On February 16, 2024, the Substance Abuse and Mental Health Services Administration (“SAMHSA”) and the Office for Civil Rights (“OCR”) of the U.S. Department of Health and Human Services (“HHS”) published a Final Rule making major changes to the Confidentiality of Substance Use Disorder Patient Records rules at 42 C.F.R. Part 2 (“Part 2”).[1] These changes, required by the Coronavirus Aid, Relief, and Economic Security (“CARES”) Act, aim to more closely align Part 2 with the privacy, security, and breach notification rules under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The Final Rule becomes effective on April 16, 2024. Providers subject to Part 2 will have two years to comply with the Final Rule: the deadline for compliance is February 16, 2026. However, the changes to Part 2 are significant and will likely require substantial revisions to policies, procedures, and practices by these providers. Therefore, affected providers should now begin to determine what changes are needed and take steps ensure compliance by the deadline.
Background
When Part 2 was enacted, it was intended to protect individuals receiving substance use disorder (“SUD”) treatment from discrimination and restrict the use of SUD treatment records by the government to prosecute these patients. Part 2 – with its highly restrictive rules on disclosures – was meant to eliminate these deterrents to SUD treatment. Part 2 was originally enacted during a time when SUDs were treated in stand-alone facilities and practices. Generally, Part 2’s restrictions on the uses and disclosures of SUD information were stricter than those imposed by HIPAA. Thus, while HIPAA permitted providers to disclose patient information for treatment, payment, and health care operations purposes without needing patient authorization, Part 2 often required patient consents for discrete disclosures for these purposes.
The differences in how SUD information and all other information were regulated eventually became inconsistent with current practice in how SUDs are treated and managed. Instead of treating behavioral health disorders as problems separate from physical disorders, the trend is to increase coordination and integration of the treatment of behavioral and physical health problems. Moreover, complying with both HIPAA and Part 2 can require complex policies and substantial compliance resources. Accordingly, the purposes of these changes to Part 2 are to: (i) more closely align Part 2 with the HIPAA privacy and breach notification rules to simplify compliance with both laws while maintaining certain heightened protections for SUD information, and (ii) make it easier for providers to coordinate and manage treatment for individuals with a SUD.
Brief Summary of Changes
The Final Rule attempts to align Part 2 with HIPAA in several ways, including:
· Adopting many standard HIPAA terms and definitions;
· Imposing a separate obligation on Part 2 programs to honor certain patient rights
under HIPAA, such as providing a Notice of Privacy Practices and providing an
accounting of disclosures;
· Applying the requirements of the HIPAA breach notification rule to breaches of
Part 2 information;
· Replacing the criminal penalties under Part 2 with the civil and criminal penalties
under HIPAA;
· Creating a category of information similar to psychotherapy notes under HIPAA,
called “SUD counseling notes”, that are subject to additional protections;
· Allowing disclosures for public health purposes similar to HIPAA if the information
is de-identified pursuant to HIPAA’s standards; and
· Conforming the Part 2 qualified service organization (“QSO”) provisions with the
HIPAA Business Associate provisions, making it clear that a QSO can use and
disclose information to carry out treatment, payment, and health care operations
on behalf of the Part 2 program without the need for a patient authorization, as
long as a valid Qualified Service Organization Agreement is in effect.
Another important change is allowing a single authorization for all uses and disclosures of Part 2 information for treatment, payment, and health care operations purposes, as these terms are defined by HIPAA. Part 2 programs, HIPAA covered entities, and HIPAA business associates that receive the information pursuant to such an authorization may also use and disclose Part 2 information for treatment, payment, and health care operations purposes. The patient retains the right to revoke this consent.
HHS did retain various Part 2 provisions. These include the stringent requirements for disclosing Part 2 information in judicial proceedings and in criminal investigations, and limits on disclosures made without authorization.
_____________________________
Part 2 providers have two years to become compliant with these changes. Because of the scope and number of changes included in the Final Rule, providers are encouraged to begin preparing for these changes now. If you have any questions about the Final Rule and becoming compliant with these changes, we encourage you to contact a Kozak & Gayer attorney. Additionally, Kozak & Gayer has created a redline document comparing the current Part 2 rules with the new revisions. The comparison is available in a PDF that can be downloaded below.[2]
[1] 89 Fed. Reg. 12472 (Feb. 16, 2024).
[2] The redline is an unofficial version created for educational purposes only and does not constitute giving legal advice. Kozak & Gayer does not guarantee the accuracy of the redline version. Readers are encouraged to review the official version in the Code of Federal Regulations.