For nearly 50 years, 42 CFR Part 2 (Part 2) provided an additional layer of confidentiality protections to patient records for people receiving substance use disorder (SUD) treatment, a cornerstone of effective SUD treatment. Due to the widespread stigma and criminalization of SUD, without privacy protections, patients are right to fear that information about past and current drug use could be accessed and used against them by police, a landlord, employer, judge, or social worker. In fact, Part 2 was created with the explicit intent to help protect patients from the deeply-rooted social stigma and ensuing legal action, which endure in SUD status and treatment.
Part 2 assured these protections by requiring a patient’s written consent prior to disclosure of protected records. These records must be written and include specific information about the records to be shared, to whom they will be shared, and for how long. Upon release by patient consent, the records must be accompanied by a notice prohibiting re-disclosure. Part 2 also required the use of a special court order before the records could be shared with law enforcement and associated entities.
However, under pressure from health care providers, the Coronavirus Aid, Relief, and Economic Security (CARES) Act directed the U.S. Department of Health and Human Services (HHS) to amend Part 2 to align it with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, which it did in proposed rulemaking.
The Addiction and Public Policy Initiative at the O’Neill Institute submitted public comments to HHS in response to the December 2, 2022 Notice of Proposed Rulemaking (NPRM)’s proposed modifications to 42 CFR Part 2.
Background
Created in 1996, HIPAA is a federal law that requires the creation of national standards to protect sensitive patient health information (PHI) from being disclosed without the patient’s consent or knowledge.
The regulations under HIPAA and Part 2, while both developed to protect patient information, affect different categories of records. Part 2 only protects SUD treatment records from certain types of federally assisted “Part 2 programs.” Conversely, HIPAA applies to many types of patient information, not just SUD information, and is generally less protective of patient privacy than Part 2 is.
Both protect patient privacy by regulating the ways in which patient information can be shared and disclosed. Unlike HIPAA, however, the privacy protections codified by Part 2 follow the records even after disclosure, prohibiting re-disclosure.
We strongly support Part 2’s core confidentiality protections. It is more important than ever to understand and protect patients’ privacy rights, as the privacy protections increasingly come under attack.
Why We Commented
By aligning Part 2 with the less-stringent HIPAA regulations, we are concerned that the proposed changes would infringe upon patient privacy rights, compromise the confidentiality of SUD records, and effectively place people seeking SUD treatment in a position in which they must decide between the risk of their records falling into the wrong hands and receiving necessary healthcare. Further, a number of the NPRM’s proposed modifications went beyond this congressional intent to allow for more relaxed sharing of Part 2 records once disclosed.
As drafted, adoption of the proposed regulations would not only compromise the privacy rights of people with SUD treatment records — putting them at risk of increased discrimination, stigma, and even prosecution — but will also have a chilling effect on people seeking treatment in the midst of a public health crisis of overdoses that are taking over 107,000 lives each year.
To safeguard access to treatment, improve treatment outcomes, and protect patients, we commented to advocate that the privacy protections central to Part 2 should be maintained.
Summary of Comments
While the NPRM did propose some needed changes to Part 2, including transferring the regulation’s enforcement to the HHS Office for Civil Rights (OCR) for more effective administrative oversight, we focused our comment on five areas of concern:
- Weakened patient privacy rights without implementing required anti-discrimination protections: In addition to the new health care privacy framework that aligns with HIPAA, the CARES Act requires new anti-discrimination protections for individuals in a variety of settings, including employment, housing, and healthcare. The concurrent implementation of anti-discrimination protections alongside the new privacy rules is critical to protect patient information, though the current rule does not implement them. While HHS indicates that it will propose the anti-discrimination provisions in a separate rulemaking, this delayed change creates a gap of unprotected time in which people with SUD treatment records will be subject to the sharing and use of their health information and status in a variety of settings without the proposed anti-discrimination protections. Recommendation: HHS should align implementation of the act’s anti-discrimination protections to take effect at the same time as this final rule, or delay the current proposed rulemaking until the anti-discrimination rulemaking is completed.
- Ensuring informed consent for use and disclosure of Part 2 records for treatment, payment, and healthcare operations with initial patient consent: This NPRM permits, but does not require, individuals to sign a single, written consent for all future uses and disclosures of SUD records for Treatment, Payment, and Healthcare Operations (TPO) purposes. Upon a patient’s signature of consent under this change, Part 2 programs, HIPAA covered entities, and business associates that receive patient records have authority to redisclose patient records (with some exceptions). This change will vastly expand the ways in which Part 2 records may be used and shared without the patient’s actual knowledge, including disclosures to third-parties who are not involved in the patient’s care. Recommendation: HHS should ensure informed consent by providing a standard form for use by Part 2 covered programs and require the notice to identify whether the patient’s records are subject to the new redisclosure permissions.
- Ensuring that “general consent” does not equate to “perpetual consent” for use and disclosure of Part 2 records: This NPRM permits the new general consent for TPO to last indefinitely, provided that the consent includes a statement that it will not expire. This NPRM requires a new consent only when the Part 2 provider changes in name, not in ownership. Consent forms without an expiration date or clear descriptions as to how and to whom a patient’s information will be shared limit the patient’s ability to meaningfully understand how their health information will be used for years to come. Furthermore, these changes are not required by the CARES Act, and as such, are unnecessarily included and unjustifiably burdensome. Recommendation: HHS should require the following: an expiration date and affirmative renewal of the new “general consent” form after a specific period of time; a new consent form to be signed upon ownership change of a Part 2 program; and Part 2 programs to designate a “privacy officer” responsible for questions, concerns, and implementation of Part 2.
- Disclosure and use of Part 2 records in a criminal investigation or prosecution: Under the proposed rule, investigative agencies can now access Part 2 records without a special court order. In addition to being outside of the scope of the CARES Act, this modification is a major departure from the established 40-year privacy standard that required a special court order to authorize the use or disclosure of SUD patient records in a criminal investigation or prosecution. Recommendation: HHS should maintain the current language, which requires investigative agencies to seek court authorization to use or disclose records implicated by Part 2 protections.
- Inclusion of a safe harbor provision shielding law enforcement from liability for improper use and disclosure of Part 2 records in a criminal investigation or prosecution: The NPRM proposes a safe harbor provision to limit civil or criminal liability for investigative agencies upon “unknowingly” receiving Part 2 records without first obtaining the requisite court order in the course of investigating or prosecuting a Part 2 program or person holding Part 2 records. Recommendation: HHS should not include a “safe harbor provision” for investigative agencies, as this is not required by the CARES Act.
We, at the Addiction and Public Policy Initiative, are grateful for the opportunity to submit our comments and hope that HHS will revise the proposed rule to ensure that the rights of those directly impacted by the rule will be afforded greater protections and safeguards.
