WPF advises HHS on confidentiality of patient records re: alcohol and drug treatment records
The World Privacy Forum (WPF) submitted comments on an important Notice of Proposed Rulemaking that proposes modifications of the protection requirements for substance use disorder (SUD) treatment records. Currently, health records regarding treatment for Substance Use Disorders receive special protections under what is called Part 2 regulations, or, 42 CFR Part 2. The changes proposed in the NPRM seek to implement section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act.
Protecting Substance Use Disorder (SUD) treatment records from unwanted uses and disclosures in order to assure the individuals who are seeking treatment that they will not face prosecution or other unwanted consequences is certainly a worthy goal. Providing these greater assurances is obviously the primary objective of the changes to Part 2 directed by the CARES Act.
Existing Part 2 rules can and have created complex problems for the health care system and for others. For example, because the protections afforded by current Part 2 rules “follow the records” that are disclosed in accordance with Part 2, any entity that receives these records and who is not already a Part 2 provider faces a new and significant challenge. In some contexts, Part 2 records can be profoundly challenging for providers and others because of governance complexities and the potential for increased risks that they bring to some recipients. The core of the problem is that existing Part 2 rules are both different and stricter than the privacy rules otherwise applicable to health or other records that recipients maintain under broader HIPAA regulations.
In our comments, (PDF 10 pages) WPF noted that HHS should cover all Part 2 programs under HIPAA. This would include:
-
-
- HIPAA-covered entities;
- Part 2 programs subject to HIPAA;
- Part 2 programs not subject to HIPAA.
-
Other topics WPF discussed include de-identification, the need to improve the implementation of the right to request restrictions, the right to direct disclosures, and updating notices to link directly to 42 CFR Part 2 to assist patients in finding the relevant text that is referred to in privacy notices.
WPF also discussed the need for HHS to clearly define scientific research in the NPRM. WPF urged HHS to utilize the relevant section of foundational work already done to define scientific research, including the relevant definition of scientific research found in the Common Rule. HHS needs to adopt a strong definition of “scientific research” that sits comfortably in the existing legal canon.