Privacy is paramount for all patient records. Restrictions on how treatment records can be used and disclosed are more stringent, however, when it comes to particularly sensitive areas, like HIV and AIDS testing, mental health records, and substance use disorder (SUD) treatment records. While the reasons for protecting patient confidentiality are evident, the practical effect for health care providers is additional procedural and logistical hurdles as they navigate how to store, use, and disclose these records.
New Proposed Rules Regarding SUD Record Disclosure
On November 28, 2022, the Department of Health and Human Services took a step forward in balancing the confidentiality of certain SUD records with promotion of the coordination of care. It issued a notice of proposed rulemaking that will change federal regulations restricting the use and disclosure of SUD treatment records from federally assisted SUD treatment programs. These higher-level protections are called “Part 2” requirements because they are found in 42 C.F.R., Part 2.
Generally, Part 2 providers can include any doctor with DEA authorization to prescribe controlled substances for the treatment of SUD. Historically, SUD records have been subject to these Part 2 requirements to allow patients to get necessary treatment without facing adverse consequences in other areas of their life, like employment and divorce.
However, these protections can make coordination of care between disciplines more difficult. For example, under the current regulations, Part 2 providers cannot disclose any information that would identify a person as having a SUD without that person’s written consent to the patient’s other medical providers. So, if a patient receives SUD treatment through one provider at a facility that provides multidisciplinary treatment, any information identifying the patient as a recipient of SUD treatment cannot be given to any other non-SUD treatment providers in the same facility or put into the general electronic medical record unless the patient has executed an appropriate authorization to release her SUD information to the facility and/or to other, individual providers within the facility.
Likewise, Part 2 has restrictions on “redisclosure” of information. Once SUD treatment information is disclosed, it cannot be disclosed again without another written authorization by the patient, unless one of a narrow set of exceptions applies. A valid authorization for the disclosure of SUD treatment records must include a specific statement that the information and records cannot be further disclosed. Other than when a few, limited exceptions apply, a new consent form is needed for each disclosure.
As part of the Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020, regulations were to be revised to align the more stringent Part 2 protections more closely with the privacy requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The November 28 notice of proposed rulemaking is in furtherance of that requirement and reflects several practical changes that will make care coordination more efficient without sacrificing the privacy protections that will help individuals with SUD feel more able to seek appropriate treatment.
Proposed Regulation Revisions
- First, the proposed regulations allow a written consent for the disclosure of Part 2 records to apply to future uses and disclosures for treatment, payment, and health care operations. Redisclosure can occur without a new consent form, so long as the redisclosure is consistent with the HIPAA privacy rule and the recipients are also Part 2 programs or HIPAA covered entities like health care providers and health insurers. This would be a significant shift from the existing prohibition on redisclosure without a new consent or applicable exception for each disclosure.
- Additionally, the changes will make it more difficult to use or disclose Part 2 records for civil and criminal legal proceedings without a court order or patient consent. For example, proposed regulations specifically address whether testimony conveying information from SUD treatment records is admissible in civil proceedings against patients, absent a court order or the patient’s consent.
- The changes will also add characteristics from HIPAA to Part 2, including a patient right to accounting of disclosures and a right to request restrictions on disclosures, a confidentiality notice requirement similar to a HIPAA notice of privacy practices, and a breach notification requirement for unauthorized disclosure of Part 2 records.
- Finally, the changes give more teeth to administrative enforcement of Part 2 protections. They require a complaint process for violations, protect patients from adverse action for filing complaints, and prohibit Part 2 programs from conditioning treatment on a patient’s agreement to never make a complaint. The proposed rules are available for comment as of December 2, 2022, and the comment period is open for 60 days. Ultimately, the aim appears to be to make it easier for healthcare professionals to provide proper care to patients with SUD, balancing care coordination with patient privacy by allowing easier disclosures for treatment, payment, and health care operations while shoring up complaint procedures, civil money penalties for violations, and breach notification requirements.
Jamie Wilhite Dittert is an award-winning healthcare law and torts & insurance member attorney at Sturgill, Turner, Barker & Moloney, PLLC. She may be reached at 859.255.8581, or jdittert@sturgillturner.com. This article is intended to be a summary of state and/or federal law and does not constitute legal advice.