Final rule to implement bipartisan CARES Act legislation
Today, the US Department of Health and Human Services, through its Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA), finalized modifications to the Substance Use Disorder (SUD) Confidentiality regulations. ) for patient records at 42 CFR part 2 (“Part 2”), which protect the privacy of patients’ SUD treatment records. Specifically, today’s final rule increases coordination among providers treating patients for SUDs, strengthens confidentiality protections through civil enforcement, and enhances the integration of behavioral health information with other medical records to improve patient health outcomes.
Today’s rule was informed by the bipartisan Coronavirus Relief, Assistance, and Economic Security Act (CARES Act) that, among other things, required HHS to bring the Part 2 program into closer compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Breach Notification and Enforcement Rules.
“Patient confidentiality is one of the main foundations in health care. People struggling with substance use disorders should have the same ability to keep their information private as anyone else. This new rule helps ensure that happens by strengthening confidentiality protections and improving the integration of behavioral health with other medical records,” said HHS Secretary Xavier Becerra. “The Biden-Harris administration has priority is to end the stigmatization of those living with substance use disorders and to give health care providers the tools they need so they can treat the whole patient while continuing to protect patient privacy. We we will not rest until behavioral health is fully integrated into health care and those struggling with behavioral health challenges receive the best treatment available.”
“The final rule strengthens confidentiality protections by improving care coordination for patients and providers. Patients can seek needed substance use disorder treatment and care knowing that greater protections are in place to keep their information private, and providers can now better share information to improve patient care. said OCR Director Melanie Fontes Rainer.
“One of SAMHSA’s priorities is working to make effective treatments and recovery supports for SUDs more accessible to all Americans,” said Miriam E. Delphin-Rittmon, Ph.D., HHS Assistant Secretary for Mental Health and Substance Use and lead SAMHSA. “The Final Rule supports access to care and treatment and mitigates the discrimination and stigma we all too often face people with SUD while continuing to implement strong privacy protections.”
The final rule includes the following modifications to Part 2:
- Allows use and disclosure of Part 2 data based on a single, one-time patient consent for all future uses and disclosures for treatment, payment, and health care operations.
- Permits the re-disclosure of Part 2 data by HIPAA-covered entities and business associates in accordance with the HIPAA Privacy Rule, with certain exceptions.
- Provides new rights for patients under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also provided by the HIPAA Privacy Rule.
- Extends prohibitions on use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings.
- Provides HHS enforcement authority, including the potential imposition of civil money penalties for violations of Part 2.
- Summarizes the new breach notification requirements that apply to Part 2 data.
A fact sheet on the final rule can be found at: https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index. html