CARES Act: Revisions to the Treatment of Substance Use Disorder (SUD) Records

Addiction treatment has long held a stigma in society. Prior to the original implementation of 42 C.F.R. Part 2 (Part 2) regulations, patients were often reluctant to identify to their provider a need for addiction treatment and/or consent to the release of one’s medical records covering addiction treatment. The implementation of Part 2 regulations sought to encourage individuals to seek addiction treatment, for alcohol and substance abuse purposes, and to protect the confidentiality of those addiction treatment records. Those protections were significantly revamped upon passage of the Coronavirus Aid, Relief and Economic Security (CARES) Act of 2020 on March 27, 2020. Unlike many changes promulgated for the duration of the COVID-19 pandemic, the changes to Part 2 protections are permanent.

Most importantly, the CARES Act significantly eases the ability to disclose SUD records with the patient’s initial consent. Specifically, once a patient gives written consent, the record may be further disclosed by a covered entity, business associate, or a program that receives Part 2 information for purposes of treatment, payment and health care operations as permitted under HIPAA. Now, after initial disclosure, subsequent disclosures can be made under HIPAA unless and until the patient revokes his/her consent. In other words, no longer will the patient be required to state in his/her original consent, by name, who (person or entity) specifically can receive the records with the disclosure limited to only those named individuals or entities.

Summary of Material Changes to Part 2 Regulations Under the CARES Act

• Consent: As discussed above, the most significant change is that patients will not be able to restrict the sharing of their SUD records in the same way as before. Disclosure of SUD information can now occur to third parties, including public health authorities, consistent with HIPAA regulations. Organizations must be sure their consent forms and practices are reviewed and updated to support the revised expectations for SUD disclosures.
• Antidiscrimination: Prohibits discriminating against an individual for admission/treatment purposes, employment-related reasons, housing, access to courts and/or access to social services based on information included in one’s Part 2 records. Organizations should ensure that information received as a part of one’s SUD disclosure is not used outside of health care coordination and treatment needs, or for any improper purpose. As an example, it is best that the SUD information is not shared with or accessible by any individual(s) having a role in employment decisions.
• Enforcement and Breach: Oversight now moves under the Office for Civil Rights (OCR), and any applicable notices and/or penalties for breach will be assessed in accordance with HIPAA.
• Use of Records in Investigations or Proceedings: A court order or patient consent is required for disclosure and use of SUD records in any civil, criminal, administrative or legislative proceeding conducted by any federal, state, or local authority. Specifically, SUD records cannot be used without consent in any proceeding in regards to evidence in any criminal prosecution or civil action, proceedings before a government agency, for law enforcement purposes including investigations, and in applications for a warrant.

The CARES Act directs the U.S. Department of Health and Human Services and the Substance Abuse and Mental Health Services Administration to revise existing Part 2 guidance within 12 months from the CARES Act implementation date. These revisions will, among other items, provide guidance on required written privacy practices and appropriate notices of patient’s rights to those individuals signing consent forms for SUD records. While additional guidance is expected, for now, impacted organizations should begin to consider what changes will be needed to their existing policies and procedures to comply with the CARES Act’s new requirements.

Faegre Drinker’s Coronavirus Resource Center is available to help you understand and assess the legal, regulatory and commercial implications of COVID-19.