In a Notice of Proposed Rulemaking filed on November 28, 2022, the Substance Abuse and Mental Health Services Administration (SAMHSA), announced proposed updates to federal regulations located at 42 CFR Part 2 (Part 2) governing the confidentiality of substance use disorder (SUD) treatment records maintained by certain SUD programs.
The proposed updates are intended to more closely align the Part 2 regulations with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), thus implementing requirements of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). The updates are also meant to strengthen care coordination and enhance enforcement mechanisms. The Notice was published on December 2, 2022, and public comments will remain open until January 31, 2023.
Proposed Updates
The updates proposed in the Notice include the following:
- A single prior patient consent for all future uses and disclosures of Part 2 records of the patient by Part 2 programs for treatment, payment, and health care operations, which remains in effect until revoked in writing.
- Permitting a Part 2 program, covered entity, or business associate that receives Part 2 records pursuant to a written consent to redisclose the records in any manner permitted by the HIPAA Privacy Rule, except for certain proceedings against the patient.
- Permitting a lawful holder of patient information that is not a covered entity, business associate, or Part 2 program to redisclose Part 2 records for payment and health care operations to its contractors, subcontractors, or legal representatives as needed to carry out the activities in the consent.
- Expanded prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings against patients.
- New patient rights that align with individual rights under the HIPAA Privacy Rule.
- A right to obtain an accounting of disclosures made with consent.
- A right to request restrictions on disclosures.
- A disclosure requirement related to enforcement by the Secretary of Health and Human Services.
- The application of HIPAA and HITECH Act civil and criminal penalties to Part 2 violations.
- A requirement for Part 2 programs to create a process for receiving complaints.
- Protections from adverse actions for patients who file complaints.
- A prohibition against requiring individuals to waive the right to file a complaint as a condition of providing treatment, enrollment, payment, or eligibility for services.
- Applying the breach standards of the HITECH Act and the HIPAA Breach Notification Rule to breaches of Part 2 records by Part 2 programs.
- Modifying the Part 2 confidentiality notice requirements to align with the HIPAA Notice of Privacy Practices.
Takeaways
Part 2 programs, covered entities, business associates, and lawful holders of Part 2 records should consider how the proposed changes will impact their internal policies and processes if they are implemented in the final rule. For example, Part 2 programs will no longer need to obtain consent to every use and disclosure where such consent was previously required, so long as they have obtained consent from the patient and consent has not been revoked. Likewise, Part 2 programs will need to ensure they are able to establish a process for receiving complaints.
The public is welcome to submit comments on the Notice until January 31, 2023.
This update is a summary of a complex topic that is subject to change at any time and should not be relied upon in lieu of legal advice. If you have any questions or require guidance, please contact Casey Moriarty, Mallory Barnes-Ohlson or Adriana Lein.
