The U.S. Department of Health and Human Services (HHS) originally implemented 42 CFR Part 2 regulations in 1975 to ensure confidentiality of substance use disorder (SUD) records at a time when there were no broader healthcare privacy security standards. Since that time, 42 CFR Part 2 regulations, or more commonly referred to as simply Part 2, have frustrated non-Part 2 healthcare providers seeking access to SUD records of their patients for continuity of care purposes.
In response to the opioid epidemic, HHS has recognized the need to remove many of the burdensome requirements of the Part 2 regulations that impede patient safety and care coordination among those providers involved in the treatment of SUD patients. Pursuant to a final rule published June 15, 2020, HHS has taken its first steps toward modernizing Part 2 and removing those barriers.
The modified sections of the Part 2 regulations will have positive impacts on care collaboration, resolve ambiguities, and remove burdensome elements on patient consents. The following is a summary of the most significant changes, which go into effect August 14, 2020:
-
Consent requirements. Previously, a consent to disclose SUD records executed by a patient was required to list not only the entity to which records would be released, but also the specific name of the individual who would receive the information. Now, patients can consent to disclosure of their records to an entity without having to name a specific individual to receive the information on behalf of the entity.
-
SUD records obtained by non-Part 2 providers. The new rule clarifies through a revision to the definition of “records” that information received orally by a non-Part 2 provider from a Part 2 provider does not render the information protected by Part 2 merely because the non-Part 2 provider reduces the information to writing and includes that writing in the patient’s medical record. Written records received by non-Part 2 providers from Part 2 providers can continue to be segregated by the non-Part 2 provider to prevent applicability of Part 2 to the entirety of the patient’s records.
-
Disclosure for payment or healthcare operations activities. The new rule clarifies what is included as a payment or healthcare operations activity by expressly listing 18 activities that fall within this category. These named activities align with similar provisions in HIPAA and now expressly include care coordination and case management activities. Additionally, the regulations have been updated to expressly allow for redisclosure of SUD records by contractors of Part 2 providers. Disclosures for payment and healthcare operations activities still require patient consent.
-
Disclosures to prescription drug monitoring programs. Part 2 programs can now disclose SUD medications prescribed or dispensed to state prescription drug-monitoring programs if required by applicable state law. The SUD patient’s consent is required prior to reporting.
-
Medical emergencies. Previously, the rule allowed for disclosures without a patient’s consent during a bona fide medical emergency where the patient’s consent could not be obtained in advance. The expanded rule now also allows for disclosure without consent to the extent necessary to meet a “bona fide medical emergency in which a part 2 program is closed and unable to provide services or obtain the prior written consent of the patient, during a temporary state of emergency declared by a state or federal authority as the result of a natural or major disaster, until such time that the part 2 program resumes operations.”
Even with the above changes, the Part 2 regulations continue to afford SUD patients and their records many of the same fundamental protections as before such as prohibiting law enforcement’s use of SUD records in criminal prosecutions against patients without a court order, or prohibitions against disclosure without patient consent unless a statutory exception applies (e.g., court order, scientific research).
Significantly, the current revisions to the Part 2 regulations do not incorporate recent amendments made to the underlying statute, 42 USC § 290dd-2, by enactment of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). In Section 3221 of the CARES Act, Congress requires revision of the Part 2 regulations to more closely align Part 2 with HIPAA, require breach reporting, limit the use of SUD records in certain proceedings, and prohibit discrimination related to SUD treatment. HHS intends to again revise the Part 2 regulations to comply with the requirements of the CARES Act, but such changes will not take effect until at least March 2021.
For more information on the current revisions, see the following:
