— Proposal also aims to impose criminal penalties for Part 2 violations
Shannon Firth, Washington Correspondent, MedPage Today
November 28, 2022
HHS proposed Monday changes to “Part 2”, to better align privacy and HIPAA measures in an effort to coordinate care for patients with substance abuse disorder (SUD).
If implemented, the Proposed rule Part 2 programs would be able to access and share patient records after a signed consent from the patient. This consent could be used for all future uses and disclosures of treatment, payment, or healthcare operations.
This proposal also seeks to improve protections regarding disclosure of SUD treatment record records in order to protect against discrimination or stigma.
Initial calls for the changes were made in the CARES Act of 2020The HHS secretary was required to align the 42 CFR Part 2 rule, also known as “Part 2”, with HIPAA’s Privacy, Security, Breach Notification and Enforcement Rules.
HHS Secretary Xavier Becerra said in a statement that “this proposed rule would improve the coordination of care to patients receiving treatment while strengthening crucial privacy protections, to help ensure individuals don’t forego lifesaving care due to concerns over records disclosure.” Press release.
Becerra also pointed out that different privacy laws can cause delays in treatment as well as “negative stereotypes” about substance abusers.
Part 2 confidentiality protections are designed to reduce patients’ fear of being discriminated against or prosecuted, and to prevent them from seeking out help for an SUD. HHS Fact Sheet.
The Part 2 policy is designed to protect records that “identify, diagnose, prognosis or treat any patient”. This includes programs that involve SUD education prevention, treatment, rehabilitation or research. It can also be used to safeguard records that relate to the treatment or monitoring of any U.S. government agency or department.
But, these protections may have unintended consequences.
Dustin McKee, Director of Policy for the National Alliance on Mental Illness of Ohio, stated at a House hearing in 2018 that the Part 2 rules meant that the doctors who prescribed opioids Brandon Johnathan McKee weren’t aware of his struggle with substance abuse.
McKee stated that McKee had said, “They gave an unloaded gun to someone who’s suicidal.”
The HIPAA Notice on Privacy Practices would be updated to reflect the new Part 2 confidentiality notice requirements. This rule would allow for “redistribution” of Part 2 records, in compliance with the HIPAA privacy Rule, by recipients of Part 2 programs, HIPAA covered entities, and business partners, except in certain situations.
This rule will also make it more difficult to “use or divulge” Part 2 records in civil, criminal, administrative or legislative proceedings that are being conducted by a federal or state authority against a person.
Other measures included in the rule proposal include:
- Part 2 establishes patients’ rights that mirror the HIPAA Privacy Rules, including the “right of an accounting of disclosures” as well as the “rights to request restrictions on disclosures related to treatment, payment and healthcare operations.
- Requirement for Part 2 programs to create a complaints procedure for rule violations
- Part 2 programs are prohibited from taking “adverse actions” against patients who file complaints
- Criminal and civil penalties for violating Part 2 of the HIPAA or HITECH Act are extended
- Part 2 programs are prohibited from issuing waivers in order to stop patients from filing complaints.
- To detect records breaches by Part 2 programs, apply the standards of the HITECH Act or the HIPAA Breach Notification Rule
The proposed rule would also modify HIPAA Notice of Privacy practices requirements for “covered entities”, receiving or maintaining Part 2 documents to establish a provision which would limit redisclosure of data, in line with Part 2 requirements. This rule will allow investigative agencies to “use and disclose” Part 2 documents if they obtain a court order from the court after having received “unknowingly” such records.[d] Part 2 records are used to investigate or prosecute a Part 2 programme, provided certain preconditions have been met.
Comments on the proposed rule must be submitted by January 30, 2023.
Since 2014, Shannon Firth is the Washington correspondent for MedPage Today. She has been covering health policy since then. She is also a member of the site’s Enterprise & Investigative Reporting team. Follow