A newly proposed HHS regulation on the confidentiality of substance use disorder (SUD) patient records under 42 C.F.R. Part 2 would bring requirements further in line with HIPAA—but that is somewhat of a double-edged sword, say attorneys.
Published last month and open for comments until Jan. 31,[1] the proposed rule may make consent less burdensome for Part 2 providers; however, it would also subject them to the breach notification obligations of HIPAA and its civil and criminal penalties if it is finalized as proposed.
Part 2 applies to organizations that hold themselves out as providing drug and alcohol diagnosis and treatment and receive federal assistance—potentially including providers participating in Medicare or Medicaid. Part 2 provisions also apply to recipients of the records, such as health plans, from Part 2 providers.
“Part 2 has been this rule for decades that is very difficult to comply with, but the counterbalance is it wasn’t actively enforced through criminal penalties,” said attorney Adam Hepworth with Foley & Lardner in Los Angeles. “Now by aligning more closely with HIPAA, it might be easier to comply with, but probably will have more enforcement.”
If the proposed rule seems familiar, it should: HHS finalized significant changes to Part 2 in 2020. This time around, however, HHS is interpreting revisions imposed by the CARES Act.[2] “There’s a lot of tweaking to reconcile the definitions and terms between HIPAA and Part 2,” said attorney Adam Greene with Davis Wright Tremaine in Washington, D.C. “The huge change is now we will have HHS enforcing 42 CFR Part 2 in the same manner as HIPAA.”
Questions Surround Notification Provisions
Prior to the CARES Act, responsibility for enforcement rested with U.S. attorneys, but there has never been a criminal enforcement action for a Part 2 violation, Hepworth said. HHS has experience investigating breaches, imposing penalties and requiring corrective action, which suggests Part 2 providers will face enforcement actions down the road for violations, he said.
Regarding breach notification, Greene said the proposed rule incorporates the definition of a breach from the HIPAA Breach Notification rule, which defines a breach as a violation of the Privacy Rule.
“It’s a little unclear how breach notification will play out here,” he said. Will a Part 2 breach only be reportable if the Part 2 information is disclosed in violation of the HIPAA Privacy Rule? “There are plenty of circumstances where uses and disclosures are prohibited by Part 2 but permitted by the privacy rule,” Greene noted. “Is it a breach of the Privacy Rule or Part 2 rule that triggers the breach notification rule?”
As noted, the proposed rule builds on earlier efforts to harmonize Part 2 and HIPAA. In the 2020 rule, HHS added care coordination and case management to a list of 17 activities—including billing and fraud, and waste and abuse activities—that are now considered as payment and health care operations.
Along with other provisions, this means a patient can consent to share SUD information with a Part 2 entity—and that entity can further disclose the information to its contractors for payment and health care operations.
