Nearly half a century ago, Congress passed a law to encourage people to seek treatment for substance use disorder (SUD) without fear that treatment records would be used for criminal prosecution or would otherwise negatively affect court proceedings.[i] In 1975, the implementing regulations at 42 CFR Part 2 followed.[ii] These regulations imposed strict rules on the use and disclosure of SUD treatment information and were far more stringent than the health information privacy rules under the Health Insurance Portability and Accountability Act of 1996 and its regulations (HIPAA), which did not come about until more than 20 years later.
The strict rules under 42 CFR Part 2 have often been at odds with HIPAA and have made treatment and information sharing challenging for providers, especially as the healthcare system has moved toward a coordination of care model. Unlike HIPAA, prior to March 27th, 42 CFR Part 2 prohibited the sharing of SUD treatment information without specific consent of the patient for treatment, payment and healthcare operations.
The inability to share information for treatment purposes without specific consent has put patients’ health and safety at risk. For example, if a patient is receiving medication-assisted treatment for a SUD, the patient’s primary care provider (PCP) or an Emergency Department physician may not have access to that information and could prescribe a contraindicated medication. For this reason, the healthcare industry has been demanding changes to 42 CFR Part 2 for many years. While some regulatory changes came about in 2017 and proposed 2019 changes remain pending, none of the revisions addressed the restrictions on sharing critical SUD treatment information.
It took the COVID-19 pandemic to change that. Buried in the hundreds of pages of the Coronavirus Aid, Relief, and Economic Security Act[iii] (CARES Act), enacted on March 27, 2020, section 3221 changes the language in the original federal statute from the 1970s to more closely align it with HIPAA. Specifically, it allows providers to rely on initial and general consent from the patient for future disclosures related to “treatment, payment and healthcare operations” as permitted HIPAA. Unlike HIPAA, the patient must provide initial consent for such treatment, payment and healthcare operations disclosures and the patient retains the right to revoke that consent at any time.
Additionally, the CARES Act requires that SUD treatment programs, known as Part 2 Programs, provide a Notice of Privacy Practices (NPP) that complies with HIPAA regulations. The NPP must be easily understandable, describe the patient’s rights and detail when the Part 2 Program may use the patient’s information without consent. Congress also charged the Department of Health and Human Services (DHHS) with updating the HIPAA regulations relating to NPPs within one year to ensure that the notices are written in plain language.
The CARES Act also requires Part 2 Programs to follow the Breach Rule under HIPAA for the unauthorized use or disclosure of SUD information, adopts the accounting of disclosure rules under HIPAA, permits the disclosure of de-identified information to a public health authority and adds a new anti-discrimination provision.
All the HIPAA-related changes will streamline operations for Part 2 Programs, most of which are already complying with HIPAA. Most importantly, these changes protect patients by allowing treatment information to be shared without time-consuming and clunky consent procedures.
Operationally, Part 2 Programs will need to obtain consent upon initiation of care to use and disclose information for treatment, payment and healthcare operations. These categories of use and disclosure must be explained in the NPP, including examples of each. Also, consistent with HIPAA requirements, the Part 2 Program should get a signed acknowledgment of receipt of the NPP. Importantly, Part 2 Programs will need to implement a process to manage changes in consent. For example, if a patient wishes to revoke the initial consent to share information for treatment purposes, the Part 2 Program must ensure that it does not make any such disclosures without the patient’s consent and must implement a process for obtaining consent when necessary.
These CARES Act changes will soon be reflected in 42 CFR Part 2. Congress directed DHHS to revise 42 CFR Part 2 within one year to implement and enforce the amendments in the CARES Act. It will be interesting to see how DHHS changes the extensive regulations at 42 CFR Part 2 as well as requirements relating to NPPs under HIPAA.
[i] 42 USC § 290dd-2.
[ii] 42 CFR § 2.1 et seq.
[iii] Public Law No. 116-136