COVID-19: CARES Act Makes Significant Changes to 42 CFR Part 2

The COVID-19 pandemic has prompted seismic changes to the way providers are allowed to handle substance-use disorder (SUD) information after years of affording it heightened confidentiality. The changes to so-called “Part 2” information are permanent and are not limited to the duration of the COVID-19 pandemic.

The important changes to the federal regulation found at 42 CFR Part 2—which governs the handling of SUD information—accomplish two things. First, SUD information is treated in a way more aligned with the Health Insurance Portability and Accountability Act (HIPAA). Second, the act contains strong anti-discrimination language to protect individuals who are receiving or have received SUD treatment.

One of the most significant changes made by the CARES Act is to allow the disclosing SUD information for treatment, payment, and health care operations (TPO) purposes with a patient’s written consent. Disclosing health information for these three purposes is obviously familiar to many providers who are subject to HIPAA and allows the disclosure of protected health information for many routine functions such as treating the patient, billing for services, and operating the practice or facility.

The CARES Act also states that, once SUD information is disclosed for a TPO reason, the information can then be re-disclosed as permitted by HIPAA. Under the current changes, a covered entity, business associate, or program that receives Part 2 information pursuant to a patient’s written consent may use or re-disclose the Part 2 information for TPO purposes without needing additional consent from the patient. Prior to the CARES Act, entities and individuals receiving information from a Part 2 program were generally prohibited from re-disclosing the information.

The CARES Act adopts another HIPAA provision by giving patients the right to request a restriction on using or disclosing SUD information for TPO purposes and also requires entities to “make every reasonable effort to the extent feasible to comply with a patient’s request” to restrict the disclosure. With that said, there are some important differences between what is permissible under the new CARES Act and the HIPAA TPO exceptions. Unlike the HIPAA TPO exceptions, providers will still be required to obtain written patient consent before disclosing SUD for any TPO purpose.

The CARES Act also allows disclosing SUD data to certain public health authorities as long as disclosures are consistent with HIPAA. In other words, the Part 2 information must be de-identified in accordance with HIPAA’s de-identification standards prior to disclosure. SUD entities must additionally follow HIPAA-required breach notification procedures. Practically, this provision only creates a change for the limited Part 2 information that was not already subject to HIPAA.

The CARES Act also creates additional protections for SUD information that are not required by HIPAA. The most important of these protections is the new anti-discrimination provision that prohibits using SUD information to discriminate against individuals relative to health care, employment, access to courts, access to social services benefits, and the sale or rental of housing. The CARES Act further prohibits, in broad fashion, any recipient of federal funds from discriminating against an individual on the basis of Part 2 information when providing services paid for by federal funds such as Medicare and Medicaid.

The CARES Act also states that SUD data cannot be used in various civil, criminal, administrative, or legislative proceedings without a court order or patient consent. It specifically replaces the narrower language in Part 2 (no use for initiation or substantiation of criminal charges or conduct of an investigation) with much broader regulatory language: no use or disclosure in any civil, criminal, administrative, or legislative proceeding. The broader language leaves little to no room for exceptions or interpretation.

So, what comes next? The CARES Act is effective immediately, and it requires the US Department of Health and Human Services (HHS) and the Substance Abuse and Mental Health Services Administration (SAMHSA) to revise Part 2 within 12 months. However, providers need to amend their policies and procedures accordingly now to comply with the requirements of the CARES Act.

If you have any questions regarding the content of this alert, please contact Eric Naegely, partner, at enaegely@barclaydamon.com or another member of the firm’s Health Care & Human Services Practice Area.

We also have a specific team of Barclay Damon attorneys who are actively working on assessing regulatory, legislative and other governmental updates related to COVID-19 and who are prepared to assist clients. You can reach our COVID-19 Response Team at COVID-19ResponseTeam@barclaydamon.com.