HHS publishes proposed rule to align substance use disorder patient records with HIPAA privacy rules

Key Takeaways

On December 2, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and Substance Abuse and Mental Health Services Administration (SAMHSA) published a proposed rule to align 42 CFR Part 2, which protects the confidentiality of Substance Use Disorder (SUD) patient records with the Health Insurance Portability and Accountability Act (HIPAA) privacy rules. This proposed rule implements provisions in the Protecting Jessica Grubb’s Legacy Act (Legacy Act), which was passed through Section 3221 of the Coronavirus Aid, Relief and Economic Security Act (CARES Act) (P.L. 116-136) in 2020.

Under the CARES Act, the Legacy Act changes existing privacy regulations under 42 CFR Part 2 to stop the prescription of opioids to individuals in recovery and prevent other adverse events related to limitations on the use and disclosure of patient SUD treatment records that impede comprehensive and coordinated medical care. The proposed rule would simplify the process in which patients give consent to providers to release SUD treatment information and would allow healthcare providers more appropriate access to patient information that is essential for providing effective and safe care, while still protecting patient privacy.

Key provisions within the proposed rule include:

• Aligning the rules for 42 CFR Part 2 covered information consent with HIPAA by only requiring patients to provide consent once for an SUD record to be disclosed for treatment, payment and operations purposes and other purposes permitted under HIPAA
• Outlining that consent can be revoked at any time by a patient for the sharing of their 42 CFR Part 2 covered information
• Requiring 42 CFR Part 2 programs to follow HIPAA privacy and security breach notification requirements
• Implementing updated Notice of Privacy Practices requirements to account for the new 42 CFR Part 2 covered information consent, disclosure and revocation requirements
• Detailing how and when law enforcement can access a patient’s SUD 42 CFR Part 2 records and how those records are to be handled and proceedings continue if a patient’s records are inadvertently accessed
• Clarifying when and how a patient’s SUD data can be shared in a de-identified format
• Information on how 42 CFR Part 2 SUD data can be shared for public health activities

The proposed rule would help county health systems better address the nation’s behavioral health crisis as it will ensure that all members of a patient’s treatment team have access to a person’s history of substance use disorder, which will help improve care coordination and reduce stigma, while protecting individuals in treatment from discrimination.

The deadline to submit comments in response to the proposed rule is January 31, 2023.  NACo will continue to track when the final rule will be released and when compliance will begin to be enforced.

Additional Resources

• One Pager: Behavioral Health Matters to Counties
• NACo Policy Brief: Enhance Counties' Ability to Prevent and Treat Mental Illness and Substance Abuse Disorders
• NACo Blog: Nearly 150 county officials sign onto NACo’s behavioral health advocacy letter to Congress