by Lindsey Phillips with Burr & Forman, LLP
On November 28, 2022 the Office for Civil Rights (“OCR”) at the United States Department of Health and Human Services (“HHS”) announced proposed changes to the regulations at 42 CFR Part 2 (“Part 2”). Part 2 protects the confidentiality of medical records related to treatment for substance abuse disorders and was first promulgated in 1987 to address concerns that relaxed access to these types of records would promote fear of discrimination and deter individuals from seeking help and treatment for substance abuse disorders. While the rationale supporting Part 2 is good in theory, it has presented practical challenges for patients and healthcare providers alike because its protections and provisions often conflict those afforded by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and other medical record privacy laws.
The proposed changes, which are set out in the Notice of Proposed Rulemaking (“NPRM”), are part of a broader initiative to promote value-based care, enable better coordination among healthcare providers, facilitate patient autonomy and engagement, and protect the privacy of patients’ medical records. Upon announcement of the NPRM, Secretary Xavier Becerra noted that “varying requirements of privacy laws can slow treatment, inhibit care, and perpetuate negative stereotypes about people facing substance use challenges.” He went on to say that the changes proposed in the NPRM would “improve coordination of care for patients receiving treatment while strengthening critical privacy protections to help ensure individuals do not forego life-saving care due to concerns about records disclosure.” OCR’s Director expressed similar sentiments and further noted that the HHS “understands how critical it is for patients to better align the Part 2 rules and program with HIPAA” and that the changes would decrease the burdens on both patients and providers “while protecting confidentiality of treatment records.”
This article briefly identifies some of the proposed changes contained in the NPRM. The proposed changes are loosely separated into two categories. The first category outlines the proposed changes that appear to relax the current provisions found in Part 2; the second category outlines the proposed changes that purport to create protections and enforcement mechanisms for violations of Part 2.
Proposed Changes Relaxing Current Requirements Found in Part 2
- Permitting Part 2 programs to use and disclose Part 2 records based on a single prior consent signed by the patient for all future uses and disclosures for treatment, payment, and health care operations;
- Permitting the redisclosure of Part 2 records as permitted by the HIPAA Privacy Rule by recipients that are Part 2 programs, covered entities under HIPAA, and business associates under HIPAA; and
- Modifying the Part 2 confidentiality notice requirements to mirror those found in HIPAA.
Proposed Changes Creating Patient Protections and Enforcement Procedures
- Creating two patient rights that parallel those afforded to patients under HIPAA:
- The right to an accounting of disclosures, and
- The right to request restrictions on disclosures for treatment, payment, and health care operations;
- Requiring disclosures to the Secretary for enforcement;
- Applying HIPAA penalties to Part 2 violations;
- Requiring Part 2 programs to establish a process for receipt of complaints of Part 2 violations; and
- Prohibiting Part 2 programs from requiring patients to waive the right to file a complaint as a condition of eligibility and providing treatment
While HHS has stated that the proposed modifications will not only increase coordination among providers but also afford more protections for patients, the proposed changes do present some concerns and tensions among stakeholders. Accordingly, all stakeholders are encouraged to participate in the public comment and feedback process. Stakeholders have 60 days after the publication of the NPRM in the Federal Register to provide commentary. The NPRM was published in the Federal Register on December 2, 2022, so stakeholders have until January 31, 2023 to provide comments.
Lindsey Phillips is an associate at Burr & Forman LLP practicing exclusively in the firm’s Healthcare Industry Group. Lindsey may be reached by telephone at (205) 458-5370 or by e-mail at lphillips@burr.com.