Proposed changes to the federal substance use disorder law will increase provider efficiency and alignment with the Health Insurance Portability and Accountability Act (HIPAA). In a move that seeks to decrease administrative burdens on patients and providers while beefing up enforcement capabilities, the Department of Health and Human Services (HHS) issued its long awaited Notice of Proposed Rulemaking (Proposed Rule) for the proposed changes to 42 C.F.R. Part 2 (Part 2), the regulation governing the confidentiality of substance use disorder patient records. The changes have been expected since 2020 when Congress directed HHS to amend Part 2 in the CARES Act. The Proposed Rule’s impact will be a net positive for substance use disorder providers already required to comply with HIPAA. However, cash-pay providers required to comply with Part 2 but not regulated by HIPAA will be required to comply with HIPAA’s Privacy Rule and Breach Notification Rule.
“HHS understands how critical it is for patients to better align the Part 2 rules and program with HIPAA. This proposed rule helps decrease burdens on patients and providers, improves coordination and increases access to care and treatment, while protecting confidentiality of treatment records.” - OCR Director Melanie Fontes Rainer (Nov. 28, 2022)
Here are six key takeaways from the Proposed Rule.
Notably, the proposed rule would modify both Part 2’s Patient Notice requirements and HIPAA’s NPP requirements. Certain covered entities that are not Part 2 programs but receive and maintain Part 2 records (and are thus subject to Part 2 requirements for those records) would need to add a provision to their NPP that references the restrictions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings against the individual. Current NPP requirements would continue to apply, without change, to covered entities that do not maintain or receive Part 2 records.
Public comments on the Proposed Rule are due 60 days after publication of the Proposed Rule in the Federal Register, which is expected on December 2, 2022. Note that the current Part 2 rules remain in effect while HHS undertakes this rulemaking process.
For more information on the Proposed Rule, Part 2, or legal considerations related to telemedicine, telehealth, virtual care, remote patient monitoring, digital health, and other health innovations, contact Foley’s Telemedicine & Digital Health, Cybersecurity & Data Privacy, or Health Care Practice Group.