Printer Friendly, PDF & Email

Proposed Rule Brings Part 2, HIPAA Closer Regarding Enforcement, Consent, NPP

A newly proposed HHS regulation on the confidentiality of substance use disorder (SUD) patient records under 42 C.F.R. Part 2 would bring requirements further in line with HIPAA—but that is somewhat of a double-edged sword, say attorneys.

Published last month and open for comments until Jan. 31,[1] the proposed rule may make consent less burdensome for Part 2 providers; however, it would also subject them to the breach notification obligations of HIPAA and its civil and criminal penalties if it is finalized as proposed.

Part 2 applies to organizations that hold themselves out as providing drug and alcohol diagnosis and treatment and receive federal assistance—potentially including providers participating in Medicare or Medicaid. Part 2 provisions also apply to recipients of the records, such as health plans, from Part 2 providers.

“Part 2 has been this rule for decades that is very difficult to comply with, but the counterbalance is it wasn’t actively enforced through criminal penalties,” said attorney Adam Hepworth with Foley & Lardner in Los Angeles. “Now by aligning more closely with HIPAA, it might be easier to comply with, but probably will have more enforcement.”

If the proposed rule seems familiar, it should: HHS finalized significant changes to Part 2 in 2020. This time around, however, HHS is interpreting revisions imposed by the CARES Act.[2] “There’s a lot of tweaking to reconcile the definitions and terms between HIPAA and Part 2,” said attorney Adam Greene with Davis Wright Tremaine in Washington, D.C. “The huge change is now we will have HHS enforcing 42 CFR Part 2 in the same manner as HIPAA.”

This document is only available to subscribers. Please log in or purchase access.

Would you like to read this entire article?

If you already subscribe to this publication, just log in. If not, let us send you an email with a link that will allow you to read the entire article for free. Just complete the following form.

* required field