Promising a future of stronger protections and more effective treatment for patients with substance use disorders, the U.S. Department of Health and Human Services (HHS) has modified 42 CFR Part 2 (“Part 2”) to better align with the Health Insurance Portability and Accountability Act (HIPAA). Effective as of April 16, 2024, with a two-year deadline for entities subject to the regulations to comply, the new rule allows health care professionals access to necessary, but previously restricted, patient information and enforces new safeguards to patient privacy.
Part 2:
The the health care records of any patient involved in substance use disorder programs or activities, including treatment, rehabilitation, and research, that is conducted, regulated, or assisted by any department or agency of the United States. Before the newly enacted modifications, privacy regulations under Part 2 were more stringent than those under HIPAA. These stricter regulations were intended to encourage those with a substance use disorder to seek treatment by decreasing the possible fear of legal or discriminatory repercussions that could result from an information disclosure. In practice, this system made it too difficult for providers to provide effective care, as access to important patient information was restricted. This new rule seeks to increase the privacy of substance use disorder patients while giving health care providers the proper tools to best treat patients with behavioral health challenges.
Key Changes:
- Consent Requirements
While Part 2 previously prohibited substance use disorder patients’ records from being redisclosed (with few exceptions), under the new rule, substance use disorder patients can provide a one-time, general consent for the future uses and disclosures of their information for treatment, payment, and health care operations. This change will ensure that Part 2 health care providers have access to any and all necessary information when treating those with a substance use disorder, allowing the health care practitioner to view the patient’s entire health history and give a more holistic view of their patients.
Additionally, the substance use disorder information in a patient’s medical record received from a Part 2 program will no longer need to be segregated from the rest of the medical record once general consent is granted. While this change could benefit Part 2 programs by lowering the administrative burdens associated with segregating records, Part 2 providers will need to continue segregating records for patients yet to provide general consent.
In following HIPAA’s protections regarding psychotherapy notes, this general consent under the newly modified Part 2 will not include the disclosure of clinician notes kept separate from a patient’s treatment and medical records during substance use disorder counseling. These notes will require specific consent from the patient due to their special nature.
- Breaches and Penalties
HHS has also heightened its enforcement authority by replacing previous criminal penalties for Part 2 violations with the same civil and criminal enforcement authorities that apply to HIPAA violations. This change will greatly increase the repercussions for violating the new rule, as previous criminal penalties were rarely enforced by the U.S. Department of Justice.
Furthermore, Part 2 has adopted HIPAA’s Breach Notifications Rule and the HIPAA Notice of Privacy requirements. These expanded prohibitions on the use and disclosure of patient records in civil, criminal, administrative, and legislative proceedings intend to reduce patient fear and encourage patient privacy.
While Part 2 continues to prohibit the use of substance use disorder patient information from investigative agencies without permission by court order, the new rule has adopted a Safe Harbor provision, which limits civil or criminal liability for investigative agencies that act diligently and follow certain steps if they find that they have received Part 2 records without court order permission.
By specifying and strengthening penalties under Part 2, HHS has taken a proper step in enduring that the information of patients with substance use disorders will be safeguarded.
- Patient Requests
Included in the many benefits that substance use disorder patients gain from these modifications is the newly granted right to obtain an accounting of disclosures. From now on, each disclosure that is made with the patient’s consent will include a copy of the consent, and/or an explanation of exactly what the consent allows. In addition to this, patients can also request restrictions on some disclosures, including the option to opt out of communications regarding fundraising. In the event of a Part 2 violation, patients now can file a complaint directly with the HHS Secretary and with the Part 2 program.
Providing Part 2 patients with more rights than previously seen before, HHS has given patients with substance use disorders the chance to see a future with more personal autonomy in decision making, and more power in ensuring that their privacy is protected.
What Does This Mean for the Health Care Industry:
Amidst these new modifications to Part 2, health care organizations and providers will need to prepare for change in an effective and safe matter. To do this, proper training and education will be necessary to avoid any accidental breaches of patient privacy. Additionally, health care organizations will need to update their policies and procedures to comply with these new rules while monitoring patient records to ensure that privacy is protected during this training period.