Impact of Revised Substance Use Disorder Privacy Rules on Stakeholders
TL/DR –
The Department of Health and Human Services (HHS) has issued a rule to bring the Confidentiality of Substance Use Disorder Patient Records regulations in line with the Health Insurance Portability and Accountability Act (HIPAA) privacy rule. Under the new rule, federally assisted providers that offer substance use disorder (SUD) services must obtain patient consent before disclosing information for treatment, payment, and health care operations. The rule aims to improve care coordination for patients seeking or undergoing SUD treatment, address patient privacy concerns, and simplify information sharing by easing compliance complexity and providing patients with additional rights.
Updated Federal Substance Use Disorder (SUD) Privacy Statute: Key Takeaways
Last week, the Department of Health and Human Services (HHS) issued a final rule to align the Confidentiality of Substance Use Disorder Patient Records regulations under 42 CFR Part 2 with the Health Insurance Portability and Accountability Act (HIPAA) privacy rule. These changes facilitate improved care coordination for patients undergoing SUD treatment and simplify regulatory compliance while enhancing patient rights.
The rule specifically impacts a limited class of SUD providers, known as Part 2 programs. Contrary to HIPAA’s lenient disclosures, the final rule requires that these programs obtain patient consent prior to disclosing Part 2 information. However, the rule also modifies how such consent can be obtained, leading to significant implications for various healthcare system players.
Implications for Part 2 Programs
The new rule introduces civil and criminal penalties under HIPAA and the Health Information Technology for Economic and Clinical Health (HITECH) Act for Part 2 violations. It also imposes new obligations exceeding HIPAA requirements on Part 2 programs, like revising privacy practices to comply by February 2026. This could result in these programs sharing information more frequently due to increased flexibility around consent.
Returns for Electronic Health Record (EHR) Vendors and Health Information Exchanges (HIEs)
EHR system designers and HIEs will benefit from this rule’s simplified consent provisions, enabling the use of a single consent form for future disclosures. This mitigates operational difficulties stemming from Part 2 consent requirements. The rule redefines “intermediary” to exclude business associates and covered entities, typically not applying additional limitations on HIEs and EHR vendors.
Effects on Recipients of Part 2 Information
Health plans and providers exchanging information with Part 2 programs are significantly affected by the final rule, allowing them to redisclose Part 2 information in compliance with HIPAA. The rule exempts health plans from all Part 2 requirements for the Part 2 information they receive. It further eases administrative burdens by not needing to segregate Part 2 records from other data, but still demands a process for separating records for legal cases.
Patient Implications
As a result of the new rule, patients may find their information exchanged more frequently, potentially increasing comprehensive care from providers. The rule also maintains protections against using Part 2 data in legal proceedings against patients and grants rights like requesting an accounting of disclosures. However, these rights may take up to two years to get implemented.
—
Read More Health & Wellness News ; US News