By Matt Fisher, Healthcare Attorney
LinkedIn: Matthew Fisher
X: @matt_r_fisher
Host of Healthcare de Jure – #HCdeJure
The Department of Health and Human Services released a final rule that will establish greater alignment between Part 2 (privacy of substance use disorder treatment records) and HIPAA. HHS kicked off the process with a notice of proposed rulemaking that was published on December 2, 2022. The 60 day period to submit comments closed in early 2023. Now, roughly a year later, the final rule is coming.
Statutory changes from the Coronavirus Aid, Relief, and Economic Security Act of 2020 (the CARES Act) were the impetus for the new regulations. However, the drive to incorporate consistency with HIPAA into Part 2 had been a long sought outcome since it would allow for greater consistency in understanding of how to interact with the different types of records.
Quick Background on Part 2
Before getting into the changes, it is likely helpful to set the stage as to what the Part 2 regulations actually address. The Part 2 regulations, the shorthand way of referring to 42 C.F.R. Part 2, establish privacy standards for records created by substance use disorder (SUD) treatment facilities and associated clinicians. Part 2 imposes restrictions that are more stringent than corresponding provisions under HIPAA.
The particular sensitivity around the treatment of SUDs informs the heightened restrictions. Traditionally, SUDs carry a high degree of stigma and negative associations. To avoid negative repercussions for individuals seeking support and help with such disorders, Part 2 greatly restricts the circumstances under which SUD records can be used or disclosed. In most instances, an individual must consent to the use or disclosure of SUD records. The broad consent requirement acknowledges the sensitivity of the records.
It is important to note that Part 2 only applies to so-called Part 2 programs. A Part 2 program is a facility or clinician operating a federally assisted program for the treatment of SUD. The keywords in the definition are “program” and “federally assisted” as both carry a lot of import.
Regardless of whether the Part 2 program is a separate entity or a sub-unit within a bigger facility, just being a Part 2 program imposes a different set of compliance requirements. There are nuances beyond HIPAA, which necessitates education focused on these requirements.
The Changes
With that overall brief and very high level background, what does the new rule do? As stated by HHS, the final rule aligns certain portions of the Part 2 regulations with HIPAA, as required by the CARES Act.
Changes Impacting Use and Disclosure
The rules around use and disclosure of Part 2 records are subject to the greatest impact from the changes. A number of the previous restrictions have been modified to reflect the procedures that apply under HIPAA. The individual consent process has been changed a little bit, though the consent still needs to identify the information to be used or disclosed and where the information can go. If the consent will allow records to be provided to a covered entity or business associate for treatment, payment, or health care operations (each as defined by HIPAA), then the consent needs to include a statement that such information may be further used and disclosed in accordance with HIPAA. In essence, the consent will now allow ongoing utilization of the SUD records whereas before a separate consent was typically required for each use or disclosure. Since use and disclosure can ripple (as long as it is consistent with HIPAA), the records could be disseminated to a much wider range of third parties. Individuals will likely need to consider that impact, though it is questionable how much a member of the general public will understand that nuance.
The final rule introduces a new standard for SUD counseling notes. The term SUD counseling notes receive a brand new definition and will then receive treatment similar to psychotherapy notes under HIPAA. That means SUD counseling notes will still be subject to more stringent restrictions on use and disclosure. The restrictions will only apply to the extent the SUD counseling notes are not maintained as part of the general note, though HHS does not in the commentary that discretion always exists of whether granting an individual access will be ok.
The consent process also gets some clarification. Consents cannot be combined for purposes of allowing use or disclosure in connection with a civil, criminal, administrative, or legal proceeding with another consent for use or disclosure. That also reinforces that generally records cannot be used or disclosed in a legal proceeding without a consent. As noted above, a separate consent is needed for the use and disclosure of SUD counseling notes. Lastly, the consent needs to clearly explain the scope of the consent, which appears designed to promote understanding of what is being asked for. How effective the clear language is in practice will be an issue to watch.
Breach Notification
Surprisingly, Part 2 does not contain a distinct breach notification process. That means, a breach impacting purely Part 2 records could arguably occur without notice to impact individuals. That will change going forward. The current requirements of the HIPAA Breach Notification Rule are being extended Part 2 programs. Will a spike in reports come and will compliance differ from programs subject to HIPAA already? It’s an interesting question to ponder.
In addition to imposing a breach notification requirement, the changes also call out certain security measures that need to be implemented. While the measures are all pretty basic and should ideally already exist, calling out in the regulation will provide a hook for enforcement going forward.
Introduction of Individual Rights from HIPAA
Some of the individual rights from HIPAA are coming over to Part 2 programs. One with a potential big, though questionable impact is the requirement to present individuals with a Patient Notice. The Patient Notice is intended to mimic the Notice of Privacy Practices called for by HIPAA. The Patient Notice must include the elements called out in the new rule, which includes labeling the document as a Notice of Privacy Practices.
Explaining how information will be kept private and protected is important. However, the practical effect of the notice is always questionable. Anecdotally, it is not clear how many individuals actually read the notice, let alone absorb or understand what it explains. From that perspective, a bigger change could be helpful, though identifying what would help is not necessarily easy to determine.
Additional HIPAA-based individual rights now coming to Part 2 are: (i) a right to request restriction of disclosures with prior consent for treatment, payment, and health care operations, (ii) a right to request and obtain a restriction on disclosures paid for in full by the individual without insurance, (iii) a right to an accounting of disclosures for the past 3 years, and (iv) a right to a list of disclosure by an intermediary for the past 3 years.
A Couple of Miscellaneous Changes
Another change of note is the ability to intermingle Part 2 and other records. Previously, Part 2 programs, whether independent or a part of a larger organization, would wall off Part 2 records from any other patient information. The segregation could create some logistical concerns on the technology side. With the rule specifically stating that such separation is not necessary, it may make some operational procedures easier. However, it will also require enhanced attention when using or disclosing records.
The final change is carrying over the enforcement and penalty structure from HIPAA to Part 2. The relatively stepped up enforcement in the HIPAA realm far outpaces the complete absence in Part 2 enforcement actions to date. If the process is easier, then more activity could likely follow.
Time to Prepare
Even though the requirements of the new rule will not go into effect for a while, all Part 2 programs should take the time to develop an understanding now and prepare for compliance. Given the ability for easier enforcement, not following could result in some unwanted negative attention.
This article was originally published on The Pulse blog and is republished here with permission.