Proposed SAMHSA Updates Align 42 CFR Part 2 with HIPAA Rules

On November 28, 2022, the Substance Abuse and Mental Health Services Administration (SAMHSA) released a Notice of Proposed Rulemaking in collaboration with HHS through OCR. This proposal is designed to update the confidentiality of patient records regarding substance use disorders (SUD).

The SAMHSA “42 CFR Part 2” addresses the opioid crisis by helping people feel more comfortable seeking treatment for SUD. Unfortunately, conditions related to substance abuse, mental health, etc., carry stigmas that can damage relationships, reputations, and more. Part 2 aims to protect SUD records to ease patient concerns about discrimination and prosecution.

The CARES Act requires the Secretary to align certain aspects of Part 2 with (HIPAA) Rules and the HITECH Act. Additionally, the Secretary must update the HIPAA Privacy Rule Notice of Privacy Practices requirements with Part 2 protections and rights. The updates posted in this Notice of Proposed Rulemaking fulfill these obligations.

KEY TAKEAWAYS

The SAMHSA Notice of Proposed Rulemaking enhances protections and rights for SUD patients. While all of these updates seek to standardize SUD record protections per
HIPAA Rules, we’ve split the key takeaways into 3 sections.

ENHANCEMENTS TO PATIENT RIGHTS AND PROTECTIONS

Part 2 programs are “federally assisted organizations that provide alcohol or drug abuse diagnosis, treatment or referral for treatment.” The SAMHSA Notice of Proposed Rulemaking adjusts how these programs must handle SUD records and authorizations.

If this passes into law unchanged, the following changes will take effect:

Part 2 programs may use a single patient-signed prior consent form for future use and disclosure for treatment, payment, etc. This will reduce the administrative legwork of releasing SUD records for healthcare staff and speed up the patient care process.

Improved Process Supports Patients Filing Part 2 Complaints.

Part 2 programs may not require patients to waive the right to file a complaint before providing treatment, enrollment, payment, or eligibility for services. These programs must establish a complaint receival process, and they may not take adverse action against patients who file complaints.

Enhanced Individual Patient Rights Align With the Privacy Rule.

Patients will receive the right to request an accounting of disclosures for SUD records.

Need help keeping up with your accounting of disclosures? Click here to learn how our Automated Audit Log can help at https://www.chartrequest.com/release-of-information-plans

Patients will also gain the ability to request disclosure restrictions for treatment, payment, and healthcare operations. This grants patients more control over their SUD records if they have reason to limit disclosures.

DIRECT HIPAA ALIGNMENTS

The breach Notification Rule Will Apply to Part 2 Records.

The Breach Notification Rule requires notification to the Secretary, the affected individual(s), and sometimes the media. If passed, Part 2 records will apply.

The HITECH Act Penalties Will Apply to Part 2 Records.

The HITECH Act cemented a tier-based penalty structure for HIPAA violations. If passed, this update will impose this penalty structure following violations of Part 2 regulations.

Patient Notice Will be Updated Per HIPAA

The existing Part 2 confidentiality notice requirements will be updated to align with the HIPAA Notice of Privacy Practices. This requires accessible language and a clear description of patient rights, protections, etc.

SUD RECORD UPDATES FOR LEGAL PROCEEDINGS

Permit Court Order Applications for Part 2 Use and Disclosure

Investigative agencies that unknowingly receive Part 2 records while investigating or prosecuting a Part 2 program can apply for a court order to use or disclose these records if certain preconditions are met.

Limit Redisclosure for Legal Proceedings

The Notice of Privacy Practices for Part 2 records will begin to limit the redisclosure of these records for legal proceedings.

Expand Use and Disclosure Prohibitions

Federal, state, and local authorities will face additional prohibitions for the use and disclosure of part 2 records without a court order or patient consent. This applies to civil, criminal, administrative, and legislative proceedings.

WHAT SHOULD YOU DO NOW?

Until the government passes the Notice of Proposed Rulemaking, current Part 2 regulations will remain in effect. If you would like to dig deeper into the NPRM, click here to review the notice as a whole.

If you would like to leave comments about the Notice, visit regulations.gov for HHS review.