Coronavirus: CARES Act Takes Significant Step Toward Modernizing Part 2

In the Coronavirus Aid, Relief, and Economic Security (CARES) Act, Congress took another step forward in the 50-year tightrope walk between protecting SUD patients' privacy, in an effort to encourage them to seek SUD treatment, and allowing use and disclosure of patient information necessary to protect patients and others from harm and enable SUD treatment providers to operate.

The balancing act in Section 3221 of the CARES Act, a landmark stimulus bill providing for approximately $2 trillion to combat the impact of the coronavirus pandemic, is the first update in more than two decades to the enabling legislation for the regulations governing confidentiality of patient records related to SUD at 42 C.F.R. Part 2 (Part 2).

On the One Hand: Easier Disclosure of Information

Redisclosure for Treatment, Payment, Health Care Operations

Perhaps most significantly, the legislation expands the ability of covered entities (CEs) and business associates (BAs) (as defined by HIPAA), and federally assisted programs offering SUD treatment (Part 2 Programs) that receive SUD patient information pursuant to the patient's written consent to redisclose that information for treatment, payment, and health care operations purposes.

What Did the Law Say About Redisclosure Before the CARES Act?

Prior to passage of the CARES Act, and still today, federal law prohibits Part 2 Programs from disclosing information that would identify a patient as having (or having had) an SUD (Part 2 Information) without the patient's prior written consent, unless an exception applies. (42 U.S.C. § 290dd-2(a); 42 C.F.R. § 2.12)

Notably, there is no exception for routine disclosures of Part 2 Information for purposes of treatment, payment, and health care operations, meaning such disclosures require the patient to complete and sign a Part 2–compliant consent form prior to the disclosure.

Prior to the CARES Act, an individual or entity receiving Part 2 Information from a Part 2 Program pursuant to a patient's written consent (a Lawful Holder) was generally prohibited from redisclosing the Part 2 Information unless the patient consented in writing prior to the redisclosure or an exception to the Part 2 restrictions applied. (42 C.F.R. § 2.12(d)(2); 42 C.F.R. § 2.32)

If a patient consented to disclosure of his or her Part 2 Information to a Lawful Holder for purposes of payment or health care operations, Part 2 allowed the Lawful Holder to redisclose the Part 2 Information to contractors, subcontractors, or legal representatives without consent—but only as needed to carry out payment or health care operations of the Lawful Holder. (42 C.F.R. § 2.33(b))

How Does the CARES Act Change the Law Vis-à-vis Redisclosure?

Now, under the CARES Act, a CE, BA, or Part 2 Program that receives Part 2 Information pursuant to a patient's written consent may use or redisclose the Part 2 Information for purposes of treatment, payment, or health care operations without additional consent by the patient, as allowed by HIPAA. (42 U.S.C. § 290dd-2(b)(1)(B)) Once the recipient CE, BA, or Part 2 Program rediscloses the information, the information may be further redisclosed without the patient's additional consent, as long as the further redisclosure is in accordance with the requirements and restrictions of HIPAA. (42 U.S.C. § 290dd-2(b)(1)(B))

The CARES Act also states that a patient can give consent once for "all such future uses or disclosures for purposes of treatment, payment, and health care operations," which consent is valid until revoked by the patient in writing. (42 U.S.C. § 290dd-2(b)(1)(C))

Open Questions Regarding Redisclosure in the CARES Act Provisions

The CARES Act provisions leave questions open related to redisclosure of Part 2 Information, presumably to be addressed in regulations implementing the amendments. For example:

• The new law does not state whether redisclosures by CEs, BAs, or Part 2 Programs are only allowed for purposes identified in the original patient consent. For example, if a patient consents to disclosure of Part 2 Information to a CE for treatment purposes, can the covered entity then use and disclose that Part 2 Information for its health care operations without further consent by the patient? Or would the patient consent have to state that the disclosure, and any future disclosures, can be for the purposes of treatment, payment, or health care operations?
• Similarly, is redisclosure allowed by a CE, BA, or Part 2 Program that receives the Part 2 Information if the patient consent only identifies the initial recipient? Or does the patient consent have to authorize the initial recipient and any entity to which the initial recipient rediscloses the Part 2 Information for treatment, payment, or health care operations?

