Confidentiality of Substance Use Disorder (SUD) Patient Records. Notice of Proposed Rulemaking, 42 CFR Part 2 and 45 CFR Part 164. Federal Register, v.87, n.231, December 2, 2022, pp.74216-74287.
SUMMARY: The Department of Health and Human Services (HHS or ‘‘the Department’’) is issuing this notice of proposed rulemaking (NPRM) to solicit public comment on its proposal to modify its regulations to implement section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act. DATES: Comments due on or before January 31, 2023.
Background and Need for Proposed Rule. There are approximately 16,066 publicly funded SUD treatment facilities and 1.8 million HIPAA covered entities and business associates, with an unknown percentage of entities subject to both HIPAA and Part 2. Part 2 records often also meet the definition of PHI when maintained by HIPAA covered entities (or their business associates on the covered entities’ behalf). To ensure compliance with both sets of regulatory requirements, dually regulated entities subject to both Part 2 and the HIPAA Rules (i.e., covered entities that also are Part 2 programs) must track and segregate the records that are subject to Part 2 from the records that are subject only to the HIPAA Rules and obtain specific written consent for most uses and disclosures of Part 2 records (including uses and disclosures for non-emergency treatment purposes). The Department has been urged by many stakeholders to change Part 2 to eliminate the need for data segmentation. [74220] … To address these concerns, Congress enacted on March 27, 2020, the CARES Act, which requires the Department to promulgate regulations modifying the confidentiality requirements for Part 2 records. This rulemaking proposes modifications to 42 CFR part 2 and the Privacy Rule that are necessary to implement the statutory amendments made to 42 U.S.C. 290dd–2, and additional modifications to Part 2 to better align certain provisions of Part 2 to the Privacy Rule and address concerns about potential liability for government agencies in the course of investigating and prosecuting Part 2 programs under the new penalties and enforcement scheme. [74221]
Section 3221 of the Cares Act also requires the Secretary to update the HIPAA Privacy Rule Notice of Privacy Practices requirements to address Part 2 protections and individual rights. [Also, see HHS/OCR, Regulatory Initiatives, November 28, 2022, (Last Review). https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/index.html.]