The proposed rule would wash this near-total restriction on redisclosure away, replacing it with a single signed patient consent for all future uses and disclosures for treatment, payment, and healthcare operations.
The HIPAA Privacy Rule permits a covered entity to use or disclose protected health information for these purposes, without written patient authorization (a provider may obtain consent, which may be in writing, but does not have to). Under the proposed new rule, a 42 CFR Part 2 provider may use or disclose Part 2-protected information in any manner the Privacy Rule already permits.
The only difference between the proposed 42 CFR Part 2 sharing rule for treatment, payment, and healthcare operations, and the equivalent HIPAA Privacy Rule provision, is that Part 2 requires the provider to obtain signed consent.
So that providers remain mindful of their redisclosure obligations, the proposed rule updates the HIPAA Privacy Rule Notice of Privacy Practices requirements to address uses and disclosures of Part 2 records and individual rights with respect to those records.
42 CFR Part 2 and HIPAA Care Coordination: What’s In It for Patients?
HHS’ proposed “42 CFR Part 2 and HIPAA care coordination” rule creates new patient rights to ensure that providers honor their obligations under the expanded redisclosure rule.
These new rights include:
- New patient rights under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule
- Expanded prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings
- New HHS enforcement authority, including the imposition of civil money penalties for violations of Part 2
- Updated breach notification requirements to HHS and affected patients
The proposed 42 CFR Part 2 and HIPAA care coordination rule also imposes new obligations on Part 2 program providers. It requires Part 2 programs to develop a complaints process for rule violations and prohibits Part 2 programs from taking adverse action (e.g., retaliation) against patients who file complaints. In addition, the proposed rule bans Part 2 programs from issuing waivers to prevent patients from filing complaints as a condition of receiving treatment.
These new patient rights and provider responsibilities are meant to mirror those rights and responsibilities contained in the HIPAA Privacy Rule and Breach Notification Rule.
42 CFR Part 2 and HIPAA Care Coordination: Speak Now…
HHS encourages all stakeholders, including patients and their families, health insurance issuers, health care providers, health care professional associations, consumer advocates, and state and local government entities, to submit comments on the proposed rule through regulations.gov. Public comments must be mad