In late November, HHS proposed long-awaited modifications to laws at 42 C.F.R. Half 2 (“Half 2”) governing the confidentiality of substance use dysfunction (“SUD”) data as required below the Coronavirus Assist, Aid, and Financial Safety (“CARES”) Act. Typically, HHS is trying to align Half 2 necessities with the HIPAA (“Well being Insurance coverage Portability and Accountability Act”) Privateness Rule. Essentially the most vital modifications are these to the principles governing consent for entities topic to Half 2’s restrictions to make use of, disclose, and redisclose Half 2 data with respect to remedy, fee, and well being care operations (“TPO”) actions.
Key Proposals
The Discover of Proposed Rulemaking (“NPRM”) accommodates a number of vital modifications to the present Half 2 guidelines, with probably the most impactful proposed modifications being these implementing the CARES Act’s amendments relating to consent for the use, disclosure, and redisclosure of Half 2 data. By implementing these amendments, the NPRM proposes that if a affected person offers legitimate consent to a use or disclosure of their data, the recipient might additional use or disclose such data in accordance with the next guidelines:
1. When disclosed for TPO actions to a Half 2 program, lined entity, or enterprise affiliate, the recipient might additional use or disclose these data as permitted by HIPAA, apart from makes use of and disclosures for civil, prison, administrative, and legislative proceedings towards the affected person.
2. When disclosed with consent given as soon as for all future TPO actions to a Half 2 program that’s not a lined entity or enterprise affiliate, the recipient might additional use or disclose these data in line with the consent.
3. When disclosed for fee or well being care operations actions to a lawful holder that’s not a lined entity, enterprise affiliate, or Half 2 program, the recipient might additional use or disclose these data as could also be essential for its contractors, subcontractors, or authorized representatives to hold out the fee or well being care operations specified within the consent.
Most notably, these modifications would allow extra flexibility within the use, disclosure, and redisclosure of Half 2 data for TPO functions, and set up the power to obtain written consent from a affected person as soon as for all future TPO makes use of and disclosures. As well as, the NPRM proposes quite a few modifications to the necessities for a sound Half 2 written consent to higher align with these for a sound HIPAA authorization, together with an announcement of the suitable to revoke consent.
The NPRM proposes a number of different modifications to the Half 2 guidelines to allow higher alignment with the HIPAA guidelines. There are proposed modifications to Half 2 guidelines within the following topics: enforcement and penalties, definitions, makes use of and disclosures, complaints, breaches, necessities for intermediaries, safety, notices of privateness practices, particular person rights, de-identification, and required disclosures to the Secretary. For an intensive breakdown of among the most doubtlessly impactful proposals, see .
Wider Implications
The proposed rule would assist enhance care coordination, notably within the wake of the opioid disaster. As HHS has promoted larger interoperability and knowledge sharing for remedy and care coordination, well being care suppliers, well being plans and well being info trade organizations have struggled to help the sharing of Half 2 data given stringent privateness protections. This proposed rule would allow simpler sharing of Half 2 data in order that this info might inform remedy. Nonetheless, there will likely be some considerations raised about privateness protections for people who’ve or have had substance use dysfunction remedy up to now because the extra stringent Half 2 guidelines had been meant to guard among the most delicate well being care information. As a lot, these proposed modifications might affect selections by some people to hunt wanted remedy and could also be of notably concern for pregnant girls post-Dobbs.
Subsequent Steps
The NPRM has intensive implications for a myriad of stakeholders within the well being care trade because it goals to boost flexibility in utilizing and sharing Half 2 data. If finalized, HHS would require compliance 24 months after publication of the ultimate guidelines, so there’s nonetheless a while till these provisions can be carried out. Stakeholders ought to analyze the potential affect of the NPRM on their operations and submit feedback to HHS, earlier than or on January 31, 2023 within the Federal Register. Crowell & Moring has intensive expertise advising on Half 2 necessities and may counsel you on the implications of those proposed modifications on your enterprise and any feedback to the proposed rule.