On November 28, 2022, the Department of Health and Human Services (HHS) issued a proposed rule to modify the confidentiality protections of Substance Use Disorder (SUD) patient treatment records under 42 CFR Part 2 (Part 2) to implement statutory amendments passed under Section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act (42 U.S.C. 290dd-2). Comments are being accepted for 60 days from the date of publication.
HHS indicates in the proposed rule that the current confidentiality provisions under Part 2 (which Part only applies to SUD treatment records as defined in the Part) differ from those of HIPAA and create “dual obligations and compliance challenges” for HIPAA covered entities that maintain both protected health information (PHI) and Part 2 records and, therefore, are responsible for both sets of rules, as well as potential informational barriers for treating providers. The proposed changes aim to align the requirements of Part 2 with the HIPAA Privacy Rule to provide greater care coordination so that treatment and recovery supports for SUD are more accessible for patients with SUD challenges.
Key proposed changes align the use and disclosure of Part 2 treatment records with the HIPAA requirements, as follows:
- Disclosure: A single patient consent given once for all future uses and disclosures for treatment, payment, and health care operations (TPO) of Part 2 records. In addition, revised rules regarding the permitted re-disclosure of Part 2 records consistent with the HIPAA Privacy Rule, subject to certain exceptions.
- Patient Rights: New patient rights to obtain an accounting of disclosures and to request restrictions on certain disclosures of Part 2 records, and related updates to the HIPAA Privacy Rule Notice of Privacy Practices requirements concerning patient rights and uses and disclosures of Part 2 records. The changes also provide for expanded prohibitions on the use and disclosure of Part 2 records in certain legal proceedings, as well as establishing a process for patients to make complaints for Part 2 violations.
- Enforcement: New HHS enforcement authority, including the imposition of civil monetary penalties for violations of Part 2.
- Breach Notification: Updated breach notification requirements to HHS and affected patients.
The proposed compliance date is 24 months following publication of the final rule, thereby providing enough lead time for entities to comply. We will continue to monitor changes to Part 2 resulting from any final rule issued by HHS.