New HHS rule would harmonise substance abuse privacy rule, HIPAA
The US Department of Health and Human Services issued a new proposed rule Monday that would change how privacy protections for people with substance abuse disorders interact with HIPAA information sharing rules. Spurred by a provision of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) that passed in 2020, one effect of the rule could be to prevent situations where a person with a history of substance abuse is prescribed opioids by unknowing healthcare providers.
Currently, in the US, privacy around substance abuse treatment records is governed by a regulation called 42 CFR Part 2, which protects “records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance abuse education prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States.”
Part 2 was designed, way back in 1972, to encourage people to seek treatment for substance abuse disorders by assuring their privacy to curtail the possible social and economic consequences associated with drug addiction. But over the years, especially in light of the opioid crisis, the strict nature of the law has created problems for providers who need to know about patients' histories to treat them appropriately.
The Substance Abuse and Mental Health Services Administration (SAMHSA) has updated Part 2 twice in recent years to make voluntary patient disclosure of treatment records easier — once in 2018, and again in 2020.
Changes in the latest proposed rule include the following:
- Enables patients to consent a single time to all future uses and disclosures, rather than having to consent each time records are shared
- Allows re-disclosure in most of the same circumstances in which it is allowed by HIPAA for other medical information
- Grants patients a right to obtain an accounting of disclosures and a right to restrict disclosures
- Expands protections against use and disclosure of records in non-healthcare settings, i.e. civil, criminal, administrative, and legislative proceedings
- Gives HHS enforcement authority to levy fines for Part 2 violations
- Requires HHS to inform patients about breaches of the policy
“Varying requirements of privacy laws can slow treatment, inhibit care, and perpetuate negative stereotypes about people facing substance use challenges,” HHS Secretary Xavier Becerra said in a statement. “This proposed rule would improve coordination of care for patients receiving treatment while strengthening critical privacy protections to help ensure individuals do not forego life-saving care due to concerns about records disclosure.”
The rule is only a proposed rule as of now, and HHS is accepting public comments for the next 60 days on the Federal Register.
