In late November, HHS proposed long-awaited adjustments to laws at 42 C.F.R. Half 2 (“Half 2”) governing the confidentiality of substance use dysfunction (“SUD”) information as required beneath the Coronavirus Assist, Aid, and Financial Safety (“CARES”) Act. Typically, HHS is making an attempt to align Half 2 necessities with the HIPAA (“Well being Insurance coverage Portability and Accountability Act”) Privateness Rule. Essentially the most important adjustments are these to the principles governing consent for entities topic to Half 2’s restrictions to make use of, disclose and redisclose Half 2 information with respect to remedy, cost, and well-being care operations (“TPO”) actions.
The Discover of Proposed Rulemaking (“NPRM”) incorporates a number of important adjustments to the present Half 2 guidelines, with probably the most impactful proposed adjustments being these implementing the CARES Act’s amendments relating to consent for the use, disclosure, and redisclosure of Half 2 information. By implementing these amendments, the NPRM proposes that if an affected person gives legitimate consent to a use or disclosure of their information, the recipient might additionally use or disclose such information in accordance with the next guidelines:
1. When disclosed for TPO actions to a Half 2 program, lined entity, or enterprise affiliate, the recipient might additionally use or disclose this information as permitted by HIPAA, apart from making use of and disclosures for civil, prison, administrative, and legislative proceedings in opposition to the affected person.
2. When disclosed with the consent given as soon as for all future TPO actions to a Half 2 program that isn’t a lined entity or enterprise affiliate, the recipient might additionally use or disclose this information in step with the consent.
3. When disclosed for cost or well-being care operations actions to a lawful holder that isn’t a lined entity, enterprise affiliate, or Half 2 program, the recipient might additionally use or disclose this information as could also be obligatory for its contractors, subcontractors, or authorized representatives to hold out the cost or well-being care operations specified within the consent.
Most notably, these adjustments would allow extra flexibility within the use, disclosure, and redisclosure of Half 2 information for TPO functions, and set up the flexibility to obtain written consent from an affected person as soon as for all future TPO makes use of and disclosures. As well as, the NPRM proposes quite a few adjustments to the necessities for a legitimate Half 2 written consent to raised aligned with these for a legitimate HIPAA authorization, together with an announcement of the correct to revoke consent.
The NPRM proposes a number of different adjustments to the Half 2 guidelines to allow higher alignment with the HIPAA guidelines. There are proposed adjustments to Half 2 guidelines within the following topics: enforcement and penalties, definitions, makes use of and disclosures, complaints, breaches, necessities for intermediaries, safety, notices of privateness practices, particular person rights, de-identification, and required disclosures to the Secretary. For an intensive breakdown of a number of the most doubtlessly impactful proposals, see our Shopper Alert on the NPRM for Half 2.
The proposed rule would assist enhance care coordination, notably in the wake of the opioid disaster. As HHS has promoted higher interoperability and knowledge sharing for remedy and care coordination, well-being care suppliers, well-being plans and well-being info change organizations have struggled to assist the sharing of Half 2 information given stringent privateness protections. This proposed rule would allow simpler sharing of Half 2 information in order that this info may inform remedy. Nonetheless, there shall be some issues raised about privacy protections for people who’ve or have had substance use dysfunction remedy up to now because the extra stringent Half 2 guidelines have been supposed to guard a number of the most delicate well-being care knowledge. As a lot, these proposed adjustments might impression choices by some people to hunt wanted remedy and could also be of notable concern for pregnant ladies post-Dobbs.
The NPRM has in-depth implications for a myriad of stakeholders within the well-being care business because it goals to boost flexibility in utilizing and sharing Half 2 information. If finalized, HHS would require compliance 24 months after publication of the ultimate guidelines, so there’s nonetheless a while till these provisions could be carried out. Stakeholders ought to analyze the potential impression of the NPRM on their operations and submit feedback to HHS, earlier than or on January 31, 2023, within the Federal Register. Crowell & Moring has in-depth expertise advising on Half 2 necessities and might counsel you on the implications of those proposed adjustments on your small business and any feedback to the proposed rule…