OCR Strengthens Confidentiality of Substance Use Disorder Patient Records
March 1, 2023 5 minutes read
The Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA) recently announced proposed changes to the Confidentiality of Substance Use Disorder (SUD) Patient Records under 42 CFR Part 2, which could affect HIPAA compliance programs.
Part 2 protects patient privacy and records concerning treatment related to substance use challenges from unauthorized disclosures. The proposed rule “increases coordination among providers in treatment for substance use challenges and increases protections for patients concerning records disclosure to avoid discrimination in treatment.”
Currently, Part 2 imposes different requirements for SUD treatment records than the HIPAA Privacy Rule. This can cause confusion among covered entities trying to comply with the rules — and that, in turn, can complicate or denigrate the care provided to SUD patients.
If finalized, the new rule would provide long-awaited relief for Part 2-regulated healthcare providers (and their patients) who have wrestled for years with the inconsistencies across these two federal privacy frameworks, says Vicki J. Tankle, JD, partner with Reed Smith in Philadelphia.
“Those providers would need to re-evaluate their health privacy compliance programs that are currently designed to comply with Part 2’s far more stringent standards,” Tankle said. “While this may cause some operational challenges, and may also frustrate providers who have spent time and financial resources in complying with strict Part 2 requirements, I think consistency across these two frameworks will ultimately enhance information-sharing and care coordination to the benefit of both providers and their patients. It will reduce confusion and compliance challenges for providers currently regulated by these dual standards.”
For example, the response to this change in the rule would include streamlining the provider’s privacy notice and practices around responding to patient requests for an accounting of disclosures and restrictions on disclosures, Tankle says.
If finalized, the proposed rule would afford Part 2-regulated providers with new flexibility, consistent with HIPAA, around obtaining patient authorization to use and disclose information for treatment, payment, and healthcare operations purposes (TPO).
“In particular, Part 2-regulated providers who are currently required to obtain separate written patient consent for each TPO use or disclosure would be able to obtain a single patient authorization applicable to future uses and disclosures for TPO purposes,” Tankle says.
More Ability to Share
The proposed change is driven in part by the improved ability to share information electronically, along with a push for continuity of care and coordination between providers, says Amy M. Joseph, JD, partner with Hooper, Lundy & Bookman in Boston.
“This has become more and more of a challenge with insurance types of information, because 42 CFR Part 2 is so strict with how you can use the information,” Joseph says. “Under Part 2, you have to have the individual consent. It’s a pretty prescriptive requirement right now regarding what that consent must look like.”
The proposed rule would create a much easier process to facilitate sharing information for patient care purposes and for payment purposes — much more streamlined and closer to HIPAA.
“The biggest takeaway on the Part 2 side is that going forward, there’s now going to be a proactive requirement to self-report any breaches, like we’ve always had under HIPAA,” Joseph says. “Part 2 has potential criminal enforcement, but we rarely see it enforced, and there’s no proactive duty to go to the government or to the individuals to let them know that a breach has occurred. That is the other big change that will come out of these rules.”
Advancing Patient Rights
Melissa Soliz, JD, partner with Coppersmith Brockelman in Phoenix, notes Congress passed the Coronavirus Aid, Relief, and Economic Security (CARES) Act in 2020, promising to give individuals suffering from SUDs the same advantages of integrated care afforded to patients suffering from other maladies. The proposed rule changes will fulfill that promise while strengthening HHS’ ability to enforce SUD privacy protections and prohibiting discrimination against those suffering from SUDs, she says.
“These proposed regulations are desperately needed as the ranks of those suffering from SUDs continues to swell as the opioid epidemic rages across the country,” Soliz says.
The proposed rule changes will advance patient rights by putting the full force of HIPAA notice, complaint, and enforcement structure behind SUD privacy protections, Soliz says. It will do so by requiring SUD treatment providers to self-report breaches of SUD records and by prohibiting the use of SUD records and testimony against SUD patients in a broader range of civil, criminal, and administrative proceedings and law enforcement investigations.
“The proposed rule changes will also afford SUD patients the benefits of better care coordination and treatment by allowing HIPAA-covered healthcare providers and health plans to use and disclose SUD records for any HIPAA-permitted purpose, if the SUD patient has consented to the use and disclosure of their SUD records for treatment, payment, and healthcare operations activities,” Soliz says.
Because this is a proposed rule, healthcare organizations do not need to change anything immediately in response to this proposed change, says J. Malcolm DeVoy, JD, partner with Holland & Hart in Las Vegas. The final rule may end up different from the proposed rule, as is often the case, once HHS receives comments from stakeholders and industry.
For healthcare providers who do not offer SUD treatment programs, many will not see any changes. For providers who work in coordination with SUD treatment programs, such as psychiatric facilities or practices involved in the care of patients undergoing treatment, these rules will make it easier to share and disclose SUD-related records.
Administrative and clinical staff will need to review their policies and procedures regarding authorizations, sharing, storing, accounting for, and disclosing patient information subject to the protections of Part 2 to understand what uses are permitted as well as which are now prohibited.
These rule changes may affect all practices to some degree, and the entities that do not regularly encounter Part 2 likely will face the most challenges, DeVoy says. Facilities, hospitals, and practices enmeshed with SUD programs will understand the points of contact between the final rule and their practices, and be able to anticipate these changes.
“Practices within infrequent contact with SUD treatment, such as pediatric practices, or practices where SUD treatment may be relevant to other care, such as OB/GYN practices, may struggle and even be caught unaware because of how distant the requirements of Part 2 are from their practices,” DeVoy says. “Due to the broader sweep of information that may be protected under Part 2 in the final rule, and the administrative penalties that may attach to violations, any practice that may receive Part 2-protected information needs to be aware of these changes.”
Greater Accessibility for Patients
These changes would create greater accessibility for the patient in the treatment continuum, says Thomas Britton, MD, CEO of American Addiction Centers in Brentwood, TN.
“Healthcare organizations should review their current health information and information privacy policies to conform them to the changes in the proposed rule, as well as reviewing their consent forms. For non-SUD providers, it will be necessary to review how the data are physically maintained and segmented in the electronic health record to ensure that adequate safeguards are maintained under the proposed rule,” Britton says. “They should also review their Notice of Privacy Practices under the HIPAA Privacy Rule, and the expanded proposed prohibitions on use and disclosure of Part 2 records for civil, criminal, and administrative disclosures.”
The Office for Civil Rights and the Substance Abuse and Mental Health Services Administration recently announced proposed changes to the Confidentiality of Substance Use Disorder Patient Records under 42 CFR Part 2, which could affect HIPAA compliance programs.
You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content