CARES Act Includes Substantial Revisions to the Federal Confidentiality of Substance Use Disorder Patient Records (42 C.F.R. Part 2)

On March 27, 2020, the U.S. Congress passed and the president signed an unprecedented $2 trillion stimulus package in response to the coronavirus pandemic (COVID-19), known as the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). Among the numerous provisions intended to address the COVID-19 pandemic are significant revisions to the federal regulations governing the Confidentiality of Substance Use Disorder Patient Records, under 42 U.S.C. § 290dd-2 and the corresponding regulations found at 42 CFR Part 2 (Part 2). These revisions more closely align Part 2 with the Privacy and Security Regulations under the Health Insurance Portability and Accountability Act (“HIPAA”) but also add heightened protections against use or disclosure of Part 2 records in legal or other proceedings, as well as imposing ground-breaking new anti-discrimination protections.

In most situations, Part 2 currently requires that patient consent or a valid court order be obtained prior to disclosure of Part 2 records.  The legislation would retain the consent requirement but now only requires initial patient consent before a Covered Entity, Business Associate, or Part 2 Program may use or disclose the Part 2 records for Treatment, Payment, and most Health Care Operations, as each of those terms is defined under HIPAA or Part 2. The legislation excludes from permissible Health Care Operations uses or disclosures for the creation of de-identified health information or a limited data set, and fundraising for the benefit of a Covered Entity. However, the legislation does permit the use or disclosure of de-identified information for certain public health purposes.

Currently, Part 2 imposes the same patient consent or court order requirement upon most disclosures of Part 2 records by a recipient of those records (a “Lawful Holder”) and applies those restrictions to downstream recipients of the data indefinitely. Under the new legislation, a recipient would be permitted to re-disclose the Part 2 records in accordance with HIPAA. Specifically, it will be permissible for a patient’s prior written consent to be given once for all future uses or disclosures for purposes of Treatment, Payment, and Health Care Operations, until the patient revokes such consent in writing. Each of the disclosures will be subject to the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”) accounting of disclosures requirements.

Currently, Part 2 prohibits the use of Part 2 records in criminal or civil proceedings without patient consent or a stringent court order protocol that imposes certain procedural requirements meant to address privacy concerns.  The legislation creates an even stronger set of protections and prohibitions which mandates that records may not be disclosed or used in any civil, criminal, administrative, or legislative proceeding conducted by any Federal, State, or local authority, against a patient, including that:

• The record or testimony shall not be entered into evidence in any criminal prosecution or civil action before a Federal or State court
• The record or testimony shall not form part of the record for decision or otherwise be taken into account in any proceeding before a Federal, State, or local agency
• The record or testimony shall not be used by any Federal, State, or local agency for a law enforcement purpose or to conduct any law enforcement investigation
• The record or testimony shall not be used in any application for a warrant

These protections are critical as disclosures to third parties would not necessarily fall under Treatment, Payment, or Health Care Operations.

The legislation introduces explicit protections against discrimination based upon Part 2 records or information about the patient disclosed under Part 2—either inadvertently or intentionally.  Specifically, no entity may discriminate against a patient about whom the Part 2 records relate in:

• Admission, access to, or treatment for health care
• Hiring, firing, or terms of employment, or receipt of worker’s compensation
• Sale, rental, or continued rental of housing
• Access to Federal, State, or local courts
• Access to, approval of, or maintenance of social services and benefits provided or funded by Federal, State, or local governments

Furthermore, no recipient of Federal funds may discriminate against the patient based upon the Part 2 records in affording access to the services provided with such funds.
The HIPAA Breach Notification Rule is now directly applicable to Part 2 programs, regardless of whether they are considered Covered Entities.

Part 2 has historically been enforced criminally by the U.S. Attorney.  The legislation modifies the penalties, moving the penalties from Title 18 of the U.S. Code to sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d–5 and 42 U.S.C. 1320d–6), which are the penalties imposed for HIPAA violations.

The legislation includes “the sense of Congress”, aspirational goals, rules of construction, and interpretive guidance for the regulations which will need to be issued by the Substance Abuse and Mental Health Services Administration (“SAMHSA”).  Among the Congressional intent indicated is:

• No limit upon a patient’s right, under HIPAA, to request a restriction on the use or disclosure of a record (45 C.F.R. § 164.522)
• No restriction on a Covered Entity’s right, under HIPAA, to utilize the patient consent process (45 C.F.R. § 164.506)
• A simplified Notice of Privacy Practices
• The encouragement of Part 2 programs to access State Prescription Drug Monitoring Programs when clinically appropriate
• Incentives for Part 2 programs to explain the consent process and its benefits

These substantial modifications should allow for greater flow of information among and between health care providers and payors and further the goal of integrated care across behavioral health and medical health.  Data exchange for reimbursement, Health Information Exchanges (“HIEs”), Accountable Care Organizations (“ACOs”), and similar care models should benefit.  The addition of clear protections in criminal, civil, administrative, and legislative proceedings should be lauded by privacy advocates, along with brand new anti-discrimination protections.  Further, the ability of the patient to revoke consent to the flow of Part 2 records at any time grants unprecedented control to patients over their health information. However, care must be taken to identify the unique distinctions that remain between Part 2 and HIPAA, and professionals should carefully review the legislation and any proposed regulations in addition to State mental health and substance use disorder laws to ensure proper uses and disclosures of all health information.

Gerald (Jud) E. DeLoss, J.D., is the chief executive officer for the Illinois Association for Behavioral Health. He may be contacted at jud@ilabh.org.