HHS Issues a Part 2 Proposed Rule to Better Facilitate Care for SUDs
It has been a major focus for the U.S. Department of Health and Human Services (HHS) to combat the opioid epidemic while still ensuring that the confidentiality of patient records is maintained.
HHS is proposing to revise the federal confidentiality law and regulation found at 42 CFR, commonly referred to as "Part 2" that is in place to protect the privacy of substance use disorder (SUD) patient records by prohibiting unauthorized disclosures of patient records except in limited circumstances.
According to the HHS, the purpose of the proposed rule is to facilitate better coordination of care for SUDs) which will also enhance care for opioid use disorder. It's important to note the proposed rule will not alter the basic framework for confidentiality protection of SUD patient records created by federally funded treatment programs. What is changing, under the new Part 2 Rule are the following provisions:
- Applicability and Re-Disclosure - Treatment records created by non-part 2 providers based on their own patient encounter(s) will not be covered by part 2, unless any SUD records previously received from a part 2 program is incorporated into such records. Segmentation or holding a part of any part 2 patient record previously received can be used to ensure that new records created by non-part 2 providers will not become subject to part 2.
- Disposition of Records - When a SUD patient sends an incidental message to the personal device of an employee of a part 2 program, the employee will be able to fulfill the part 2 requirement for "sanitizing" the device by deleting that message.
- Consent Requirements - An SUD patient may consent to the disclosure of their part 2 treatment records to an entity (e.g., the Social Security Administration), without naming a specific person as the recipient for the disclosure.
- Disclosures Permitted w/ Written Consent - Disclosures for the purpose of "payment and health care operations" are permitted with written consent, in connection with an illustrative list of 17 example activities.
- Disclosures to Central Registries and PDMPs - Non-OTP (opioid treatment program) providers will become eligible to query a central registry, in order to determine whether their patients are already receiving opioid treatment through a member program.
- OTPs will be permitted to enroll in a state prescription drug monitoring program (PDMP) and permitted to report data into the PDMP when prescribing or dispensing medications on Schedules II to V, consistent with applicable state law.
- Medical Emergencies - Declared emergencies resulting from natural disasters (e.g., hurricanes) that disrupt treatment facilities and services will meet the definition for a "bonafide medical emergency," for the purpose of disclosing SUD records without patient consent under part 2.
- Research - Disclosures for research under part 2 will be permitted by a HIPAA covered entity or business associate to individuals and organizations who are neither HIPAA covered entities, nor subject to the Common Rule (re: Research on Human Subjects).
- Audit and Evaluation - Part 2 will be revised to clarify that some specific situations fall within the scope of permitted disclosures for audits and/or program evaluation.
- Confidential Communications - The standard for court-ordered disclosures of SUD records for the purpose of investigating "an extremely serious crime" will be revised, by dropping the phrase "allegedly committed by the patient."
- Undercover Agents and Informants - Court-ordered placement of an undercover agent or informant within a part 2 program will be extended to a period of 12 months, and courts will be authorized to further extend the period of placement through a new court order.
The proposed changes to Part 2 are the first proposed regulations released as part of the Deputy Secretary's Regulatory Sprint to Coordinated Care, which was launched by Secretary Azar as part of his vision for delivering value-based healthcare.