Part 2 Modernization Underway: Revised Rule Released While We Await CARES Act Rulemaking

Newsletter

Where do we stand with the Part 2 Rules and what are the current standards for managing substance use disorder records? After years with no updates, 42 C.F.R. Part 2 (Part 2) saw updates in 2017 and 2018. While those updates allowed for a shorter redisclosure prohibition notice and some increased flexibility for disclosures for payment and health care operations purposes, the basic principles of Part 2 Rules remained in place, including specific limitations on use and disclosure of substance use disorder records. However, the Coronavirus Aid, Relief, and Economic Security (CARES) Act and corresponding yet-to-be released rules, as well as an unrelated Part 2 final rule first proposed in August 2019 and finalized this month, should significantly modify Part 2 going forward. With all of these rules at play, where do we stand with Part 2 records now and what should we expect going forward? Part 2 programs, providers, and pharmacies should track the changes in flux and varying effective dates and prepare for a significant shift in Part 2.

CARES Act
The President signed the CARES Act in March 2020, including a significant change to standards for managing substance use disorder records under the Public Health Services Act (42 U.S.C. 290dd-2). Notably, the CARES Act amendments allow substance use disorder records to be shared for treatment, payment, and health care operations purposes in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) after the Part 2 program has received initial (revocable) consent from the patient.

While this is not the standard HIPAA TPO exception some are hoping for in order to support interoperability and ease care coordination for substance use disorder patients, it is a significant shift which, according to the US Department of Health and Human Services (HHS), will provide greater flexibility for patients and health care providers to share substance use disorder records than presently allowed and seek to further align Part 2 with HIPAA. Whether we see a complete overhaul to the Part 2 consent requirements still remains to be seen.

The CARES Act also makes further significant statutory changes, including:

  • A new exception for disclosures to a public health authority for data meeting HIPAA’s de-identification standards.
  • A requirement for HHS to update HIPAA to require references to substance use disorder records in covered entities’ notices of privacy practices.
  • Addition of antidiscrimination provisions that prohibit discrimination on the basis of information received pursuant to an inadvertent or intentional disclosure of substance use disorder records (or information contained in the records), including in admission, access to, or treatment for health care; regarding employment, including receipt of workers’ compensation; in housing; in access to the courts; and regarding provision of social services and government benefits.
  • A new requirement for Part 2 programs to report breaches of unsecured substance use disorder record information in accordance with HIPAA (regardless of whether the Part 2 program is otherwise subject to HIPAA).
  • Providing an indication of Congressional preference for Part 2 information to be included in state-based prescription drug monitoring programs (despite Part 2 patients’ rights to request restrictions) and a sense that further guidance may be required to address concerns.

HHS will need to consult with other agencies, including the Substance Abuse and Mental Health Services Administration (SAMHSA), and update Part 2 to implement and enforce the policy shift. The CARES Act requires implementing Part 2 regulations, which cannot take effect before March 27, 2021. In the meantime, Part 2 is in flux, as the CARES Act demonstrates a policy shift for uses and disclosures occurring on or after March 27, 2021 (12 months after enactment of the CARES Act), but Part 2 programs must comply with existing Part 2 regulations (including the July 2020 updates outlined below) until changes are finalized.

Revised Rule July 2020
Further complicating the Part 2 analysis and timeline, HHS released a Final Rule and fact sheet earlier this month. The Revised Rule will be effective August 14, 2020. These revisions are meant to align Part 2 with advances in the health care system and increase alignment between Part 2 and HIPAA. This Revised Rule was originally proposed in August 2019 (pre-CARES Act). HHS explains in the preamble to the Revised Rule that it expects further modifications to Part 2 as a result of the CARES Act and that this Revised Rule will serve as “interim and transitional standards” until the CARES Act regulations are promulgated.

