HHS releases proposal to overhaul patient privacy rules for addiction treatment

The Department of Health and Human Services (HHS) announced proposed changes late last week to the federal regulations governing the confidentiality of patient records created by federally-assisted substance use disorder treatment programs, known as 42 CFR Part 2.

Drafted in 1975, 42 CFR Part 2 was designed to protect patient records created by federally-assisted programs for the treatment of SUD from the stigma associated with substance abuse that often deters patients from seeking treatment. However, in light of the current opioid crisis, the original protections have created significant clinical and safety challenges for providers.

What changes

The proposed rule modifies several sections of 42 CFR Part 2 to encourage care coordination among providers, including updating the definition of what constitutes a Part 2 record and its applicability. This is designed to give providers clarity about what is, or should be, protected by Part 2 and to ensure non-Part 2 providers are not discouraged from caring for SUD patients or recording SUD information due to onerous legal requirements.

The rule also clarifies that personal devices not used by a Part 2 program in the regular course of business do not have to be sanitized (i.e. record deletion) because an SUD patient sends an incidental message to their physician’s personal device.

Non-Part 2 providers under this rule will now have access to central registries to determine if a patient is enrolled in an Opioid Treatment Program (OTP) and receiving medications as part of SUD treatment to ensure at-risk patients are not accidentally overprescribed or given prescriptions for which they are seeking treatment.

“The lack of critical substance use history in a patient’s medical record can lead to potentially damaging consequences for a person with a substance use disorder and can further stigmatize these conditions,” said HHS Assistant Secretary Elinore F. McCance-Katz. “This rule aims to ease the sharing of information, reduce burden for providers, and increase access to care for individuals while at the same time maintaining important privacy controls.”

What does not change

The basic framework for confidentiality protection of SUD patient records created by federally-assisted treatment programs will not be altered under the proposed rule. Further, 42 CFR Part 2 will continue to prohibit law enforcement use of SUD patient records in criminal prosecution against the patient, and will also continue to restrict the disclosure of SUD treatment records without patient consent unless an exception applies.

For help deciphering what these proposed changes mean to your practice, contact the HIPAA experts at PrivaPlan.

Related Posts

What’s On Your Website?

The partnership combines PrivaPlan’s industry-leading guidance with Cyndelos’ AI technology to pinpoint website vulnerability and uphold website compliance.

Learn More +

Access PrivaPlan Toolkit

Access CMA-PrivaPlan Toolkit

Sign up for updates

Sign up. Learn about Compliance

Subscribe now for up-to-date information about privacy & security compliance! You’ll receive emails regarding news about compliance & alerts for new blog posts.