A proposed HHS regulation on the Confidentiality of Substance Use Disorder (SUD) Patient Records under 42 C.F.R. Part 2 would bring it further in line with HIPAA, which is somewhat of a double-edged sword, attorneys say.[1] While patient consent would become less burdensome for Part 2 providers, they also would be subject to the breach notification obligations of HIPAA and its civil and criminal penalties if the proposed rule—published in the Federal Register Dec. 2—is finalized.
Part 2, as it’s known, applies to organizations that hold themselves out as providing drug and alcohol diagnosis and treatment and receive federal assistance, potentially including providers participating in Medicare or Medicaid. The rule also applies to recipients of the records, such as health plans, from Part 2 providers.
“Part 2 has been this rule for decades that is very difficult to comply with, but the counterbalance is it wasn’t actively enforced through criminal penalties,” said attorney Adam Hepworth, with Foley & Lardner in Los Angeles. “Now by aligning more closely with HIPAA, it might be easier to comply with, but probably will have more enforcement.”
If the proposed rule seems like déjà vu all over again, that’s because HHS finalized significant changes to Part 2 in 2020. This time around, however, HHS is interpreting revisions ordered by Congress in Sec. 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act. “There’s a lot of tweaking to reconcile the definitions and terms between HIPAA and Part 2,” said attorney Adam Greene, with Davis Wright Tremaine in Washington, D.C. “The huge change is now we will have HHS enforcing 42 CFR Part 2 in the same manner as HIPAA.”
Until now, the responsibility for enforcement rested with U.S. attorneys, but there has never been a criminal enforcement action for a Part 2 violation, Hepworth said. Because HHS has experience investigating breaches, imposing penalties and requiring corrective action, it suggests Part 2 providers will face enforcement actions down the road for violations, he said. They may be pursued by HHS through either or both agencies that jointly released the proposed rule: the Substance Abuse and Mental Health Services Administration (SAMHSA) and the Office for Civil Rights (OCR).
