In late November, HHS proposed long-awaited changes to regulations at 42 C.F.R. Part 2 (“Part 2”) governing the confidentiality of substance use disorder (“SUD”) records as required under the Coronavirus Aid, Relief, and Economic Security (“CARES”) Act. Generally, HHS is attempting to align Part 2 requirements with the HIPAA (“Health Insurance Portability and Accountability Act”) Privacy Rule. The most significant changes are those to the rules governing consent for entities subject to Part 2’s restrictions to use, disclose, and redisclose Part 2 records with respect to treatment, payment, and health care operations (“TPO”) activities.
The Notice of Proposed Rulemaking (“NPRM”) contains several significant changes to the current Part 2 rules, with the most impactful proposed changes being those implementing the CARES Act’s amendments regarding consent for the use, disclosure, and redisclosure of Part 2 records. By implementing these amendments, the NPRM proposes that if a patient provides valid consent to a use or disclosure of their records, the recipient may further use or disclose such records in accordance with the following rules:
1. When disclosed for TPO activities to a Part 2 program, covered entity, or business associate, the recipient may further use or disclose those records as permitted by HIPAA, except for uses and disclosures for civil, criminal, administrative, and legislative proceedings against the patient.
2. When disclosed with consent given once for all future TPO activities to a Part 2 program that is not a covered entity or business associate, the recipient may further use or disclose those records consistent with the consent.
3. When disclosed for payment or health care operations activities to a lawful holder that is not a covered entity, business associate, or Part 2 program, the recipient may further use or disclose those records as may be necessary for its contractors, subcontractors, or legal representatives to carry out the payment or health care operations specified in the consent.
Most notably, these changes would enable more flexibility in the use, disclosure, and redisclosure of Part 2 records for TPO purposes, and establish the ability to receive written consent from a patient once for all future TPO uses and disclosures. In addition, the NPRM proposes numerous changes to the requirements for a valid Part 2 written consent to better align with those for a valid HIPAA authorization, including a statement of the right to revoke consent.
The NPRM proposes several other changes to the Part 2 rules to enable better alignment with the HIPAA rules. There are proposed changes to Part 2 rules in the following subjects: enforcement and penalties, definitions, uses and disclosures, complaints, breaches, requirements for intermediaries, security, notices of privacy practices, individual rights, de-identification, and required disclosures to the Secretary. For an extensive breakdown of some of the most potentially impactful proposals, see our Client Alert on the NPRM for Part 2.
The proposed rule would help improve care coordination, particularly in the wake of the opioid crisis. As HHS has promoted greater interoperability and information sharing for treatment and care coordination, health care providers, health plans and health information exchange organizations have struggled to support the sharing of Part 2 records given stringent privacy protections. This proposed rule would enable easier sharing of Part 2 records so that this information could inform treatment. However, there will be some concerns raised about privacy protections for individuals who have or have had substance use disorder treatment in the past as the more stringent Part 2 rules were intended to protect some of the most sensitive health care data. As much, these proposed changes may impact decisions by some individuals to seek needed treatment and may be of particularly concern for pregnant women post-Dobbs.
The NPRM has extensive implications for a myriad of stakeholders in the health care industry as it aims to enhance flexibility in using and sharing Part 2 records. If finalized, HHS would require compliance 24 months after publication of the final rules, so there is still some time until these provisions would be implemented. Stakeholders should analyze the potential impact of the NPRM on their operations and submit comments to HHS, before or on January 31, 2023 in the Federal Register. Crowell & Moring has extensive experience advising on Part 2 requirements and can counsel you on the implications of these proposed changes on your business and any comments to the proposed rule.