On November 28, 2022, Health and Human Services/Office for Civil Rights (HHS/OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA) introduced proposed changes to confidentiality rules relating to 42 CFR Part 2 Programs (Part 2). This was done through a Notice of Proposed Rule Making (NPRM) and is in response to Section 3221 of the CARES Act which required HHS to bring Part 2 into closer alignment with existing HIPAA/HITECH rules. This is also in line with other initiatives by OCR including the Patient Access Initiative and various other proposals which have been under discussion for the last two to three years. This includes the 2022 request for information relating to the “recognized security framework” and how this might be implemented into any enforcement strategy, as well as discussions involving an increase in penalties. There is also a request for information and comment on whether or not those bringing HIPAA complaints to OCR’s attention should be entitled to a portion of any fines or penalties as damages.

In Iowa, there are state-based laws that provide greater privacy, confidentiality, or different processes for the release of information for a limited number of things such as mental health records, substance abuse records, and records relating to HIV/AIDS. However, Part 2 regulations are federal and relate to patients being treated for substance abuse in specific clinics which qualify under 42 CFR Part 2. Over the last decade, there have been significant changes in the rules regarding Part 2 and how information can be shared to improve continuity of care, emergency access, and to streamline a patient’s ability to access information or have that information sent to a third-party representative. HHS and state agencies have been understandably cautious about broadening such access too quickly or without clear direction given the highly confidential nature of substance abuse records, the real potential for significant damage if they are released to the wrong parties and the fact that decision-making capacity may be compromised for certain patients. Further, SAMHSA.gov has continued to shore up provisions against the use of this documentation in litigation or criminal prosecutions to encourage people to seek treatment. 

Note that the comment period is still open and public comments are due within 60 days after the publication of the Notice of Proposed Rule Making. More specific information may be accessed through HHS.gov, SAMHSA.gov, and the full text is at federalregister.gov. Proposed changes encompass the following:

• Improving the complaint process - This would require that programs develop a program for complaints, prohibits programs from taking adverse action against patients who bring a complaint, as well as prohibits any requirement for participation in a new program that waives “the right to file a complaint as a condition of providing treatment, enrollment, payment or eligibility for services.” It also adds health plans to the list of people who may receive records without consent.
• Requires Part 2 programs to comply with the notification of breach requirements currently existing under HITECH.
• For discontinued programs which currently have relatively onerous requirements about obtaining consent prior to the transfer of records to an alternate facility to clearly state that those provisions do not apply to patient transfers and certain other programs.
• Require modification of the facility’s confidential notice requirements to align with the requirements of HIPAA’s Notice of Privacy Practices (NPP). It would need to include complaint processes and procedures as well as other limited items. Note: some sample language for a Notice of Privacy Practices is included in the Notice of Proposed Ruel Making.
• Require that facilities keep an accounting of disclosures in compliance with HIPAA although there is some commentary as to how long such documentation may be required. This could result in changes to the proposed rule.
• Amend the consent requirements to allow that treatment, payment and operations can be based on “a single consent given once for all future use and disclosures” until this consent is revoked in writing by the patient or patient representative. This would create an evergreen consent absent revocation. This would also lessen the non-disclosure requirements for treatment, payment, and operational purposes.
• Further clarify and strengthen the prohibitions on utilization of records without patient consent in some circumstances, particularly in civil, criminal, administrative, and legislative proceedings. This requirement is likely to impact a variety of legal activities ranging from criminal prosecution to requests for information about substance abuse treatment in divorce or custody proceedings. Some of this is intended to take into account new forums which are being used in both civil and criminal justice systems and a heavier emphasis on administrative proceedings in certain areas.
• For the purpose of criminal investigation changes to the rules will also permit “investigative agencies” to request a court order to use or disclose Part 2 records if they have accidentally or knowingly received such records in the course of an investigation or a prosecution of a Part 2 Program. This is likely to lead to significant litigation questions about when a prosecutor or investigator may have received something “unknowingly.”
• Additionally, the changes create a right for patients to request restrictions on data for treatment, payment, and healthcare operations.