Cares Act – Significant Revisions To Part 2: Aligning The Confidentiality Protections Of Substance Use Disorder Records With HIPAA

The Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”; Pub. L. 116-136) signed into law on March 27, 2020 contained significant revisions to Part 2—the industry moniker for the federal law protecting the confidentiality of substance use disorder records held by certain providers.

The addition of these changes may seem out-of-place in the stimulus bill, but this strategy is not unprecedented. Congress similarly amended the Health Insurance Portability and Accountability Act (“HIPAA”) in the last major stimulus legislation—the American Reinvestment and Recovery Act of 2009, from which the HITECH Act is derived. These stimulus bills can be subject to less scrutiny, so are sometimes used to push through desired but controversial legislation such as the the Part 2 changes. 

The discussion around updating the Part 2 statute was largely due to the recent opioid epidemic. The need for updating was far from the consensus—patient advocates have generally resisted the relaxation of the notoriously stringent privacy protections afforded under the law. Providers, however, found the more stringent protections unnecessarily burdensome and claimed the restrictions have hindered effective coordination of patient care. 

The implementing regulations, 42 CFR 2.1 et seq., have undergone several updates since 2017. As recently as mid-2019, the Substance Abuse and Mental Health Services Administration (or “SAMHSA”) published a proposed rule updating Part 2 and in doing so, reminded the industry of its position that the agency was restricted in how far its regulatory updates could go because of statutory limitation. For that reason, there was a push to pass legislation relaxing the underlying statute. Furthermore, those closely following potential changes to the Part 2 statute will recognize the Part 2 revisions added to the CARES Act because a substantial portion had been introduced in prior legislative attempts in both the House and the Senate. 

Those who work with HIPAA will be accustomed to following many of the new rules passed in the CARES Act as the Part 2 statute now largely aligns with HIPAA. The most significant changes include:

• Disclosure with Patient Consent: With the patient’s consent, a substance use disorder record may be used and disclosed for treatment, payment and health care operations of the disclosing facility in accordance with HIPAA, and redisclosed by the recipient for such purposes as well. These uses and disclosures may continue unless and until the patient revokes his or her consent. It appears this is Congress’s attempt to retain some of the desired restrictions on disclosures without a patient’s consent while permitting better care coordination. 

Both HIPAA’s accounting of disclosures and restriction on certain disclosures will apply to Part 2 records disclosed under this new consent-related disclosure and in some ways will be more stringent than HIPAA. 

• Breach Notification: The breach notification provisions of HIPAA will apply to Part 2 protected records. While Part 2 currently does not have a breach notification requirement, many Part 2 providers were also covered by HIPAA and so such breaches would have been reportable under HIPAA regardless of a separate Part 2 requirement.
• Notice of Privacy Practices: The CARES Act directs the Department of Health and Human Services (“HHS”) to update HIPAA regulations related to the Notice of Privacy Practices (“Notice”). The revised regulations must require a HIPAA covered entity holding Part 2 records to disclose in its Notice how such records are protected. Part 2 requires Part 2 programs to provide a summary of Part 2’s protections, but this portion of the CARES Act will extend beyond Part 2 programs.
• Civil and Criminal Penalties: The civil and criminal penalties applicable to HIPAA violations now apply to Part 2 violations as well. Note that previously Part 2 was only a criminal statute. This change expands the scope of enforcement available to HHS. 

• Anti-Discrimination: The revisions include an entirely new provision protecting individuals who are the subject of substance use disorder records. The inclusion of such an anti-discrimination provision may be to settle fears of those who did not want to see a relaxation of Part 2, as there may be a stigma against those who seek treatment for such disorders. The protections extend beyond providers; they prohibit discrimination in health care treatment and also certain employment, housing, court access and social services contexts. 

This much anticipated alignment of Part 2 with HIPAA may be viewed by many as relieving a compliance burden. However, we will have to wait again for the implementation date of these changes and future regulations that will undoubtedly add details. The CARES Act states that the amendments apply to disclosures of substance use disorder records 12 months after the date of its enactment. It also directs HHS, under which SAMHSA falls, to revise regulations in that same one-year time period. Over the next year, and with the additional regulatory guidance, providers can implement changes to better coordinate the health care of patients who suffer from substance use disorders.