HHS 42 CFR Part 2 Proposed Rule Fact Sheet

by iMARS Staff 23. August 2019 EHR, EMR, Health, HIPAA 0

The 42 CFR part 2 regulations serve to protect patient records created by federally funded programs for the treatment of substance use disorder (SUD). SAMHSA is currently proposing to revise part 2, to facilitate better coordination of care for substance use disorders which will also enhance care for opioid use disorder (OUD). These provisions will be an important part of the Federal response to the opioid epidemic, while maintaining part 2 confidentiality protections.

What’s Not Changing Under the New Part 2 Rule: The proposed rule will not alter the basic framework for confidentiality protection of SUD patient records created by federally funded treatment programs. Part 2 will continue to prohibit law enforcement use of SUD patient records in criminal prosecution against the patient. Part 2 will also continue to restrict the disclosure of SUD treatment records without patient consent, other than as statutorily authorized in the context of a bona fide medical emergency; or for the purpose of scientific research, audit, or program evaluation; or based on an appropriate court order for good cause.

What Is Changing Under the New Part 2 Rule: The proposed rule will modify several sections of part 2, as follows:

Provision	What Is the Proposed Change?	Why Is This Being Changed?
Applicability and Re-Disclosure	Treatment records created by non-part 2 providers based on their own patient encounter(s) will not be covered by part 2, unless any SUD records previously received from a part 2 program are incorporated into such records. Segmentation or holding apart of any part 2 patient record previously received can be used to ensure that new records created by non-part 2 providers will not become subject to part 2.	To facilitate coordination of care activities by non part-2 providers.
Disposition of Records	When an SUD patient sends an incidental message to the personal device of an employee of a part 2 program, the employee will be able to fulfill the part 2 requirement for “sanitizing” the device by deleting that message.	To ensure that the personal devices of employees will not need to be confiscated or destroyed, in order to sanitize per part 2.
Consent Requirements	An SUD patient may consent to disclosure of his part 2 treatment records to an entity (e.g., the Social Security Administration), without naming a specific person as the recipient for the disclosure.	To allow patients to apply for benefits and resources more easily, for example, when using online applications that do not identify a specific person as the recipient for a disclosure of part 2 records.
Disclosures Permitted w/ Written Consent	Disclosures for the purpose of “payment and health care operations” are permitted with written consent, in connection with an illustrative list of 17 example activities.	In order to resolve lingering confusion under part 2 about what activities count as “payment and health care operations,” the list of examples will be moved into the reg text from the preamble.
Disclosures to Central Registries and PDMPs	Non-OTP (opioid treatment program) providers will become eligible to query a central registry, in order to determine whether their patients are already receiving opioid treatment through a member program. OTPs will be permitted to enroll in a state prescription drug monitoring program (PDMP), and permitted to report data into the PDMP when prescribing or dispensing medications on Schedules II to V, consistent with applicable state law.	The revised central registry and PDMP provisions will help to prevent duplicative enrollments in SUD care, duplicative prescriptions for SUD treatment, and adverse drug events related to SUD treatment.
Medical Emergencies	Declared emergencies resulting from natural disasters (e.g., hurricanes) that disrupt treatment facilities and services will meet the definition for a “bona fide medical emergency,” for the purpose of disclosing SUD records without patient consent under part 2.	To ensure clinically appropriate communications and access to SUD care, in the context of declared emergencies resulting from natural disasters.
Research	Disclosures for research under part 2 will be permitted by a HIPAA covered entity or business associate to individuals and organizations who are neither HIPAA covered entities, nor subject to the Common Rule (re: Research on Human Subjects).	To facilitate appropriate disclosures for research, by streamlining overlapping requirements under part 2, the Privacy Rule and the Common Rule.
Audit and Evaluation	Part 2 will be revised to clarify that some specific situations fall within the scope of permitted disclosures for audits and/or program evaluation.	To resolve current ambiguity under part 2 about what activities are covered by the audit and evaluation provision.
Confidential Communications	The standard for court ordered disclosures of SUD records for the purpose of investigating “an extremely serious crime” will be revised, by dropping the phrase “allegedly committed by the patient.”	To correct an earlier technical error from the 2017 rule-making, in which this phrase was inadvertently added to regulatory text without notice or public comment.
Undercover Agents and Informants	Court-ordered placement of an undercover agent or informant within a part 2 program will be extended to a period of 12 months, and courts will be authorized to further extend the period of placement through a new court order.	To address DOJ concerns that the current policy is overly restrictive to some ongoing investigations of part 2 programs.