While we wait for CARES Act-related regulations, here is a brief summary of key takeaways from the Revised Rule. In terms of effective dates, these standards are effective August 14, 2020, until at least March 27, 2021 (or longer if the CARES Act-related regulations do not affect these updates):

  • Disclosure by Non-Part 2 Providers. For providers that are not covered by Part 2, the Revised Rule explicitly states that treatment records created by these providers are not subject to Part 2 and therefore are not subject to Part 2’s restrictions on disclosure, provided that Part 2 records are not incorporated into those other treatment records.
  • Prohibition on Re-Disclosure. Under the Revised Rule, non-Part 2 providers do not need to redact information in a non-Part 2 record regarding substance use disorders and may re-disclose if permitted by written patient consent or as permitted under Part 2.
  • Consent Requirements. The Revised Rule allows patients to provide consent for disclosure of their Part 2 records to an entity without naming a specific person to whom the Part 2 records may be disclosed.
  • Disclosures for Payment and Health Care Operations. The Revised Rule expressly lists 18 activities that qualify as “payment and health care operations,” for which providers may disclose Part 2 records after obtaining patient consent. The list specifically includes care coordination and care management in order to encourage such activities.
  • Disclosures to Central Registries and PDMPs. To encourage coordination of care, the Revised Rule allows non-opioid treatment providers with a treating provider relationship to access central registries to prevent multiple patient enrollments. The Revised Rule also creates new permission—subject to patient consent—to allow opioid treatment programs to disclose dispensing and prescribing data on Schedules II to V (per applicable state law) to prescription drug monitoring programs (PDMPs).
  • Medical Emergencies. The Revised Rule authorizes disclosures of patient information to another Part 2 provider or other substance use disorder provider during state or federally declared natural and major disasters.
  • Research. In an attempt to better align Part 2 with HIPAA and the federal human subject protection regulations (the Common Rule), the Revised Rule permits HIPAA covered entities and business associates to disclose Part 2 records in connection with human subject research. The Revised Rule also permits research disclosures to recipients covered by Food and Drug Administration regulations for the protection of human subjects in clinical investigations.
  • Audit and Evaluation. Providing clarification on audit and evaluation of Part 2 programs, the Revised Rule states that federal, state, and local governmental agencies, and third-party payers may conduct audits and evaluations to identify needed actions at the agency or payer level to improve care. Such audits and evaluations may include reviews of appropriateness of medical care, medical necessity, and utilization of services. Auditors may include quality assurance organizations as well as entities with direct administrative control over a Part 2 program or lawful holder. The Revised Rule also clarifies the provision related to quality improvement organizations (QIOs) and allows for patient identifying information to be disclosed to federal, state, or local government agencies, and to their contractors, subcontractors, and legal representatives for audit and evaluations required by statute or regulation.

While not an update to Part 2, the preamble of the Revised Rule also provides guidance on the use of personal devices within Part 2 programs. Specifically, though discouraging the use of patient communication through personal email and cell phone, the discussion acknowledges that patients may make contact through these devices and clarifies that such communication would not make the device or account part of the Part 2 record requiring the restrictions and obligations imposed by Part 2. Instead, the guidance directs the information be immediately deleted and a response to the patient provided only via the authorized channel provided by the Part 2 provider. If the communication included patient identifying information, the employee should forward through the authorized channels first where it could be incorporated into the patient’s record and then delete from the personal device.

We will continue to watch for updates from HHS on the CARES Act implementing regulations further modifying Part 2. In the meantime:

  • Part 2 programs should evaluate current practices to incorporate July 2020 standards and consider how CARES Act changes may affect handling Part 2 records going forward, including patient consent for TPO and HIPAA breach notification.
  • Part 2 programs should be prepared to update their notices of privacy practices and Part 2 patient consent process, which could include a temporary update to the consent process now in the event CARES Act rulemaking may be applied retroactively.
  • CARES Act rulemaking will require an assessment of state privacy law, so Part 2 programs may wish to familiarize themselves with or refresh state law compliance obligations in advance.
  • For Part 2 programs not currently subject to HIPAA, the CARES Act changes will require an investment in an expanded compliance program, and efforts should begin in advance of rulemaking.

For questions about this update, 42 C.F.R. Part 2 compliance generally, or how to prepare your Part 2 compliance program for CARES Act policy, legal, and operational shifts, please contact:

Follow Quarles

Subscribe Media Contact
Back to Main Content

We use cookies to provide you with the best user experience on our website and to analyze statistics related to our website. To understand more about how we use cookies, or for instructions to change your preference and browser settings, please see our Privacy Notice. Please note that if you choose to reject cookies, doing so may impair some of our website's functionality.