For years, federal privacy laws relating to substance abuse disorder (SUD) treatment records have differed in significant ways from federal privacy laws relating to other medical records. Changes, however, are afoot. Almost three years ago, the CARES Act directed HHS to better align these federal laws. And last week, HHS published the first set of proposed rulemaking designed to ease compliance challenges inherent in these laws and improve care coordination. This alert addresses a few of the key proposed changes as well as the major issue left unresolved in this round of rulemaking.
Under current federal law, the privacy of SUD treatment records is governed by 42 U.S.C. Section 290dd-2 and C.F.R. Title 42, Part 2 (collectively referred to as Part 2). Part 2 is entirely separate from the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively referred to as HIPAA), which govern all other medical records. Part 2 and HIPAA requirements have long differed in important ways, posing compliance challenges for providers subject to both regulatory schemes, as well as coordination of care challenges relating to patients who receive treatment for SUD disorders.
In recent years, HHS’s efforts to update the Part 2 regulations to better align them with HIPAA were constrained by Part 2’s governing statute, which only Congress has the power to change. Enter the Coronavirus Aid, Relief, and Economic Security (CARES) Act, enacted in March 2020. While better known for providing more than $2 trillion in emergency assistance in response to COVID-19, the CARES Act also amended 42 U.S.C. § 290dd-2, and directed the U.S. Department of Health and Human Services (HHS) to engage in rulemaking, to better align Part 2 and HIPAA. On Dec. 2, 2022, HHS published its long-awaited Notice of Proposed Rulemaking (NPRM) to implement the changes to Part 2 as set forth in the CARES Act.
Although several changes are proposed, two in particular are notable for their potential to broadly impact HIPAA-covered entities and not only Part 2 programs. First, HHS proposes to alter the current provisions governing patient consent for the use and disclosure of Part 2 records for treatment, payment and health care operations (TPO) purposes. While HIPAA generally does not require patient authorization for use or disclosure of information for TPO purposes, Part 2 currently does. This Part 2 requirement can be a barrier to coordination of patient care when it results in treating providers’ lacking access to complete information about their patients—that is, if a SUD patient’s providers do not know the patient is or was in SUD treatment. In line with the CARES Act, the NPRM proposes to relax Part 2’s patient consent requirement by permitting patients to broadly consent to all future uses and disclosures for TPO purposes by describing the recipient of the records as “my treating providers, health plans, third-party payers, and people helping to operate this program.” Covered entities and business associates that receive Part 2 records pursuant to such a written consent would then be permitted to use and redisclose the records in accordance with HIPAA, with the limited exception of redisclosures for certain legal proceedings involving the patient. Although HHS’ proposal would still not fully align Part 2 and HIPAA with respect to uses and disclosures for TPO purposes, this broad consent option is a step in that direction.
Second, HHS proposes to require HIPAA-covered entities that are not Part 2 programs, but receive and maintain Part 2 records, to update their Notices of Privacy Practices to reference the Part 2 protections of those records. Specifically, HHS proposes to require that Notices of Privacy Practices provide notice of the uses and disclosures of the Part 2 records and of the individual’s rights and the covered entity’s legal duties with respect to such records. Notice of Privacy Practices requirements would remain unchanged for HIPAA-covered entities that do not receive or maintain Part 2 records.
Notably, HHS did not propose any regulations on one of the most interesting provisions of the CARES Act—the addition of a new antidiscrimination provision. That provision prohibits discrimination against an individual based on information contained in that person’s Part 2 records in: (A) admission, access to, or treatment for health care; (B) hiring, firing or terms of employment, or receipt of worker’s compensation; (C) the sale, rental, or continued rental of housing; (D) access to federal, state or local courts; or (E) access to or maintenance of social services and benefits provided or funded by federal, state or local governments. The antidiscrimination provision also more generally prohibits recipients of federal funds from discriminating against an individual, based on information contained in that person’s Part 2 records, in affording access to the services provided with such federal funds. The NPRM states only that HHS intends to implement these provisions in later rulemaking, and detailed guidance will likely be needed in order to implement them.
In the meantime, whether and how HHS ultimately chooses to go forward with its proposals in the NPRM will become clear with the later publication of a final rule. Industry stakeholders are encouraged to submit comments on the NPRM by the deadline of Jan. 31, 2023.
