In late November, HHS proposed long-awaited modifications to laws at 42 C.F.R. Half 2 (“Half 2”) governing the confidentiality of substance use dysfunction (“SUD”) information as required underneath the Coronavirus Help, Aid, and Financial Safety (“CARES”) Act. Usually, HHS is trying to align Half 2 necessities with the HIPAA (“Well being Insurance coverage Portability and Accountability Act”) Privateness Rule. Probably the most vital modifications are these to the foundations governing consent for entities topic to Half 2’s restrictions to make use of, disclose, and redisclose Half 2 information with respect to remedy, cost, and well being care operations (“TPO”) actions.
The Discover of Proposed Rulemaking (“NPRM”) accommodates a number of vital modifications to the present Half 2 guidelines, with probably the most impactful proposed modifications being these implementing the CARES Act’s amendments concerning consent for the use, disclosure, and redisclosure of Half 2 information. By implementing these amendments, the NPRM proposes that if a affected person gives legitimate consent to a use or disclosure of their information, the recipient could additional use or disclose such information in accordance with the next guidelines:
1. When disclosed for TPO actions to a Half 2 program, lined entity, or enterprise affiliate, the recipient could additional use or disclose these information as permitted by HIPAA, aside from makes use of and disclosures for civil, prison, administrative, and legislative proceedings in opposition to the affected person.
2. When disclosed with consent given as soon as for all future TPO actions to a Half 2 program that isn’t a lined entity or enterprise affiliate, the recipient could additional use or disclose these information per the consent.
3. When disclosed for cost or well being care operations actions to a lawful holder that isn’t a lined entity, enterprise affiliate, or Half 2 program, the recipient could additional use or disclose these information as could also be needed for its contractors, subcontractors, or authorized representatives to hold out the cost or well being care operations specified within the consent.
Most notably, these modifications would allow extra flexibility within the use, disclosure, and redisclosure of Half 2 information for TPO functions, and set up the flexibility to obtain written consent from a affected person as soon as for all future TPO makes use of and disclosures. As well as, the NPRM proposes quite a few modifications to the necessities for a legitimate Half 2 written consent to higher align with these for a legitimate HIPAA authorization, together with a press release of the suitable to revoke consent.
The NPRM proposes a number of different modifications to the Half 2 guidelines to allow higher alignment with the HIPAA guidelines. There are proposed modifications to Half 2 guidelines within the following topics: enforcement and penalties, definitions, makes use of and disclosures, complaints, breaches, necessities for intermediaries, safety, notices of privateness practices, particular person rights, de-identification, and required disclosures to the Secretary. For an intensive breakdown of a few of the most probably impactful proposals, see our Consumer Alert on the NPRM for Half 2.
The proposed rule would assist enhance care coordination, significantly within the wake of the opioid disaster. As HHS has promoted larger interoperability and data sharing for remedy and care coordination, well being care suppliers, well being plans and well being data alternate organizations have struggled to assist the sharing of Half 2 information given stringent privateness protections. This proposed rule would allow simpler sharing of Half 2 information in order that this data might inform remedy. Nevertheless, there will likely be some issues raised about privateness protections for people who’ve or have had substance use dysfunction remedy previously because the extra stringent Half 2 guidelines have been supposed to guard a few of the most delicate well being care knowledge. As a lot, these proposed modifications could impression choices by some people to hunt wanted remedy and could also be of significantly concern for pregnant ladies post-Dobbs.
The NPRM has intensive implications for a myriad of stakeholders within the well being care trade because it goals to boost flexibility in utilizing and sharing Half 2 information. If finalized, HHS would require compliance 24 months after publication of the ultimate guidelines, so there’s nonetheless a while till these provisions can be carried out. Stakeholders ought to analyze the potential impression of the NPRM on their operations and submit feedback to HHS, earlier than or on January 31, 2023 within the Federal Register. Crowell & Moring has intensive expertise advising on Half 2 necessities and may counsel you on the implications of those proposed modifications on your small business and any feedback to the proposed rule.