CARES Act Changes Privacy Requirements Under 42 CFR Part 2

As part of the CARES Act, Congress made several significant changes to 42 CFR Part 2. As described in more detail below, the CARES Act brings Part 2 more in line with broader federal health care privacy laws (namely, HIPAA) by expanding the ability of providers to share substance use disorder records while simultaneously tightening the requirements in the event confidentiality is breached. The changes go into effect no later than March 27, 2021, by which time the U.S. Department of Health and Human Services is required to produce regulations implementing the statutory changes.

Below is a high-level summary of these changes:

1. Eases the ability of substance use disorder programs to disclose information with patient consent. Once a patient gives prior written consent, the contents of a record “may be used or disclosed by a covered entity, business associate, or a [Part 2 program] for purposes of treatment, payment, and health care operations as permitted by the HIPAA regulations.”  This means that a patient's consent no longer needs to identify who can receive the information by name. Instead, what is required is a general category or description of the recipient (as is permitted under HIPAA). This removes a significant barrier to information sharing.
2. Incorporates some of HIPAA's provisions into Part 2. 
   1. Breaches of records of Part 2 programs are subject to the same breach notification requirements that apply to breaches of HIPAA PHI. 
   2. Statutory civil and criminal penalties that apply to violations of HIPAA are now applicable to violations of Part 2.
   3. Part 2 programs must now provide a full notice of privacy practices, as opposed to just providing a written summary of Part 2's restrictions.
   4. All disclosures for treatment, payment, and health care operations are now subject to HIPAA rules guaranteeing individuals the right to an accounting of disclosures of PHI. 
3. Adds a new antidiscrimination provision that prohibits discrimination against an individual for several purposes (including, for example, the sale or rental of housing) on the basis of information received, whether intentionally or inadvertently, from Part 2 records.

This alert was prepared by Robinson Bradshaw's Behavioral Health Industry Team. For assistance understanding any of the legal developments highlighted in this update, please contact a member of our Health Care Practice Group.