On November 28, 2022, the U.S. Department of Health & Human Services (HHS), through the Office for Civil Rights (OCR) and in coordination with the Substance Abuse and Mental Health Services Administration (SAMHSA), proposed a rule to modify privacy protections for persons with substance use disorders (SUD). The proposed rule reduces privacy protections for SUD patients, by amending the Confidentiality of Substance Use Disorders Patient Records, known as “42 CFR Part 2,” which protects the confidentiality of treatment records for any patient that has sought treatment for or been diagnosed with addiction at a federally assisted program. The rule would implement provisions of Section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), which requires HHS to make Part 2 more compliant with the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
Specifically, proposed changes would:
- Permit current and future use and disclosure of Part 2 records for treatment, payment, and health care operation after receiving patient consent once;
- Allow, with certain exceptions, redisclosure of Part 2 records in any manner permitted by the HIPAA Privacy Rule;
- Create new patient rights under Part 2 to obtain an accounting of disclosures and to request limitations on certain disclosures;
- Increase restrictions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings;
- Develop new HHS enforcement authority, including the ability to impose civil money penalties for Part 2 violations;
- Update breach notification requirements to HHS and impacted patients; and
- Update requirements in HIPAA Privacy Rule Notice of Privacy Practices to address uses and disclosures of Part 2 records and individual rights associated with those records.
Former director of SAMHSA’s Center for Substance Abuse Treatment, Dr. H. Westley Clark, MD, JD, expressed concern over similar, previously proposed changes to 42 CFR Part 2. He noted that increased disclosure of personal information may hinder patients from seeking treatment, which could give rise tom suicide, relapse to substance use or drug poisoning. He was also concerned that, given the difficulty for SUD programs to fully disclose the spectrum of entities that may receive patients’ personal information, it would be difficult for patients to provide full consent. Dr. Clark explained that more widespread disclosure policies are discriminatory because wealthy individuals who can afford to pay out-of-pocket for SUD treatment services can avoid disclosing to their health plan that they are in SUD treatment.
CUSP’s position is that HIPAA does not provide enough privacy protections for people with SUD. The proposed changes would reduce Part 2’s privacy requirements, which are necessary to ensure people with SUD can participate in treatment without fear of being targeted by law enforcement or discriminated against based on SUD status.
Read the Rule here.
Read the News Release here.
Read HHS’ factsheet here.