The Coronavirus Aid, Relief, and Economic Security Act (CARES Act) enacted into law on March 27, 2020 makes fundamental changes to the federal law, 42 U.S.C. § 290dd-2, implemented at 42 C.F.R. Part 2 that governs the confidentiality of substance-use disorder records (Part 2). Most critically, the CARES Act dramatically eases the ability of health care providers to share protected substance-use disorder information with patient consent, going far beyond both the finalized 2017 revisions to the Part 2 rules and the proposed 2019 changes. It also makes several important changes to align certain Part 2 requirements with the Health Insurance Portability and Accountability Act and its implementing regulations (HIPAA).
The federal substance-use disorder privacy law has typically been associated more closely with its implementing regulations than the underlying statute because of how much critical detail was left to the discretion of the Substance Abuse and Mental Health Services Administration (SAMHSA). While the changes in the CARES Act override some of the regulatory decisions SAMHSA has made in the past, the law also directs the Secretary of the Department of Health and Human Services to implement its provisions in regulations that would be effective 12 months after the date the CARES Act is enacted. Given that Congress still envisions a significant role for SAMHSA, it remains to be seen how the changes will ultimately be implemented through agency-drafted regulation.
The most significant changes are summarized in more detail below:
The CARES Act amends the statutory authority for disclosures with patient consent to provide that once a patient gives prior written consent, the contents of a record “may be used or disclosed by a covered entity, business associate, or a [Part 2 program] for purposes of treatment, payment, and health care operations as permitted by the HIPAA regulations.” It makes explicit that redisclosures may then be made in accordance with HIPAA, until the patient revokes the consent. That is, unlike HIPAA, patients have the right under Part 2 to prohibit or cut off disclosures for treatment, payment, and health care operations by withholding or revoking their written consent.
This represents the single most far-reaching change in the law. Part 2 has long been considered a barrier to information sharing because of the regulatory requirement that a patient’s consent must identify who can receive the information by name (as opposed to a general category or description of the recipient as is permitted under HIPAA). Even though this requirement was relaxed to some extent in 2017 for disclosures to treating providers, it remains a significant obstacle to information sharing. Congress has ensured through these changes that there will no longer be a requirement to identify by name the individual or entity who may receive information pursuant to a written consent.
The CARES Act aligns Part 2 more closely with HIPAA in several ways:
The CARES Act also adds a new provision that prohibits discriminating against an individual for the following purposes on the basis of information received—whether intentionally or inadvertently—from Part 2 records:
Foley has created a multi-disciplinary and multi-jurisdictional team, which has prepared a wealth of topical client resources and is prepared to help our clients meet the legal and business challenges that the coronavirus outbreak is creating for stakeholders across a range of industries. Click here for Foley’s Coronavirus Resource Center to stay apprised of relevant developments, insights and resources to support your business during this challenging time. To receive this content directly in your inbox, click here and submit the form.