By: Stephanie R. Weber, Neil C. Brown, and Alaina N. Crislip
The U.S. Department of Health and Human Services (“HHS”) Office for Civil Rights, in coordination with the Substance Abuse and Mental Health Services Administration, recently released a Final Rule which modifies the Confidentiality of Substance Use Disorder (“SUD”) Patient Records regulations located at 42 C.F.R. Part 2 (commonly known as “Part 2”)[1]. The statute upon which Part 2 relies, 42 U.S.C. § 290dd-2, was previously amended, thus prompting the issuance of this Final Rule. The Part 2 statute was amended by the Coronavirus Aid, Relief, and Economic Security (“CARES”) Act of 2020[2], directing HHS to more closely align Part 2 with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).
Background on Part 2
Part 2 is a federal privacy law that protects patient records against unauthorized disclosure of substance use disorder treatment information. It is distinct from, and generally more stringent than, HIPAA. Part 2 provides protections against the disclosure of records containing SUD data. Part 2 privacy protections extend to SUD data created, received, or acquired by federally-assisted entities that meet certain criteria, including those holding themselves out as providing SUD treatment.
Patient Consent for Disclosures for Treatment, Payment, and Health Care Operations
Perhaps the most significant change created by the Final Rule is the adoption of a consent process whereby a Part 2 program may obtain a single consent from an individual for future uses and disclosures of Part 2 records for treatment, payment, and health care operations. To this end, the Final Rule adopts the familiar definitions of “treatment,” “payment,” and “health care operations” from the HIPAA rules.
Redisclosures
The Final Rule generally allows covered entities and business associates that receive SUD records pursuant to a consent to redisclose the records in accordance with the HIPAA rules.[3] Each time SUD records are disclosed with patient consent, a copy of the patient consent form or a clear explanation as to the scope of the patient consent for use and disclosure must be included.[4]
SUD Counseling Notes
The Final Rule also creates a new definition of “SUD counseling notes,” which is equivalent to the definition of “psychotherapy notes” under the HIPAA rules. SUD counseling notes generally cannot be used or disclosed based on a broad consent for disclosure for treatment, payment, and/or health care operations.
What Comes Next?
While the Final Rule seeks to create additional parity between HIPAA and Part 2, certain significant differences still remain. The issuance of the Final Rule presents an opportune time for entities to evaluate their Part 2 compliance programs. Jackson Kelly attorneys are ready to serve as trusted advisors to help you comply with the Final Rule, and to help you meet all your health care compliance goals.
[1] See generally 42 C.F.R. Part 2.
[2] Coronavirus Aid, Relief, and Economic Security Act, Pub. L. No 116-136, 134 Stat 281 (27 March 2020) (CARES Act).
[3] Except for use in legal proceedings against the individual without specific consent or a valid court order.
[4] This is in addition to the redisclosure notice that must accompany each disclosure made with the patient’s written consent (“42 C.F.R. Part 2 prohibits unauthorized use or disclosure of these records”). 89 FR 12472.