HHS Proposes SUD Confidentiality Changes
We're in the office catching up our blog posts and keeping you in the loop. On November 28th, HHS proposed new protections to increase care coordination and confidentiality for protecting substance use disorder (SUD) information (i.e. data protected by 42 CFR part 2). This notice of proposed rulemaking (NPRM) seeks to better align SUD information with HIPAA. Notably, we've always considered SUD information a subset of protected health information (PHI) and while 42 CFR is generally more stringent and has different requirements, we have yet to learn how this information isn't also PHI. This also isn't the first time HIPAA and SUD have been proposed toward better integration.
From the notice:
"...Proposed changes include:
Permitted use and disclosure of Part 2 records based on a single patient consent given once for all future uses and disclosures for treatment, payment, and health care operations.
Permitted redisclosure of Part 2 records in any manner permitted by the HIPAA Privacy Rule, with certain exceptions.
New patient rights under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule.
Expanded prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings.
New HHS enforcement authority, including the imposition of civil money penalties for violations of Part 2.
Updated breach notification requirements to HHS and affected patients.
Updated HIPAA Privacy Rule Notice of Privacy Practices requirements to address uses and disclosures of Part 2 records and individual rights with respect to those records..."
Click the graphic below if you want to provide comments to this NPRM.
