HHS Proposes Rule on Confidentiality of Substance Use Disorder Patient Records

On November 28, 2022, the Department of Health and Human Services (HHS) released a Notice of Proposed Rulemaking for changes to the Confidentiality of Substance Use Disorder (SUD) Patient Records under 42 CFR Part 2 (referred to as “Part 2”). The proposed rules are intended to increase coordination among providers in treatment for substance use challenges and increase patient protections from unauthorized record disclosures. Note that Part 2 only applies to SUD treatment records from certain types of federally assisted programs, known as “Part 2 programs.”

Part 2 currently imposes different requirements for protected SUD treatment records than under the HIPAA Privacy Rule. This discrepancy can create barriers to information sharing among healthcare providers and compliance challenges for regulated entities. The CARES Act addressed this by bringing Part 2 protections into greater alignment with the HIPAA Privacy Rule on uses and disclosures for treatment, payment and healthcare operations. Secretary Xavier Becerra described the importance of the changes, noting “[t]his proposed rule would improve coordination of care for patients receiving treatment while strengthening critical privacy protections to help ensure individuals do not forego life-saving care due to concerns about records disclosure.”

With some exceptions, Part 2 currently requires SUD treatment providers to obtain written consent for use or disclosure of patient-identifying information and give notice of Part 2 protections (including requiring consent to redisclose) to recipients of Part 2 records. Notably, in the proposed rules under the CARES Act, once prior written consent has been obtained, the records described in the consent may be used or disclosed by a covered entity or business associate for treatment, payment and healthcare operations as permitted under HIPAA regulations, including redisclosure as permitted by HIPAA.

The Proposed Rulemaking changes also include:

  • New patient rights under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule. This includes self-pay patients’ right to restrict disclosures to health plans.
  • Expanded prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative and legislative proceedings.
  • New HHS enforcement authority, including the imposition of civil monetary penalties for violations of Part 2.
  • Updated breach notification requirements to HHS and affected patients that follow the HIPAA Breach Notification Rule.
  • Updated HIPAA Privacy Rule Notice of Privacy Practices requirements to address uses and disclosures of Part 2 records and individual rights with respect to those records.

The current Part 2 rules remain in effect while HHS completes the rulemaking process. Group health plan sponsors should be aware of the proposed rules and consult with their insurers or service providers regarding implementation of anticipated changes to Part 2 record protections. Public comments on the proposed rules can be submitted through January 31, 2023. We will continue to report on further major developments in Compliance Corner.

Notice of Proposed Rulemaking on Confidentiality of Substance Use Disorder Patient Records »