The U.S. Department of Health and Human Services (“HHS”) has announced proposed changes (the “Proposed Rule”) to 42 C.F.R. Part 2 (“Part 2”). While the Health Insurance Portability and Accountability Act (“HIPAA”) governs the privacy and security of protected health information generally, Part 2 specifically governs the medical records of federally assisted substance use treatment programs (“SUD Records”).
Part 2 was implemented to encourage patients to seek substance abuse treatment without fear of prosecution by limiting a treatment program’s ability to use or disclose SUD Records. Over the years, and as exacerbated by the COVID-19 pandemic, the need for streamlined coordination of care often conflicted with Part 2’s restrictions. In addition, providers subject to HIPAA were also required to comply with Part 2 for SUD Records, which forced those providers to comply with often inconsistent standards for different types of health information. Naturally, the presence of two competing standards caused confusion, increased administrative burdens, and often obstructed provider access to patient information.
At its core, the Proposed Rule seeks to create greater flexibility for patients and providers aligning Part 2 more closely with HIPAA. The Proposed Rule identifies a number of meaningful revisions, including by way of example:
- Aligning the content requirements of a Part 2 consent with HIPAA’s authorization requirements and allowing disclosure to categories of designated recipients.
- Allowing use of a single patient consent for future uses and disclosures of SUD Records and expanding redisclosure options.
- Making HIPAA’s civil and criminal penalties available for Part 2 violations.
- Empowering patients to request certain restrictions on disclosures of their SUD Records as well as to request an accounting of disclosures.
- Applying HIPAA’s breach notification obligations to Part 2 programs and requiring notice to patients where their records are compromised.
- Updating Part 2’s confidentiality notice requirements to more closely align with HIPAA’s standard for Notice of Privacy Practices.
Public comments regarding the Proposed Rule can be submitted up to January 31, 2023. Thereafter, we anticipate that HHS will issue a Final Rule in 2023. As the Proposed Rule is not final, we will continue to monitor and provide updates to keep you informed about new developments. If you have any questions about these laws or their impact on you or your business, please contact a member of the Sheppard Mullin Healthcare Team.