On March 27, 2020, President Trump signed the Coronavirus Aid, Relief and Economic Security Act (the “CARES Act”) into law. Section 3221 “Confidentiality and Disclosure of Records Relating to Substance Use Disorder” of the CARES Act ratified fundamental changes to the Public Health Service Act which govern the confidentiality requirements of substance use disorder (“SUD”) records, 42 C.F.R. Part 2 (“Part 2”). The changes are significant and align with the increasing movement to align the Part 2 rules with HIPAA. The CARES Act requires the HHS to revise the Part 2 regulations within 12 months to comply with the CARES Act.
Given the massive amount of stress, financial difficulties, anxiety, potential health issues and uncertainty generated by the pandemic and the governments’ unprecedented lock-down of the economy, it is almost a certainty that health care professionals and providers will be dealing with mental health and potentially substance abuse issues on a far larger basis than ever before. Thus, they need to be aware that Section 3221 changes this to allow SUD records to be “used or disclosed by a covered entity, business associate, or a Part 2 program . . . for purposes of treatment, payment, and health care operations as permitted by HIPAA” after the provider receives a broad consent. Because the changes provide that all disclosures for treatment, payment, and health care operations of SUD records are subject to the HIPAA rules, individuals have the right to an accounting of disclosures of such records as they would under HIPAA.
Section 3221 requires the Secretary of Health and Human Services to update 45 C.F.R. § 164.520 (Notice of Privacy Practices (“NPP”) requirements for Covered Entities) to require Part 2 programs to provide NPPs to patients. Section 3221 carries over the breach notification requirements that apply to Covered Entities under HIPAA to also apply to Part 2 programs. From a practical perspective, this would only affect those providers who were not also Covered Entities under HIPAA. Section 3221 allows the disclosure of de-identified SUD records to a public authority, so long as the de-identification complies with the HIPAA regulations at 45 CFR § 164.514(b).
In addition to CARES Act and HIPAA considerations, Florida professionals and providers would be well served to keep in mind that substance abuse and mental health matters and information are considered “super-confidential” categories of PHI and patient information. Thus, Florida health care professionals and providers should remain aware of the specific requirements for those types of information and how such information can be released in emergent/emergency situations, matters involving emancipated minors, and public health and law enforcement cases.
The civil and criminal penalties for violating Part 2 were changed to be consistent with HIPAA, which means an increase in the penalties currently mandated by Part 2. Violators now face a maximum fine of $50,000 and one year in prison for wrongful disclosure of SUD information with heighted penalties if false pretenses were involved or the information was used for personal gain or to cause malicious harm .
Our best to all of you out there taking care of patients and protecting us in these difficult and unsettling times. Stay safe!
The Healthcare Team at Lowe & Evander, P.A. understand the hard work and sacrifices it takes to become a health professional or provider and aggressively defend health professionals regarding protecting their license, practice, career, assets and reputation. Using our experience and expertise, we navigate the obstacles our clients face, serving not only as their attorneys, but also as their legal strategists, trusted advisors and protectors of their rights and interest against government investigations and lawsuits when necessary, and we help chart a course through the maze of state and federal health care laws, rules and regulations.
The information provided in this article does not, and is not intended to, constitute legal advice; instead, all information and content in this article are intended to convey general informational only and may not constitute the most up-to-date legal or other information. Readers of this article should contact their attorney to obtain advice with respect to any particular legal matter. No reader of this article should act or refrain from acting on the basis of information in this article without first seeking legal advice from counsel in the relevant jurisdiction. Only your individual attorney can provide assurances that the information contained herein – and your interpretation of it – is applicable or appropriate to your particular situation.
Michael R. Lowe, Esquire is a Florida board-certified health law attorney at Lowe & Evander, P.A. Brian C. Evander , Esquire and Mr. Lowe regularly represent providers, physicians and other licensed health care professionals, and facilities in a wide variety of health care law matters.
For more information regarding those health care law and such matters please visit our website www.lowehealthlaw.com or call our office at (407) 332-6353.