In November 2022, the U.S. Department of Health and Human Services (HHS) announced new changes to the rule known as 42 CFR Part 2.
Originally drafted in 1972, Part 2 aims to protect the confidentiality of addiction treatment records, which could shield clients from bias related to substance use disorder (SUD). This is meant to encourage individuals with SUDs to seek treatment without fear of discrimination or prosecution from healthcare providers, law enforcement, and other individuals or agencies.
Part 2 applies to client records created by federally assisted SUD treatment programs. Such records include “identity, diagnosis, prognosis, or treatment” related to “the performance of any program or activity relating to substance abuse education prevention, training, treatment, rehabilitation, or research.”
Under this rule, law enforcement cannot use the records of SUD clients in criminal prosecutions against those clients without a court order. Part 2 also restricts the disclosure of SUD treatment records without client consent.
What might change about 42 CFR Part 2?
HHS announced proposed changes to Part 2 through the Office for Civil Rights (OCR) and working with the Substance Abuse and Mental Health Services Administration (SAMHSA).
Under the 2020 CARES Act, certain parts of Part 2 must be better aligned with HIPAA and the HITECH Act. Right now, Part 2 protections for SUD treatment records differ from the HIPAA privacy rule. This creates regulatory conflicts and makes it difficult to remain compliant, which could threaten information sharing among clients and providers.
The full Notice of Proposed Rulemaking (NPRM) includes a list of changes to better coordinate these regulations. These changes include:
- Part 2 programs would be allowed to use and disclose Part 2 records based on a single prior consent signed by the client for all future uses and disclosures
- Redisclosing Part 2 records would follow HIPAA rules
- Prohibition of Part 2 records in legal proceedings, without a court order or the client’s consent, would be expanded
- Creation of two patient rights under Part 2 that align with HIPAA: the “right to an accounting of disclosures,” and the “right to request restrictions on disclosures for treatment, payment, and health care operations”
- Civil and criminal penalties of HIPAA and HITECH would be applied to Part 2 violations
- HIPAA and HITECH breach notification rules would apply to Part 2 programs
- Part 2 programs would be required to create a process for receiving complaints of Part 2 violations, and prohibiting these programs from taking adverse action against clients if they file such complaints
- Part 2 programs will be prohibited from requiring patients to waive the right to file a complaint
- Modify Part 2 patient notices to align with HIPAA Notice of Privacy Practices
When are these changes taking place?
So far, HHS has only issued the NPRM, which has a comment period that ends on January 21, 2023. That means that current Part 2 regulations are still in effect for now.
Any stakeholders can submit comments on the full NPRM through regulations.gov. These include SUD clients and their families, payers, clinicians, professional healthcare associations, consumer advocates, and government entities.
Having trouble keeping up with regulatory changes to addiction treatment services? BestNotes EHR solutions help you streamline your practice, providing automatic updates so you can stay profitable and compliant while saving time and reducing stress. Contact us today to ask questions or schedule your free demo!