The U.S. Division of Well being and Human Companies (HHS) and the Substance Abuse and Psychological Well being Companies Administration (SAMHSA) just lately launched the lengthy anticipated Remaining Rule to revise the Confidentiality of Substance Use Dysfunction (SUD) Affected person Information laws at 42 C.F.R. Half 2 (Half 2).
In March 2020, the Coronavirus Support, Reduction, and Financial Safety (CARES) Act § 3221 known as for the alignment of sure Half 2 confidentiality protocols with HIPAA and HITECH Act necessities. The Remaining Rule implements these standardizations with the targets of bettering care coordination and reducing the burden on coated entities and enterprise associates, whereas safeguarding the confidentiality of SUD information.
As a fast refresher, Half 2 serves to guard SUD information created by federally assisted packages.[1] These confidentiality protections have been initially enacted to assist deal with issues round using SUD data in felony proceedings, employment and housing discriminatory practices, little one custody hearings, and different administrative issues. Suppliers topic to Half 2 are typically prohibited from disclosing any data that might determine an individual as having or having had a SUD with out the individual’s consent.
As a result of Half 2 laws have been applied in 1975, over 20 years earlier than the implementation of HIPAA, suppliers have traditionally struggled to adjust to each legal guidelines. Particularly, suppliers topic to HIPAA have been additionally required to adjust to Half 2 for SUD information, which compelled these suppliers to adjust to usually inconsistent requirements for various kinds of well being data. Naturally, the presence of two competing requirements precipitated confusion, elevated administrative burdens, and infrequently obstructed supplier entry to affected person data. The Remaining Rule consists of a number of modifications to align Half 2 extra carefully with HIPAA and to cut back these administrative burdens, as summarized under:
- Affected person Consent. Sufferers can now present a single consent to authorize all future makes use of and disclosures associated to remedy, fee, and well being care operations (TPO), as a substitute of requiring a brand new consent for every disclosure. A consent will stay efficient except it’s revoked by the affected person.
- Enhanced Protections for Counseling Session Notes. Parallel to HIPAA protections for psychotherapists’ notes, clinicians’ notes from SUD counseling classes should be maintained individually from different affected person information, and require particular affected person consent to reveal. Thus, if a affected person offers a normal TPO consent, the counseling session notes will fall exterior the scope of that consent and won’t be disclosed.
- Breach Notification. Breaches of Half 2 information will probably be topic to the identical affected person notification necessities of the HIPAA Breach Notification Rule.
- Penalties. Violations of Half 2 will now be topic to the identical civil and felony enforcement authorities that apply to HIPAA violations.
- Affected person Complaints. Along with or in lieu of submitting a grievance for an alleged violation beneath the Half 2 program, sufferers can select to file a grievance instantly with the HHS Secretary. Additional, sufferers can request an inventory of all disclosures made with consent for the previous 3 years.[2]
- Public Well being Authority Disclosure. De-identified information might be disclosed to public well being authorities with out affected person consent, in accordance with the HIPAA Privateness Rule.
- Investigations Protected Harbor. People working for investigative companies that unlawfully acquire a confidential Half 2 document with out the requisite court docket order could have restricted civil and felony legal responsibility, as long as the person acted with “cheap diligence” in evaluating whether or not the supplier is topic to Half 2 prior to creating the document request.
- Flexibility on Redisclosures. HIPAA regulated entities might redisclose SUD information obtained pursuant to a TPO authorization in a fashion in keeping with the HIPAA Privateness Rule, lowering the necessity for segregating or segmenting SUD information from different PHI in each day operations.
The Remaining Rule takes impact on April 16, 2024 and entities should guarantee full compliance by February 16, 2026. For extra data on the Remaining Rule, see the HHS Remaining Rule Truth Sheet. The Truth Sheet signifies that OCR plans to finalize modifications to the HIPAA Discover of Privateness Practices to deal with makes use of and disclosures of PHI which can be additionally protected by Half 2. Moreover, HHS will probably be creating steering on compliance with the brand new Half 2 necessities.
We encourage federally assisted packages and suppliers topic to Half 2 to start reviewing and updating compliance insurance policies and procedures, affected person consents, affected person notices, and contractual agreements to adjust to the modifications beneath the Remaining Rule. Suppliers with questions or looking for counsel can contact any member of our Healthcare Group for help.
FOOTNOTES
[1] See 42 U.S.C. § 290dd-2(a).
[2] This provision is tolled till the HIPAA accounting provision at 45 C.F.R. § 164.528 is revised.
Supply hyperlink
