HHS Proposes New Protections for Substance Use Disorder Records
On Nov. 28, 2022, the Department of Health and Human Services (HHS) released proposed changes to its rules regarding the confidentiality of substance use disorder (SUD) treatment records. These confidentiality rules are contained in 42 CFR Part 2 and are commonly referred to as “Part 2.” Part 2 protects the confidentiality of patient records from certain types of federally assisted SUD treatment programs (Part 2 programs).
Proposed Changes
HHS states that the proposed changes would decrease administrative burdens; improve care coordination; and implement a provision of the Coronavirus Aid, Relief and Economic Security Act (CARES Act) that requires aligning certain aspects of Part 2 with the HIPAA Privacy, Breach Notification and Enforcement Rules. Key proposed changes include:
- Permitting the use and disclosure of Part 2 records based on single patient consent given once for all future uses and disclosures for treatment, payment and health care operations;
- Creating new patient rights under Part 2 to obtain an accounting of disclosures and request restrictions on certain disclosures;
- Applying HIPAA’s civil and criminal penalties to Part 2 violations;
- Requiring breach notification for improper disclosures of Part 2 records by Part 2 programs; and
- Modifying the HIPAA Notice of Privacy Practices to address uses and disclosures of Part 2 records and individual rights with respect to those records.
Impact on Health Plans
These changes are only in the proposed form at this time. If they are finalized, employers with self-insured health plans should review their privacy policies and Notice of Privacy Practices and make any necessary updates.
The proposed changes would align the confidentiality requirements for Part 2 records more closely with the HIPAA Rules.
Proposed Changes
The proposed changes would make the confidentiality protections for SUD treatment records more similar to the HIPAA Rules by:
- Allowing individuals to request restrictions on certain disclosures of their treatment records;
- Applying HIPAA’s penalties to violations of Part 2; and
- Applying HIPAA’s breach notification standards to breaches of Part 2 records by Part 2 programs.
Prev
