On December 2, 2022, the Office for Civil Rights (“OCR”) and the Substance Abuse and Mental Health Services Administration (“SAMHSA”) within the U.S. Department of Health and Human Services (“HHS”) issued a Notice of Proposed Rulemaking (“NPRM”) to revise the Confidentiality of Substance Use Disorder (“SUD”) Patient Records regulations under 41 CFR part 2 (“Part 2”). See 87 FR 74216 here. A fact sheet for the Notice of Proposed Rulemaking was also posted here. 

What You Need to Know:

• Use and disclosure of Part 2 Records will be permitted based on a single, prior consent signed by the patient for all future uses and disclosures for treatment, payment, and health care operations.
• Redisclosure of Part 2 Records will be as permitted by the HIPAA Privacy Rule, by recipients that are Part 2 programs, HIPAA-covered entities, and business associates, with certain exceptions.
• New patient rights are being added under Part 2, as currently provided through the HIPAA Privacy Rule, to allow patients to obtain an accounting of disclosures and to request restrictions on disclosures related to treatment, payment, and health care operations.
• Standards in the HITECH Act and the HIPAA Breach Notification Rule will be applied to breaches of Part 2 Records by Part 2 programs.
• The Part 2 confidentiality notice requirements (“Patient Notice”) will be modified to align with the HIPAA Notice of Privacy Practices.
• The HIPAA Notice of Privacy Practices requirements for covered entities who receive or maintain Part 2 Records will be modified to include a provision limiting redisclosure of Part 2 Records for legal proceedings according to the Part 2 standards.
• Investigative agencies will be permitted to apply for a court order to use or disclose Part 2 Records if they unknowingly receive Part 2 Records in the course of investigating or prosecuting a Part 2 program, when certain preconditions are met.

The NPRM would implement provisions of Section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) and require HHS to bring Part 2 into greater alignment with certain aspects of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy, Breach Notification, and Enforcement Rules.

Part 2 protects patient privacy for SUD patient records (“Part 2 Records”) from unauthorized disclosures by imposing requirements that are different from the privacy requirements pursuant to the HIPAA Privacy Rule. Because these different requirements can create barriers to information sharing among health care providers, as well as dual obligations and compliance challenges for regulated entities, the NPRM is an attempt to bridge those differences consistent with the Cares Act requirements.

While HHS is undertaking the rulemaking, the current Part 2 regulations remain in effect. HHS is encouraging all stakeholders, including patients and their families, health care providers, health insurers, health care professional associations, consumer advocates, and state and local government entities, to submit comments through regulations.gov.

Any party who wishes to provide comments to the NPRM are required to do so on or before January 31, 2023.