HHS Proposed Rule Seeks to Increase Care Coordination and Confidentiality for Patients With Substance Use Disorder

This blog is co-authored by Mindy Klowden and Greg Williams

On November 29, 2022, the U.S. Department of Health and Human Services (HHS) released a Notice of Proposed Rule Making (NPRM) to 42 CFR Part 2 (Part 2), the federal regulation governing sharing of patient health information when treatment for substance use disorders (SUD) is involved. The NPRM could have significant implications for a substantial number of Third Horizon Strategies’ projects and clients and the entire health care landscape.

Part 2 regulations were created to protect patient records surrounding the treatment of SUD or disclosing an individual’s history with alcohol and other drugs. The basis for this regulation pre-dates the Health Insurance Portability and Accountability Act of 1996 (HIPAA) by 21 years, centered on the prevention of potential discrimination of people with a SUD, and encouraging their willingness to accept help by promising privacy of their records. While well-intentioned at the time and still incredibly important to this day, much has changed with respect to both SUD care and the privacy of health records that creates a life-saving urgency to these proposed changes.

Since 1996, HIPAA has governed the sharing of patient health information for the rest of health care, including any information disclosed by a covered program that identifies an individual directly or indirectly as having a current or past drug or alcohol problem, or as a participant in a covered program. With limited exceptions, Part 2 requires patient consent in writing for disclosures of protected health information even for treatment, payment, or health care operations.

Over the last decade or so, there have been numerous attempts to align Part 2 more closely with HIPAA.  Proponents of Part 2 reform have argued that HIPAA requires an appropriate level of consent, while Part 2 restrictions have impeded efforts to coordinate care across health care settings and integrate behavioral health and primary care. Advocates of maintaining Part 2 have countered that the rule was created to reduce stigma and fear of legal repercussions for patients seeking treatment, particularly when illicit drugs are involved.

As SUD care has expanded beyond siloed rehabilitation centers into emergency departments, primary care, community mental health centers, federally qualified health centers, and specialty medicine, one of the more complicated aspects of Part 2 operationally has been that some providers have been forced to segment patient information in their electronic health records (EHRs). It has also been challenging for providers to determine who is subject to Part 2 regulations and who is not. For example, many community behavioral health providers offer both mental health and SUD treatment. While they have wanted to participate in health information exchange (HIE), even if a signed patient consent has been obtained, Part 2 prohibits redisclosure, thus precluding community behavioral health providers from pushing certain information up to regional HIEs. Another example sits with large health systems and hospitals who increasingly are trying to close the long-standing SUD treatment gap, but SUD is not their only or primary health service, leaving their information technology, compliance, and risk departments in the difficult position of having to determine if Part 2 applies to them or not, and if it does, how to segment records in their EHRs for individuals.

In 2020, HHS made some changes to Part 2 such as allowing an SUD patient to consent to disclosing their Part 2 treatment records to an entity (e.g., Kaiser Permanente), without naming a specific person as the recipient for the disclosure and enabling the sharing of information without patient consent in a medical emergency created by natural disaster. However, the modernization efforts fell short of aligning with HIPAA.

The new NPRM would implement provisions of Section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) that, among other things, require HHS to bring Part 2 into greater alignment with certain aspects of HIPAA. Specific changes include:

• Permitted use and disclosure of Part 2 records based on a single patient consent given once for all future uses and disclosures for treatment, payment, and health care operations
• Permitted redisclosure of Part 2 records in any manner permitted by the HIPAA Privacy Rule, with certain exceptions
• New patient rights under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule
• Expanded prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings
• New HHS enforcement authority, including the imposition of civil money penalties for violations of Part 2
• Updated breach notification requirements to HHS and affected patients
• Updated HIPAA Privacy Rule Notice of Privacy Practices requirements to address uses and disclosures of Part 2 records and individual rights with respect to those records

We believe NPRM changes are responsive to an evolving health care environment and take important steps to reduce fragmentation and support improved care coordination across a broad continuum of care, allowing for further patient-centered alternative payment models to take shape and advance SUD care. Varying confidentiality requirements can impede people with SUD from getting the care they need, which may involve treatment for an array of serious issues such as heart disease, liver or kidney failure, or other chronic conditions such as hypertension or diabetes. To effectively address these comorbidities, health professionals need a complete picture of the patient’s health and history, including the existence of SUD and treatment needs.

The changes are also needed to facilitate the electronic exchange of SUD information for treatment and other legitimate health care purposes, such as patient safety and continuous quality improvement. As many regional HIEs have been established and are helping to ensure community providers and hospitals can coordinate care and prevent unnecessary emergency department utilization or hospital readmissions, behavioral health providers are behind their primary care counterparts in participation.

Public comments on the NPRM are due January 31, 2023. Patients with SUD deserve a better-coordinated health care delivery system and we believe that HIPAA provides adequate and necessary privacy protections for individual health information. We believe the proposed rule addresses the concerns of non-health professionals (e.g., criminal justice, foster care, law enforcement, housing authorities, etc.) accessing these records to prevent potential unintended discrimination through inappropriate disclosures.