On Nov. 28, the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA) announced a notice of proposed rulemaking revising Title 42, Part 2, of the Code of Federal Regulations pertaining to the confidentiality of substance use disorder patient records. The rule is intended to better align Part 2 rules with the privacy standards under the Health Insurance Portability and Accountability Act of 1996 (HIPAA, P.L. 104-191), as required under Section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act (P.L. 116-136).
“Varying requirements of privacy laws can slow treatment, inhibit care, and perpetuate negative stereotypes about people facing substance use challenges,” said HHS Secretary Xavier Becerra. “This proposed rule would improve coordination of care for patients receiving treatment while strengthening critical privacy protections to help ensure individuals do not forego life-saving care due to concerns about records disclosure.”
Proposals include permitting Part 2 programs to use a single prior consent from the patient to use and disclose Part 2 records for treatment, payment, and health care operations and permit redisclosure as allowed by the HIPAA Privacy Rule, with certain exceptions. The proposed rule also would apply HIPAA civil and criminal penalties to Part 2 violations and apply the HIPAA Breach Notification Rule to breaches of Part 2 records by Part 2 programs. Additionally, the proposed rule would modify the Notice of Privacy Practices requirements under HIPAA for covered entities who receive or maintain Part 2 records.
Regarding patient rights, the HHS proposed creating two of the same individual rights for patients under Part 2 as under the HIPAA Privacy Rule: the right to an accounting of disclosures and the right to request restrictions on disclosures for treatment, payment, and health care operations. Additionally, if finalized, the revised rule would expand prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, or legislative proceedings against a patient, absent a court order or patient consent.
The agency also released a fact sheet. Comments are due Jan. 31, 2023.