The United States Department of Health and Human Services (“HHS”) has issued its final rule to modify its regulations on the treatment of Substance Use Disorder records to increase alignment with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to improve workability and decrease burden on programs, covered entities, and business associates.   

To explain these changes, let’s take a little trip down memory lane.  Back in 1970, Congress recognized that patients receiving treatment for substance use ought to receive a special level of privacy and protection in order to encourage and promote individuals to seek medical treatment.  After a series of laws in the 1970’s, Congress later increased its protection of substance use disorder records in 1992 with the Alcohol Drug Abuse, and Mental Health Administration Reorganization Act.  The records regulated under this law became known as “Part 2” as they amended Part 2 of the Public Health Services Act.   

Congress’s original intent with these laws—to protect patient privacy and reduce stigma associated with seeking treatment for substance use disorders—was laudable for its time.  But Part 2 has since created unintentional consequences for providers as technology has evolved and created administrative complexity and barriers with HIPAA, the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and the policy shift to coordinated care. 

Congress hoped to reconcile these competing interests in 2020 with passage of the Coronavirus Aid, Relief and Economic Security Acy (“CARES”) by amending Part 2 requirements.  Some of the changes implemented with this new regulation include the following: 

• Simplifying Consent.  Allows a single consent for all future uses and disclosures for treatment, payment, and health care operations.  Allows HIPAA covered entities and business associates that receive records under this consent to redisclose the records in accordance with the HIPAA regulations. 
• Public Health & Regulatory Reporting. Permits disclosure of records without patient consent to public health authorities, provided that the records disclosed are de-identified according to the standards established in the HIPAA Privacy Rule. 
• Accounting of Disclosures. Provides new rights for patients under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule. 
• Legal Proceedings. Expands prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings. 
• Enforcement Powers. Provides HHS enforcement authority, including the potential imposition of civil money penalties for violations of Part 2. 
• Breach Notification Requirements.  Outlines new breach notification requirements applying to Part 2 records.