent before making a disclosure of their records. Consent always had to be written and there were only a few limited exceptions such as medical emergencies or if a specific court order was issued. Part 2 requirements do not always align with what is required in HIPAA. For example, even after consent is given and records are disclosed, the receiving provider will also have to abide by the Part 2 protections. Therefore, the patient’s consent must always be obtained each time there is a new interaction with another practitioner which can happen when telehealth is employed. This could create a significant administrative burden on the provider as well as require the patient to repeatedly provide written consent.
As noted in the HHS press release, Secretary Xavier Becerra said,
“Varying requirements of privacy laws can slow treatment, inhibit care, and perpetuate negative stereotypes about people facing substance use challenges. This proposed rule would improve coordination of care for patients receiving treatment while strengthening critical privacy protections to help ensure individuals do not forego life-saving care due to concerns about records disclosure.”
Per the press release, the proposed changes include:
- Permitted use and disclosure of Part 2 records based on a single patient consent given once for all future uses and disclosures for treatment, payment, and health care operations.
- Permitted redisclosure of Part 2 records in any manner permitted by the HIPAA Privacy Rule, with certain exceptions.
- New patient rights under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule.
- Expanded prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings.
- New HHS enforcement authority, including the imposition of civil money penalties for violations of Part 2.
- Updated breach notification requirements to HHS and affected patients.
- Updated HIPAA Privacy Rule Notice of Privacy Practices requirements to address uses and disclosures of Part 2 records and individual rights with respect to those records.
Given the increased interest in and use of telehealth to treat SUD, telehealth providers will also benefit from these changes as they will help facilitate their ability to treat patients. Patients in turn will have another avenue through telehealth to access services.
Comments are due on or before January 31, 2023. To read the proposed regulations, go to the
Federal Register.