Although federal and state protections with respect to sensitive personal information remain largely unchanged during the COVID-19 crisis, there have been efforts to relax or amend specific rules to allow for urgent and appropriate responses to the pandemic. This now applies to federal law governing the confidentiality of substance abuse disorder records. Provisions of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), which became law on March 27, 2020, amended the law to, in part, expand the ability of providers to share these records, while simultaneously tightening the requirements in the event confidentiality is breached and adding other protections for patients. Overall, these changes bring this law more in line with broader federal healthcare privacy laws.

Federal Protection of Substance Abuse Disorder Information

Similar to the protection of certain patient information under the Health Information Portability and Accountability Act of 1996 and its implementing regulations, the confidentiality of alcohol and drug abuse patient records is protected by federal law under 42 U.S.C. § 290dd-2 and its implementing regulations under 42 C.F.R. Part 2. Specifically, Part 2 protects the confidentiality of patient records maintained in connection with the provision of substance abuse education, prevention, rehabilitation, treatment, training, or research by, or as part of, a federally assisted program (a Part 2 Program). Part 2 is enforced by the federal Substance Abuse and Mental Health Services Administration (SAMHSA).

While Part 2 is functionally similar to HIPAA, its scope is more limited. HIPAA applies to “protected health information,” or PHI, which broadly includes individually identifiable health information concerning an individual’s mental or physical health, treatment, or payment for healthcare services. Part 2 narrowly applies to information directly or indirectly identifying a patient as having, being diagnosed with, or being referred for the treatment of a substance use disorder. In addition, there are fewer circumstances under which a Part 2 Program can disclose patient information under Part 2. These circumstances include:

• a bona fide medical emergency in which a patient is unable to consent;
• for research purposes under limited circumstances;
• for purposes of program audit or evaluation by a government entity, payer, or other lawful holders of information protected under Part 2;
• in compliance with a court order authorizing disclosure under limited circumstances; and
• for purposes of communications with a qualified service organization, the Part 2 equivalent of a HIPAA business associate.

SAMHSA has issued guidance specifically reminding Part 2 Programs of the right to disclose substance use disorder records in a medical emergency during the COVID-19 pandemic. SAMHSA recognized that the need to rely heavily on telehealth services means providers may not be able to obtain written patient consent for disclosure, and emphasized the providers’ discretion to determine when a medical emergency necessitates disclosure. The guidance indicates that SAMHSA may intend to relax enforcement in favor of provider discretion during the current crisis.

Amendments Under the CARES Act

The U.S. government has taken formal measures to loosen Part 2 restrictions in response to the COVID-19 outbreak. The CARES Act amended 42 U.S.C. § 290dd-2 to more closely align the law with HIPAA. These amendments include:

1. Breach Notification. The CARES Act carries over the requirements of the Breach Notification Rule under HIPAA, 45 C.F.R. §§ 164.400-414, to subject breaches of confidential substance use disorder records by Part 2 Programs to the same breach notification requirements that govern breaches of PHI under HIPAA.
2. Patient Consent to Disclosures. The most significant change to 42 U.S.C. § 290dd-2 is to a patient’s ability to restrict the sharing of information among providers and third parties. Part 2 requires that a patient’s consent to disclose identifiable information explicitly name each party to whom disclosure can be made, with an exception for disclosures to providers involved in a patient’s treatment. Under the changes made by the CARES Act, once a patient broadly consents to disclosure, the patient record’s contents may be “used or disclosed by a covered entity, business associate, or a [Part 2] program … for purposes of treatment, payment, and health care operations as permitted by [HIPAA].” Like HIPAA, a patient may revoke the consent to disclosures in writing at any time, but the CARES Act has substantially facilitated information sharing regarding substance use disorder patients.
3. Prohibition Against Discrimination. The CARES Act added a provision to 42 U.S.C. § 290dd-2 prohibiting discrimination against an individual on the basis of information contained in a patient’s substance abuse treatment records, regardless of whether that information was intentionally or inadvertently disclosed. Specifically, this provision prohibits discrimination in: access to or treatment for health care; hiring, firing, terms of employment, or the receipt of workers’ compensation; the sale or rental of housing; access to federal, state, or local courts; or access to, approval for, or maintenance of federal, state, or local social services and benefits.

Congress has instructed the secretary of the Department of Health and Human Services, coordinating with appropriate federal agencies, to promulgate new Part 2 regulations implementing the changes made by the CARES Act.