HHS proposes rule for substance use treatment information sharing and protection 

Photo: People Images/Getty Images

A proposed rule would align HIPAA privacy regulations for the treatment of substance use disorder to other requirements under the Health Insurance Portability and Accountability Act. 

The current system can create barriers to information sharing by patients and among healthcare providers and create dual obligations and compliance challenges for regulated entities, said the Department of Health and Human Services in announcing the proposed rule.

The proposed rule increases coordination among providers and increases protections for patients concerning records disclosure to avoid discrimination in treatment, HHS said.

“Varying requirements of privacy laws can slow treatment, inhibit care, and perpetuate negative stereotypes about people facing substance use challenges,” said HHS Secretary Xavier Becerra. “This proposed rule would improve coordination of care for patients receiving treatment while strengthening critical privacy protections to help ensure individuals do not forgo life-saving care due to concerns about records disclosure.”

WHY THIS MATTERS

In proposing the rule, HHS, through the Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA), is implementing provisions of the Coronavirus Aid, Relief and Economic Security (CARES) Act requiring greater alignment of the Confidentiality of Substance Use Disorder Patient Records under Part 2, to certain aspects of HIPAA.

Congress required that privacy protections for this program be more closely aligned with the HIPAA Privacy rule. 

Part 2 currently imposes different requirements for SUD treatment records than the HIPAA Privacy Rule, which can create barriers to information sharing by patients and among healthcare providers and create dual obligations and compliance challenges for regulated entities, HHS said. 

Greater flexibility for information sharing would include the permitted use and disclosure of Part 2 records based on a single patient consent given once for all future uses and disclosures for treatment, payment and healthcare operations.

The proposed rule permits redisclosure of Part 2 records in any manner permitted by the HIPAA Privacy Rule, with certain exceptions.

It gives patients rights to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule. It updates breach notifications to affected patients.

It expands prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative and legislative proceedings and gives HHS new enforcement authority, including the imposition of civil money penalties for violations of Part 2.

Public comments concerning the proposed rule are due 60 days after publication in the Federal Register.

THE LARGER TREND

The number of lawsuits over data breaches has increased, with healthcare topping the list of industries facing litigation, according to April findings from law firm BakerHostetler.

Healthcare comprised 23% of lawsuits due to data breaches. The next highest was business and professional services at 17%, followed by finance and insurance (15%), education (12%) and manufacturing (10%).

During the first year of COVID-19, substance use disorder and overdose death rates climbed, while drug treatment program admissions declined by nearly one quarter, with the cuts steepest among people of color, according to a Rand Corp. study. 

ON THE RECORD

“One of SAMHSA’s priorities is working to make effective treatments and recovery supports for SUD more accessible to all Americans,” said Miriam E. Delphin-Rittmon, HHS assistant secretary for mental health and substance use and the leader of SAMHSA. “Bringing Part 2 requirements into closer alignment with HIPAA will support more effective coordination for people accessing care. At the same time, the proposed rule mitigates the discrimination and stigma that we know too often people with SUDs experience.”  

Twitter: @SusanJMorse
Email the writer: [email protected]