The U.S. Division of Well being and Human Companies (HHS) and the Substance Abuse and Psychological Well being Companies Administration (SAMHSA) not too long ago launched the lengthy anticipated Last Rule to revise the Confidentiality of Substance Use Dysfunction (SUD) Affected person Data rules at 42 C.F.R. Half 2 (Half 2).
In March 2020, the Coronavirus Assist, Aid, and Financial Safety (CARES) Act § 3221 referred to as for the alignment of sure Half 2 confidentiality protocols with HIPAA and HITECH Act necessities. The Last Rule implements these standardizations with the targets of enhancing care coordination and lowering the burden on lined entities and enterprise associates, whereas safeguarding the confidentiality of SUD data.
As a fast refresher, Half 2 serves to guard SUD data created by federally assisted packages.[1] These confidentiality protections had been initially enacted to assist tackle issues round the usage of SUD info in legal proceedings, employment and housing discriminatory practices, little one custody hearings, and different administrative issues. Suppliers topic to Half 2 are typically prohibited from disclosing any info that might determine an individual as having or having had a SUD with out the individual’s consent.
As a result of Half 2 rules had been carried out in 1975, over twenty years earlier than the implementation of HIPAA, suppliers have traditionally struggled to adjust to each legal guidelines. Particularly, suppliers topic to HIPAA had been additionally required to adjust to Half 2 for SUD data, which compelled these suppliers to adjust to typically inconsistent requirements for several types of well being info. Naturally, the presence of two competing requirements brought about confusion, elevated administrative burdens, and sometimes obstructed supplier entry to affected person info. The Last Rule contains a number of adjustments to align Half 2 extra intently with HIPAA and to scale back these administrative burdens, as summarized under:
- Affected person Consent. Sufferers can now present a single consent to authorize all future makes use of and disclosures associated to therapy, cost, and well being care operations (TPO), as an alternative of requiring a brand new consent for every disclosure. A consent will stay efficient until it’s revoked by the affected person.
- Enhanced Protections for Counseling Session Notes. Parallel to HIPAA protections for psychotherapists’ notes, clinicians’ notes from SUD counseling periods should be maintained individually from different affected person data, and require particular affected person consent to reveal. Thus, if a affected person offers a basic TPO consent, the counseling session notes will fall outdoors the scope of that consent and won’t be disclosed.
- Breach Notification. Breaches of Half 2 data might be topic to the identical affected person notification necessities of the HIPAA Breach Notification Rule.
- Penalties. Violations of Half 2 will now be topic to the identical civil and legal enforcement authorities that apply to HIPAA violations.
- Affected person Complaints. Along with or in lieu of submitting a criticism for an alleged violation beneath the Half 2 program, sufferers can select to file a criticism straight with the HHS Secretary. Additional, sufferers can request a listing of all disclosures made with consent for the previous 3 years.[2]
- Public Well being Authority Disclosure. De-identified data could be disclosed to public well being authorities with out affected person consent, in accordance with the HIPAA Privateness Rule.
- Investigations Protected Harbor. People working for investigative businesses that unlawfully get hold of a confidential Half 2 file with out the requisite court docket order could have restricted civil and legal legal responsibility, as long as the person acted with “affordable diligence” in evaluating whether or not the supplier is topic to Half 2 prior to creating the file request.
- Flexibility on Redisclosures. HIPAA regulated entities might redisclose SUD data obtained pursuant to a TPO authorization in a way in step with the HIPAA Privateness Rule, lowering the necessity for segregating or segmenting SUD data from different PHI in day by day operations.
The Last Rule takes impact on April 16, 2024 and entities should guarantee full compliance by February 16, 2026. For extra info on the Last Rule, see the HHS Last Rule Reality Sheet. The Reality Sheet signifies that OCR plans to finalize adjustments to the HIPAA Discover of Privateness Practices to deal with makes use of and disclosures of PHI which can be additionally protected by Half 2. Moreover, HHS might be growing steerage on compliance with the brand new Half 2 necessities.
We encourage federally assisted packages and suppliers topic to Half 2 to start reviewing and updating compliance insurance policies and procedures, affected person consents, affected person notices, and contractual agreements to adjust to the adjustments beneath the Last Rule. Suppliers with questions or in search of counsel can contact any member of our Healthcare Group for help.
FOOTNOTES
[1] See 42 U.S.C. § 290dd-2(a).
[2] This provision is tolled till the HIPAA accounting provision at 45 C.F.R. § 164.528 is revised.
