September 19, 2019

September 18, 2019

Subscribe to Latest Legal News and Analysis

September 17, 2019

Subscribe to Latest Legal News and Analysis

September 16, 2019

Subscribe to Latest Legal News and Analysis

HHS Proposes 42 CFR Part 2 Reforms

The confidentiality of patient records created by federally-assisted substance use disorder ("SUD") treatment programs is governed by 42 CFR Part 2 (commonly referred to as "Part 2"). On August 22, the Department of Health and Human Services ("HHS") released a proposed rule to modernize and reduce some of the burdens of Part 2. This Update highlights three of the major proposed changes to the rule that affect non-SUD providers, but a full summary of changes from the HHS Proposed Rule Fact Sheet is included below.

Non-SUD providers often have difficulty in determining when and how some medical records may become subject to Part 2. The proposed rule provides clarification. Oral statements made by a SUD provider to a non-SUD provider (with the requisite patient consent) are not records subject to Part 2 solely because they are put in writing by the non-SUD provider. This permits non-SUD providers to legally learn information from a protected SUD record, discuss the matter independently with the patient as relevant for treatment, and then incorporate all such information into the patient's medical record without such record being subject to Part 2. Moreover, while records subject to Part 2 received in writing by a non-SUD provider remain subject to Part 2, the proposed rules clarified that the receiving provider is permitted to segregate such records to avoid the patient's entire medical record from becoming subject to Part 2.

If the proposed rule is adopted, non-SUD providers will also have the ability to become eligible to access a centralized database to determine if their patients are receiving opioid treatment from a SUD provider. It is anticipated that access to this information will reduce the potential for opioid abuse and improve patient outcomes by better connecting providers with information needed for proper treatment.

Finally, under the proposed rule disclosure requirements for research involving Part 2 records would be altered to align with the Privacy Rule. This will ease the burden on non-SUD providers submitting records for research that are subject to different requirements.

The following is the full summary of the changes in the proposed rules from the HHS Fact Sheet:

Provision

What Is the Proposed Change?

Why Is This Being Changed?

Applicability and Re-Disclosure

Treatment records created by non-Part 2 providers based on their own patient encounter(s) will not be covered by Part 2 unless any SUD records previously received from a Part 2 program are incorporated into such records. Segmentation or holding apart of any Part 2 patient record previously received can be used to ensure that new records created by non-Part 2 providers will not become subject to Part 2.

To facilitate coordination of care activities by non Part-2 providers.

Disposition of Records

When a SUD patient sends an incidental message to the personal device of an employee of a Part 2 program, the employee will be able to fulfill the Part 2 requirement for "sanitizing" the device by deleting that message.

To ensure that the personal devices of employees will not need to be confiscated or destroyed, in order to sanitize per Part 2.

Consent Requirements

A SUD patient may consent to disclosure of his Part 2 treatment records to an entity (e.g., the Social Security Administration) without naming a specific person as the recipient for the disclosure.

To allow patients to apply for benefits and resources more easily, for example, when using online applications that do not identify a specific person as the recipient for a disclosure of Part 2 records.

Disclosures Permitted with Written Consent

Disclosures for the purpose of "payment and health care operations" are permitted with written consent, in connection with an illustrative list of 17 example activities.

In order to resolve lingering confusion under Part 2 about what activities count as "payment and health care operations," the list of examples will be incorporated into the regulatory text from the preamble.

Disclosures to Central Registries and PDMPs

Non-OTP (opioid treatment program) providers will become eligible to query a central registry, in order to determine whether their patients are already receiving opioid treatment through a member program.

OTPs will be permitted to enroll in a state prescription drug monitoring program (PDMP) and permitted to report data into the PDMP when prescribing or dispensing medications on Schedules II to V, consistent with applicable state law.

The revised central registry and PDMP provisions will help to prevent duplicative enrollments in SUD care, duplicative prescriptions for SUD treatment, and adverse drug events related to SUD treatment.

Medical Emergencies

Declared emergencies resulting from natural disasters (e.g., hurricanes) that disrupt treatment facilities and services will meet the definition for a "bona fide medical emergency," for the purpose of disclosing SUD records without patient consent under Part 2.

To ensure clinically appropriate communications and access to SUD care, in the context of declared emergencies resulting from natural disasters.

Research

Disclosures for research under Part 2 will be permitted by a HIPAA covered entity or business associate to individuals and organizations who are neither HIPAA covered entities nor subject to the Common Rule (re: Research on Human Subjects).

To facilitate appropriate disclosures for research by streamlining overlapping requirements under Part 2, the Privacy Rule, and the Common Rule.

Audit and Evaluation

Part 2 will be revised to clarify that some specific situations fall within the scope of permitted disclosures for audits or program evaluation.

To resolve current ambiguity under Part 2 about what activities are covered by the audit and evaluation provision.

Confidential Communications

The standard for court ordered disclosures of SUD records for the purpose of investigating "an extremely serious crime" will be revised by dropping the phrase "allegedly committed by the patient."

To correct an earlier technical error from the 2017 rule-making in which this phrase was inadvertently added to regulatory text without notice or public comment.

Undercover Agents and Informants

Court-ordered placement of an undercover agent or informant within a Part 2 program will be extended to a period of 12 months, and courts will be authorized to further extend the period of placement through a new court order.

To address DOJ concerns that the current policy is overly restrictive to some ongoing investigations of Part 2 programs.


 

©2019 von Briesen & Roper, s.c

TRENDING LEGAL ANALYSIS


About this Author

Ryan Siehr, von Briesen Law Firm, Milwaukee, Corporate and Health Care Law Attorney

Ryan Siehr is a member of the Business Practice Group and the Health Law and Technology Law Sections. He focuses his practice on business transactions, licensing, start-up and business formation, retail leasing and technology law. Ryan has significant experience in the health care industry with a special focus on HIPAA and healthcare-related software licensing and agreements. He also has experience working with entrepreneurial ventures on both a wide variety of legal issues and interaction with business planning, strategy, operation and finance.

Ryan is a member of the State Bar of...

414-238-6545
Stacy Gerber Ward, von Briesen Roper Law Firm, Milwaukee, Corporate and Health Care Law Attorney

Stacy Gerber Ward is a Shareholder and Leader of von Briesen’s Government Enforcement and Corporate Investigations Section. Stacy focuses on helping clients respond to government investigations and conduct internal investigations using her more than 14 years of experience serving as an Assistant United States Attorney for the Eastern District of Wisconsin and most recently as the Deputy Chief of the Civil Division. Stacy investigated and prosecuted individuals and corporations for civil health care fraud and other enforcement matters, including government enforcement matters under the False Claims Act, the Stark Law, the Anti-Kickback Statute, and the Controlled Substances Act.

414-287-1568