The CARES Act (the “Act”), enacted on March 27, 2020, makes notable changes to federal law governing the disclosure of substance use disorder (“SUD”) records. The Act amends 42 U.S.C. 290dd-2, the governing statute of the regulations at 42 C.F.R. Part 2 (“Part 2”) to better align certain of its confidentiality requirements with HIPAA. The amendments do not change the basic premise that prior written consent of the patient is required for disclosure of SUD treatment records. However, once prior written consent of the patient is obtained, the amendments allow a covered entity, business associate, or Part 2 program to use or disclose SUD records for purposes of treatment, payment, and health care operations as permitted by HIPAA. Any information so disclosed may then be redisclosed in accordance with the HIPAA regulations. The amendments also allow a patient’s prior written consent to be given once for all such future uses or disclosures for purposes of treatment, payment, and health care operations, until the patient revokes his or her consent in writing.
The Act also makes additional changes to 42 U.S.C. 290dd-2, including:
- requiring Part 2 programs to provide to a patient an accounting of disclosures made through an electronic health record for treatment, payment, or health care operations purposes in the three years prior to the patient’s request;
- allowing disclosure of de-identified information to public health authorities as long as the information is de-identified in accordance with HIPAA;
- applying the HITECH Act’s breach notification requirements to Part 2 programs;
- prohibiting the use of Part 2 records in criminal, civil, or administrative proceedings conducted by any federal, state, or local authority against a patient, except pursuant to a court order that meets the statute’s requirements or by consent of the patient;
- prohibiting discrimination against any individual on the basis of information in SUD records in certain health care, employment, housing, and federal or state social service benefits decisions;
- applying the statutory penalties imposed for HIPAA violations to violations of 42 U.S.C. 290dd-2;
- directing the Secretary of Health and Human Services to update the HIPAA regulations to require covered entities and entities creating or maintaining SUD treatment records to provide a notice of privacy practices regarding SUD treatment records, including a statement of the patient’s rights and a description of each purpose for which the covered entity is permitted or required to use or disclose protected health information without the patient’s written authorization.
The Act directs the Secretary of Health and Human Services to revise the Part 2 regulations so that the amendments apply to uses and disclosures of information occurring one year from the date of enactment of the CARES Act. These changes will help improve care coordination for SUD patients and ease some of the regulatory burdens on providers by better aligning the treatment of SUD records subject to Part 2 with HIPAA.