HHS adjusts substance use privacy rules to improve patient care

Substance use disorder (SUD) treatment data is among the most highly protected patient information. Due to the stigma around substance use and the potential for bias against individuals struggling with substance use disorders, this category of data is subject to enhanced rules around patient privacy and consent.

However, some of the regulations originally designed to protect patients actually make it more difficult for individuals to receive treatment for SUD and other health concerns in a coordinated, and informed manner.

The Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020 requires HHS to align certain aspects of Part 2 with HIPAA Rules and with the Health Information Technology for Economic and Clinical Health (HITECH) Act.

Proposed rulemaking to align privacy rules

As a result, the HHS Office of Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA) have issued a notice of proposed rulemaking to make certain changes to 42 CFR part 2 (Part 2) of the Confidentiality of Substance Use Disorder Patient Records regulations.

The Part 2 regulations deal with protecting the confidentiality of “records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance abuse education prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States.”

The notice of proposed rulemaking will better align the Part 2 regulations with other existing HIPAA regulations to facilitate appropriate information sharing and reduce barriers to comprehensive, coordinated patient care.

Under the revised regulations, programs that fall under Part 2 would be allowed to use and disclose applicable records based on a single prior consent by the patient. The consent would cover all future uses and disclosures for treatment, reimbursement, and other healthcare operations. The redisclosure of Part 2 records would also be permitted, as long as data use follows the existing protocols within the HIPAA Privacy Rule.

Patients would gain the right to an accounting of disclosures and the right to request restrictions on disclosures for treatment, payment, and healthcare operations.

The Part 2 revisions would also expand prohibitions on the use and disclosure of SUD records in civil, criminal, administrative, or legislative proceedings conducted by a federal, state, or local authority against a patient, absent a court order or the consent of the patient.

Part 2 programs would be required to establish a process for receiving complains of violations.  These entities would be prohibited from taking adverse action against any individual who files a complaint.

Stakeholders found in violation of the Part 2 provisions would be subject to HIPAA and HITECH Act civil and criminal penalties, and data breaches involving Part 2 information would be held to the same standards as other breaches as outlined in the HITECH Act and the HIPAA Breach Notification rule.

These and other changes to the existing regulations will give patients more control over their SUD records and better protect sensitive data from being used in an inappropriate manner. These adjustments are important in light of the ongoing substance abuse epidemic raging across the United States, with millions of Americans interacting with substance use disorder services every year.

Let your voice be heard

Stakeholders have an opportunity to comment on the notice of proposed rulemaking on privacy rules changes, which was officially published in the Federal Register on December 2, 2022.  HHS encourages all interested parties to share their feedback and suggestions for further refining these changes within the 60-day comment period.

Jennifer Bresnick is a journalist and freelance content creator with a decade of experience in the health IT industry. Her work has focused on leveraging innovative technology tools to create value, improve health equity, and achieve the promises of the learning health system.