Federal regulations at 42 CFR Part 2 (Part 2) protect patient records created by federally assisted programs for treatment of substance use disorders (SUDs). Part 2 generally requires a patient’s written consent before a Part 2 program provider can disclose patient records to another party.
Typically, when a patient consents to share Part 2 records, the recipient may only redisclose those records to a third party if the patient specifically consents to the redisclosure. Critics of Part 2’s redisclosure requirements maintain that the “no redisclosure” rule can deny patients life-saving care. What if, these critics say, information barred from redisclosure is needed by, say, a patient’s primary care physician who prescribes the patient medications that have harmful interactions with the substance to which a patient may be addicted?
HHS has responded to the criticism by issuing a Notice of Proposed Rulemaking (Proposed Rule) in November of 2022. The proposed rule updates Part 2 to allow Part 2 programs to use and share patients’ records following a single signed consent “for all future uses and disclosures for treatment, payment, and healthcare operations.” In other words, the proposed rule allows provider sharing of records in a similar manner to which HIPAA permits such sharing. More information about 42 CFR Part 2 and HIPAA care coordination is provided below.
42 CFR Part 2 and HIPAA Care Coordination: What’s in the Proposed Rule?
The proposed rule allowing for enhanced 42 CFR Part 2 and HIPAA care coordination permits Part 2 records to be redisclosed in any manner currently permitted by the HIPAA Privacy Rule, with certain exceptions. Per HHS Secretary Xavier Becerra, this change to Part 2 would “improve coordination of care for patients receiving treatment… To help ensure individuals do not forego life-saving care due to concerns about records disclosures.”
Lifting the existing re-disclosure rule allows for sharing of a significant amount of information that cannot currently be redisclosed.
Part 2 currently prevents re-disclosure of records that relate to “the identity, diagnosis, prognosis, or treatment of any patient” regarding programs that involve:
- SUD education;
- Prevention;
- Training;
- Treatment;
- rehabilitation;
- or research that are run or overseen directly or indirectly by any U.S. government department or agency.
The proposed rule would wash this near-total restriction on redisclosure away, replacing it with a single signed patient consent for all future uses and disclosures for treatment, payment, and healthcare operations.
The HIPAA Privacy Rule permits a covered entity to use or disclose protected health information for these purposes, without written patient authorization (a provider may obtain consent, which may be in writing, but does not have to). Under the proposed new rule, a 42 CFR Part 2 provider may use or disclose Part 2-protected information in any manner the Privacy Rule already permits.
The only difference between the proposed 42 CFR Part 2 sharing rule for treatment, payment, and healthcare operations, and the equivalent HIPAA Privacy Rule provision, is that Part 2 requires the provider to obtain signed consent.
So that providers remain mindful of their redisclosure obligations, the proposed rule updates the HIPAA Privacy Rule Notice of Privacy Practices requirements to address uses and disclosures of Part 2 records and individual rights with respect to those records.
42 CFR Part 2 and HIPAA Care Coordination: What’s In It for Patients?
HHS’ proposed “42 CFR Part 2 and HIPAA care coordination” rule creates new patient rights to ensure that providers honor their obligations under the expanded redisclosure rule.
These new rights include:
- New patient rights under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule
- Expanded prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings
- New HHS enforcement authority, including the imposition of civil money penalties for violations of Part 2
- Updated breach notification requirements to HHS and affected patients
The proposed 42 CFR Part 2 and HIPAA care coordination rule also imposes new obligations on Part 2 program providers. It requires Part 2 programs to develop a complaints process for rule violations and prohibits Part 2 programs from taking adverse action (e.g., retaliation) against patients who file complaints. In addition, the proposed rule bans Part 2 programs from issuing waivers to prevent patients from filing complaints as a condition of receiving treatment.
These new patient rights and provider responsibilities are meant to mirror those rights and responsibilities contained in the HIPAA Privacy Rule and Breach Notification Rule.
42 CFR Part 2 and HIPAA Care Coordination: Speak Now…
HHS encourages all stakeholders, including patients and their families, health insurance issuers, health care providers, health care professional associations, consumer advocates, and state and local government entities, to submit comments on the proposed rule through regulations.gov. Public comments must be made within 60 days after publication of the NPRM. The NRPM was published on November 28, 2022; public comments may be made until January 30, 2023.
