CARES Act Modernizes Part 2

By: Jeffrey Lynne March 31, 2020 11:54 pm

Time to read: 5 Minutes

On March 27 the Coronavirus Aid, Relief, and Economic Security (CARES) Act, the $2 trillion measure designed to respond to the coronavirus pandemic was signed into law. It is largest economic stimulus package in American history. Some of the Act’s more sweeping provisions have been widely publicized over recent days, including its direct payments and jobless benefits for individuals and a bailout fund with billions in aid meant for large and small businesses. However, a much less recognized part of the legislation is poised to have a major impact on addiction treatment providers and confidentiality of patient records.

The CARES Act makes significant changes to the current Federal law governing the confidentiality and use of substance use disorder patient records. 42 U.S.C. § 290dd-2; 42 C.F.R. Part 2 (both the law and corresponding regulations are commonly referred to simply as “Part 2”). The Act changes Part 2 so that it more closely conforms to the more recently enacted HIPAA Privacy and Security Rules. But it also adds new dimensions: heightened protections and penalties for use of SUD records in criminal and legal proceedings, as well as specific anti-discrimination protections. There has been movement over the past several years to modernize Part 2 and align its provisions with HIPAA, but the CARES Act surpasses even the 2017 revision and 2019 proposed rule changes.

The most significant changes ease a provider’s current Part 2 disclosure restrictions. With few exceptions, Part 2 requires patient consent or court order before SUD patient records can be disclosed to any third party. Also, any party who receives SUD patient records, even with patient consent, cannot re-disclose this information to any other party without specific consent to do so, by court order, or under narrow circumstances set forth in the law (like medical emergencies). On the other hand, under the HIPAA Privacy Rule, patient records can be disclosed — even without consent — for treatment, payment, and healthcare operations activities. For example, under HIPAA, a provider may use protected health information to provide healthcare to consult with other providers about the individual’s treatment and for billing purposes. Re-disclosure is also permitted.

Unlike HIPAA, the new legislation does still require consent for disclosure. However, only one initial disclosure will now be required for treatment, payment, and healthcare operations purposes. The true is same for subsequent re-disclosures. This alignment with HIPAA’s Privacy Rule should provide for greater access to and efficiency in payment for healthcare services for those seeking addiction treatment. The CARES Act also aligns Part 2 more closely with HIPAA in several other ways, including with respect to the Breach Notification Rule, notice and privacy practices, and accounting of disclosures.

Finally, the CARES Act also adds significant anti-discrimination protections for patients. These new provisions prohibit discriminating against any individual based on the information in addiction treatment records, including in admission to healthcare services, employment, or in housing service.

Though the changes to Part 2 did not come in a way that anyone could have predicted, many who have long sought these reforms are surely to be grateful that the sweeping CARES Act legislation took these important patient privacy matters into consideration.