Section 3221 of the CARES Act, signed into law on March 27, 2020, sets the stage for HHS to make significant changes to 42 C.F.R. Part 2, governing the confidentiality of Substance Use Disorder (“SUD”) records. Under the Act, HHS has 12 months to work with appropriate Federal agencies to make revisions to 42 C.F.R. Part 2 consistent with Section 3221’s mandates.
Updates to the Restrictions on the Use and Disclosure of Records
The primary aim of the Act is to ease restrictions on the use and disclosure of protected SUD information for the purposes of treatment, payment and health care operations to be more consistent with HIPAA. The Act further allows for the re-disclosure of SUD information obtained for the purposes of treatment, payment and health care operations consistent with HIPAA. Since HHS has not yet issued their revisions to 42 C.F.R. Part 2, it remains to be seen how expansive the scope of allowed re-disclosures will be.
It is important to note that the Act does not ease all restrictions on the use and disclosure of SUD information. Specifically, the Act provides for clarifications to 42 C.F.R. Part 2 regarding continued restrictions on the use and disclosure of SUD records in administrative, investigative and legal proceedings.
Another significant change allows patients to give one written consent for all future uses or disclosures of SUD records for the purposes of treatment, payment and health care operations which will remain valid until revoked by the patient. Again, until HHS issues its revisions, it remains unclear whether this written consent will be specific to 42 C.F.R. Part 2 records or will track the language of standard HIPAA authorizations.
Other Highlights
In addition to easing certain restrictions on the use and disclosure of SUD records, the Act instructs HHS to make further revisions to 42 C.F.R Part 2 which:
- Require Part 2 Programs to comply with HITECH breach notification requirements;
- Track disclosures of SUD information consistent with accounting of disclosure requirements under the HITECH Act;
- Require revisions to Notice of Privacy Practices to incorporate requirements under 42 C.F.R. Part 2;
- Protect SUD patients from discrimination based on the inadvertent or intentional disclosure of SUD records; and
- Amend the penalties for violations of the Act to make them a federal crime enforceable by the United States Department of Justice.
Until HHS issues their revisions, entities responsible for SUD information should continue to follow the current regulations found in 42 C.F.R. Part 2, including the restrictions on the use and disclosure of information.
This blog post was authored by Spencer Fane LLP attorneys Kristen Petry, Stacy Harper, and Lauren Nelson. For more information, visit spencerfane.com.