Disclosure to Public Health Authorities

The CARES Act also creates a new exception for the disclosure of Part 2 Information without a patient's prior written consent to a public health authority (as defined by HIPAA), provided that the Part 2 Information must be de-identified in accordance with HIPAA's de-identification standards prior to disclosure. (42 U.S.C. § 290dd-2(b)(2)(D))

On the Other Hand: Greater Protection for Patients

Limits on Use in Criminal, Civil, and Administrative Contexts

The CARES Act strengthens protections for SUD patients by further limiting uses or disclosures of Part 2 Information in judicial and administrative proceedings.

What Did the Law Say About Use and Disclosure in Proceedings Before the CARES Act?

Previously, federal statute prohibited the use of Part 2 Information "to initiate or substantiate any criminal charges against a patient or to conduct any investigation of a patient" absent a court order authorizing disclosure. The Part 2 regulations extend this concept, prohibiting the use or disclosure of Part 2 Information "in any civil, criminal, administrative, or legislative proceedings conducted by any federal, state, or local authority," unless either the patient provides written consent to such use or disclosure or another exception to Part 2 is applicable. (42 C.F.R. § 2.13(a))

How Does the CARES Act Change the Law Vis-à-vis Use and Disclosure in Proceedings?

The CARES Act replaces the narrower language in the statute (no use for initiation or substantiation of criminal charges or conduct of an investigation) with the broader regulatory language (no use or disclosure in any civil, criminal, administrative, or legislative proceeding), and the new statutory language extends the prohibition beyond protected records to "testimony relaying the information contained therein." (42 U.S.C. § 290dd-2(c)) The new statutory language also provides several examples of prohibited uses and disclosures in proceedings.

Antidiscrimination on the Basis of Part 2 Information

The CARES Act adds a robust antidiscrimination provision applicable to entities receiving Part 2 Information, whether intentionally or inadvertently. (42 U.S.C. § 290dd-2(i)(1)) Specifically, entities cannot discriminate against an individual on the basis of the Part 2 Information in:

• Admission, access to, or treatment for health care. (42 U.S.C. § 290dd-2(i)(1)(A))
• Hiring, firing, or terms of employment or receipt of workers' compensation. (42 U.S.C. § 290dd-2(i)(1)(B))
• The sale, rental, or continued rental of housing. (42 U.S.C. § 290dd-2(i)(1)(C))
• Access to federal, state, or local courts. (42 U.S.C. § 290dd-2(i)(1)(D))
• Access to, approval of, or maintenance of social services and benefits provided or funded by federal, state, or local governments. (42 U.S.C. § 290dd-2(i)(1)(E))

More broadly, the statute prohibits any recipient of federal funds from discriminating against an individual on the basis of Part 2 Information when providing services paid for by the federal funds. (42 U.S.C. § 290dd-2(i)(2))

Breach Notification

The CARES Act makes the breach notification provisions of the Health Information Technology and Clinical Health (HITECH) Act applicable to unauthorized uses and disclosures of Part 2 Information, in the same way the breach notification provisions of the HITECH Act apply to breaches of unsecured protected health information (as those terms are defined by HIPAA). (42 U.S.C. § 290dd-2(j)) Practically, this provision of the CARES Act only creates a change for the limited subset of Part 2 Programs that are not already subject to HIPAA.

What's Next?

The CARES Act requires the Department of Health and Human Services (HHS), in consultation with the Substance Abuse and Mental Health Services Administration (SAMHSA), to revise Part 2 within 12 months in order to comply with the amendments that the CARES Act makes to Section 543 of the Public Health Service Act. (CARES Act Section 3221(i)(1))

While the regulatory implementation of the CARES Act provisions will ultimately determine their impact, this long-awaited change to Part 2's enabling legislation appears to be a meaningful step in modernizing the continuous balancing act that is Part 2.

For more information on how this issue may affect your business or related matters, please contact Michaela Poizner, or any member of Baker Donelson's Health Law Group. Also, for more information visit the Coronavirus (COVID-19): What You Need to Know information page on our website.