In an effort to enhance care coordination for patients with substance use disorder (SUD), HHS, acting through its Office for Civil Rights and in collaboration with the Substance Abuse and Mental Health Services Administration, proposed changes to “Part 2” rules to better align privacy measures with those of HIPAA on Monday.
If implemented, the proposed rule would allow Part 2 programs to use and share patients’ records following a single signed consent by the patient “for all future uses and disclosures for treatment, payment, and healthcare operations.”
The proposal also aims to strengthen protections around disclosure of SUD treatment records to guard against discrimination and stigma.
The changes were initially called for in the CARES Act of 2020, provisions of which required the HHS secretary to better align the 42 CFR part 2 rule, better known as “Part 2,” with HIPAA’s Privacy, Security, Breach Notification, and Enforcement Rules.
“This proposed rule would improve coordination of care for patients receiving treatment while strengthening critical privacy protections to help ensure individuals do not forego life-saving care due to concerns about records disclosure,” said HHS Secretary Xavier Becerra in a press release.
Becerra also noted that differences in privacy laws can lead to delays in treatment and “negative stereotypes” about people with substance use problems.
Part 2 confidentiality protections are meant to allay patients’ fears of discrimination or prosecution, which might prevent some from seeking help for an SUD, according to an HHS fact sheet.
Specifically, Part 2 is intended to protect records that relate to “the identity, diagnosis, prognosis, or treatment of any patient” regarding programs that involve SUD education, prevention, training, treatment, rehabilitation, or research that are run or overseen directly or indirectly by any U.S. government department or agency, the fact sheet explained.
However, such protections can have unintended consequences.
At a 2018 House hearing, Dustin McKee, director of policy for the National Alliance on Mental Illness of Ohio, said that because of certain provisions of the Part 2 rule, the doctors who prescribed opioids to his brother, Brandon Johnathan McKee, weren’t aware that he struggled with substance abuse.
“They gave a loaded gun to a person who’s suicidal,” McKee said.
The proposed rule would update Part 2 confidentiality notice requirements, or the “Patient Notice,” to align with the HIPAA Notice of Privacy Practices and would allow “redisclosure” of Part 2 records in keeping with the HIPAA Privacy Rule by recipients of Part 2 programs, HIPAA-covered entities, and business associates, except under certain circumstances.
The rule would also make it harder to “use or disclose” Part 2 records in “civil, criminal, administrative, or legislative proceedings conducted by a federal, state, or local authority against a patient,” unless such authorities have a court order or a patient’s consent.
Other measures in the proposed rule include:
- Establishing patients’ rights under Part 2 that mirror the HIPAA Privacy Rule, including the “right to an accounting of disclosures” and the “right to request restrictions on disclosures for treatment, payment, and healthcare operations”
- Requiring Part 2 programs to develop a complaints process for rule violations
- Prohibiting Part 2 programs from taking “adverse action” against patients who file complaints
- Extending HIPAA and HITECH Act civil and criminal penalties to those who violate Part 2
- Banning Part 2 programs from issuing waivers to prevent patients from filing complaints as a condition of receiving treatment
- Applying the standards in the HITECH Act and the HIPAA Breach Notification Rule to breaches of records by Part 2 programs
The proposed rule would also amend HIPAA Notice of Privacy Practices requirements for the “covered entities” receiving or maintaining Part 2 records to establish a provision that would limit redisclosure of records, in keeping with Part 2 requirements. For clarity, the rule would allow investigative agencies to “use or disclose” Part 2 records, if such agencies requested a court order after having “unknowingly receive[d] Part 2 records in the course of investigating or prosecuting a Part 2 program, when certain preconditions are met.”
Public comments on the proposed rule are due by Jan. 30, 2023.
Please enable JavaScript to view the