Proposed Rule Seeks to Better Align HIPAA Privacy Rule, 42 CFR Part 2

A proposed federal rule involving the confidentiality of substance use disorder (SUD) patient records under 42 CFR part 2 (“Part 2”) is designed to both better protect patient data and make data sharing for care coordination easier.

The U.S. Health and Human Services Department’s Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA) said the proposed rule increases coordination among providers in treatment for substance use challenges and increases protections for patients concerning records disclosure to avoid discrimination in treatment.

The proposed rule would implement provisions of Section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) that, among other things, require HHS to bring Part 2 into greater alignment with certain aspects of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Breach Notification, and Enforcement Rules.

Part 2 currently imposes different requirements for SUD treatment records protected by Part 2 than the HIPAA Privacy Rule, which HHS said can create barriers to information sharing by patients and among healthcare providers and create dual obligations and compliance challenges for regulated entities. The goal of the new rule is to help safeguard the health and outcomes of individuals with SUD and create greater flexibility for information sharing envisioned by Congress in its passage of Section 3221 of the CARES Act. Proposed changes include:

• Permitted use and disclosure of Part 2 records based on a single patient consent given once for all future uses and disclosures for treatment, payment, and health care operations.
• Permitted redisclosure of Part 2 records in any manner permitted by the HIPAA Privacy Rule, with certain exceptions.
• New patient rights under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule.
• Expanded prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings.
• New HHS enforcement authority, including the imposition of civil money penalties for violations of Part 2.
• Updated breach notification requirements to HHS and affected patients.
• Updated HIPAA Privacy Rule Notice of Privacy Practices requirements to address uses and disclosures of Part 2 records and individual rights with respect to those records.

“HHS understands how critical it is for patients to better align the Part 2 rules and program with HIPPA,” said OCR Director Melanie Fontes Rainer, in a statement. “This proposed rule helps decrease burdens on patients and providers, improves coordination and increases access to care and treatment, while protecting confidentiality of treatment records.”

“One of SAMHSA’s priorities is working to make effective treatments and recovery supports for SUD more accessible to all Americans,” said Miriam E. Delphin-Rittmon, Ph.D., the HHS Assistant Secretary for Mental Health and Substance Use and the leader of SAMHSA, in a statement. “Bringing Part 2 requirements into closer alignment with HIPAA will support more effective coordination for people accessing care. At the same time, the proposed rule mitigates the discrimination and stigma that we know too often people with SUDs experience.” 

HHS said it encourages all stakeholders, including patients and their families, health insurance issuers, health care providers, health care professional associations, consumer advocates, and state and local government entities, to submit comments through regulations.gov.

Public comments on the proposed rule are due 60 days after its publication in the Federal Register.