HHS Proposes New Rule to Align 42 CFR Part 2 With HIPAA

In a new Notice of Proposed Rulemaking (NPRM), the HHS Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA) proposed updates to the Confidentiality of Substance Use Disorder (SUD) Patient Records under 42 CFR Part 2.

Part 2 safeguards patient privacy specifically relating to SUD treatment records. The proposed changes are aimed at better aligning Part 2 with HIPAA, as required by Section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act).

Ideally, the changes will improve care coordination, ease patient privacy concerns, and break down barriers to information sharing by easing compliance complexities and providing patients with additional rights.

Specifically, HHS proposed updated breach notification requirements, new HHS enforcement authority when it comes to Part 2 violations, and expanded patient rights surrounding permitted uses and disclosures, among other provisions.

“HHS understands how critical it is for patients to better align the Part 2 rules and program with HIPAA,” explained OCR Director Melanie Fontes Rainer.

“This proposed rule helps decrease burdens on patients and providers, improves coordination and increases access to care and treatment, while protecting confidentiality of treatment records.”

The NPRM also proposes to alter the Part 2 confidentiality notice requirements to line up with the HIPAA Notice of Privacy Practices and “[m]odify the HIPAA Notice of Privacy Practices requirements for covered entities who receive or maintain Part 2 records to include a provision limiting redisclosure of Part 2 records for legal proceedings according to the Part 2 standards,” HHS explained.

Additionally, the NPRM proposes giving patients more agency over their privacy by giving patients the right to an accounting of disclosures and the right to request restrictions on disclosures for payment, treatment, and operations.

“Varying requirements of privacy laws can slow treatment, inhibit care, and perpetuate negative stereotypes about people facing substance use challenges,” HHS Secretary Xavier Becerra stated.

“This proposed rule would improve coordination of care for patients receiving treatment while strengthening critical privacy protections to help ensure individuals do not forego life-saving care due to concerns about records disclosure.”

The public is welcome to submit comments on the NPRM within 60 days after its publication in the Federal Register.