Confidentiality of Substance Use Disorder Records: Long-Awaited NPRM Proposes Aligning Part 2 With HIPAA

BACKGROUND

As we noted in prior health care alerts in 2020 (available here and here), the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) significantly overhauled the federal law that governs the confidentiality of substance use disorder (SUD) records at 42 U.S.C. § 290dd-2 (Part 2).

Part 2 currently imposes requirements for the use and disclosure of SUD treatment records (Part 2 records) that differ from the requirements that apply to covered entities and their business associates under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). These differing obligations under HIPAA and Part 2 create compliance challenges for covered entities (and their business associates) when they maintain both protected health information (as defined by HIPAA) and Part 2 records.

On 2 December 2022, the Office for Civil Rights and the Substance Abuse and Mental Health Services Administration (SAMHSA), each within the U.S. Department of Health and Human Services (HHS) issued a Notice of Proposed Rule Making (NPRM) setting out the long-awaited proposed modifications to the existing Part 2 regulations to implement statutory amendments under the CARES Act to align certain Part 2 requirements more closely to HIPAA.

High-Level Overview of the NPRM:

In addition to other changes, discussed in detail in the chart available here, the NPRM includes:

• Revisions to a number of headings and provisions to clarify that uses as well as disclosures (and redisclosures) are encompassed by the Part 2 rules; 
• New requirements for patient consent to the redisclosure of Part 2 records;
• New patient rights to obtain an accounting of disclosures made with consent and to request restrictions on disclosures;
• Greater restrictions against the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings against patients;
• New civil money penalties (each, a CMP) for violations of certain of Part 2 regulations;
• New requirements to prohibit discrimination against Part 2 program participants; 
• New breach notification requirements; and
• A limitation on liability for agencies that investigate and prosecute Part 2 programs, and persons acting on their behalf (collectively proposed to be defined as “investigative agencies”), to address concerns about potential unintended consequences of proposed changes in enforcement authority and penalties under the Part 2 regulations with respect to noncompliance by investigative agencies who unknowingly receive records subject to Part 2.

The NPRM proposes additional changes in defined terms in the existing Part 2 regulations to harmonize with the terms used in the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (HIPAA Rules). As a reminder, the CARES Act adopted the following definitions from the HIPAA Rules and applied them to Part 2: (i) business associate, (ii) covered entity, (iii) health care operations, (iv) payment, (v) public health authority, (vi) treatment, and (vi) unsecured protected health information.  HHS is proposing to adopt further harmonizing language. For example, HHS proposes to adopt the phrase “use and disclosure” throughout the revised Part 2 regulations, “when both actions could apply.” In addition, HHS proposes changing the Part 2 terms “individual” and “entities” to the term “persons,” which HHS is proposing to define the same as in HIPAA. HHS is also proposing edits to correct grammatical issues, to improve readability and modernize the regulation, to renumber sections and make structural changes to the numbering of paragraphs, and to substitute the phrase “non-electronic records” for the term “paper records.”

While most of the proposed rule changes relate to Part 2, HHS is also proposing modifications to the content of the HIPAA Notice of Privacy Practices (NPP) to address both the uses and disclosures of Part 2 records and an individual’s rights with respect to those records.

HHS also indicates that it intends to develop separate rules to implement the CARES Act antidiscrimination prohibitions and that it is also considering whether to create a new definition, similar to the HIPAA definition of “psychotherapy notes,” that is specific to the notes of SUD counseling sessions by a Part 2 program professional. That definition would be used to allow for additional protection of those notes in a manner similar to the protection of psychotherapy notes under HIPAA. HHS contemplates that SUD counseling notes would be defined as those notes maintained primarily for use by the originator of the notes documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the patient’s record. The disclosure of the SUD counseling notes would be limited, generally consistent with the protection afforded to psychotherapy notes under HIPAA.

Finally, note that on 13 December 2022 (within days of the issuance of the joint NPRM discussed in this alert), SAMHSA also issued proposed rules to expand access to opioid-use disorder treatment and help close the gap in care by amending the regulations under 42 C.F.R. part 8.

HHS is Seeking Feedback

HHS recognizes the complexity of the changes it is proposing, including the complexity of moving to a use of common terminology under HIPAA and the Part 2 regulations. There are numerous instances where HHS is asking for specific comments from industry and stakeholders, including in circumstances where it is proposing changes reflecting an “assumption” about the impact of a change in Part 2 programs.  The chart linked to this health care alert discusses where HHS has specifically requested comments and provides greater detail about the proposed changes.

Deadline for Comments on the Proposed Regulations

The deadline for the receipt of comments by HHS is 31 January 2023. The proposed changes in this long-awaited NPRM have significant implications for Part 2 programs. K&L Gates’ Health Care and FDA practice regularly advises stakeholders on health privacy matters, including the Part 2 rules, and assists clients with public comments on proposed rulemakings. Contact the authors of this article or another K&L Gates lawyer for questions or assistance in regard to the NPRM.

View the Confidentiality of Substance Use Disorder Records (Part 2) Notice of Proposed Rule Making chart here.