Skip to Main Content
Services Talent Knowledge
Site Search
Menu

Alert

Our attorneys stay on top of changes in legislation, agency regulations, case law, and industry trends—then craft timely legal alerts to keep clients up to date on legal developments important to their business.

April 2, 2020

COVID-19: CARES Act Makes Significant Changes to 42 CFR Part 2

The COVID-19 pandemic has prompted seismic changes to the way providers are allowed to handle substance-use disorder (SUD) information after years of affording it heightened confidentiality. The changes to so-called “Part 2” information are permanent and are not limited to the duration of the COVID-19 pandemic. 

The important changes to the federal regulation found at 42 CFR Part 2—which governs the handling of SUD information—accomplish two things. First, SUD information is treated in a way more aligned with the Health Insurance Portability and Accountability Act (HIPAA). Second, the act contains strong anti-discrimination language to protect individuals who are receiving or have received SUD treatment. 

One of the most significant changes made by the CARES Act is to allow the disclosing SUD information for treatment, payment, and health care operations (TPO) purposes with a patient’s written consent. Disclosing health information for these three purposes is obviously familiar to many providers who are subject to HIPAA and allows the disclosure of protected health information for many routine functions such as treating the patient, billing for services, and operating the practice or facility. 

The CARES Act also states that, once SUD information is disclosed for a TPO reason, the information can then be re-disclosed as permitted by HIPAA. Under the current changes, a covered entity, business associate, or program that receives Part 2 information pursuant to a patient’s written consent may use or re-disclose the Part 2 information for TPO purposes without needing additional consent from the patient. Prior to the CARES Act, entities and individuals receiving information from a Part 2 program were generally prohibited from re-disclosing the information.

The CARES Act adopts another HIPAA provision by giving patients the right to request a restriction on using or disclosing SUD information for TPO purposes and also requires entities to “make every reasonable effort to the extent feasible to comply with a patient’s request” to restrict the disclosure. With that said, there are some important differences between what is permissible under the new CARES Act and the HIPAA TPO exceptions. Unlike the HIPAA TPO exceptions, providers will still be required to obtain written patient consent before disclosing SUD for any TPO purpose.

The CARES Act also allows disclosing SUD data to certain public health authorities as long as disclosures are consistent with HIPAA. In other words, the Part 2 information must be de-identified in accordance with HIPAA’s de-identification standards prior to disclosure. SUD entities must additionally follow HIPAA-required breach notification procedures. Practically, this provision only creates a change for the limited Part 2 information that was not already subject to HIPAA.

The CARES Act also creates additional protections for SUD information that are not required by HIPAA. The most important of these protections is the new anti-discrimination provision that prohibits using SUD information to discriminate against individuals relative to health care, employment, access to courts, access to social services benefits, and the sale or rental of housing. The CARES Act further prohibits, in broad fashion, any recipient of federal funds from discriminating against an individual on the basis of Part 2 information when providing services paid for by federal funds such as Medicare and Medicaid.

The CARES Act also states that SUD data cannot be used in various civil, criminal, administrative, or legislative proceedings without a court order or patient consent. It specifically replaces the narrower language in Part 2 (no use for initiation or substantiation of criminal charges or conduct of an investigation) with much broader regulatory language: no use or disclosure in any civil, criminal, administrative, or legislative proceeding. The broader language leaves little to no room for exceptions or interpretation.

So, what comes next? The CARES Act is effective immediately, and it requires the US Department of Health and Human Services (HHS) and the Substance Abuse and Mental Health Services Administration (SAMHSA) to revise Part 2 within 12 months. We recommend that providers wait until SAMHSA releases its revisions to Part 2 before revising their policies and procedures.  We are following this issue and will be alerting providers when the revised regulations are released.

If you have any questions regarding the content of this alert, please contact Eric Naegely, partner, at enaegely@barclaydamon.com or another member of the firm’s Health Care & Human Services Practice Area.

We also have a specific team of Barclay Damon attorneys who are actively working on assessing regulatory, legislative and other governmental updates related to COVID-19 and who are prepared to assist clients. You can reach our COVID-19 Response Team at COVID-19ResponseTeam@barclaydamon.com.
 

Subscribe

Click here to sign up for alerts, blog posts, and firm news.

Subscribe

Sign up to receive our latest news via email

Practice Areas

Featured Industries

New & Emerging Industry Practice Areas

Other

View our Privacy Policy

Featured Media

Alerts

COVID-19: SBA Releases Additional FAQs on Paycheck Protection Program Forgiveness

Alerts

NYSERDA Announces 2020 Offshore Wind Solicitation

Alerts

NYS Home Care Providers Face Uncertain Future

Alerts

Legislation Limiting Immunity for COVID-19-Related Health Care Services Advances to NYS Governor's Desk

Alerts

NYSERDA Announces Procurement for Land-Based Renewable Projects and RECs

Alerts

COVID-19: NYS Business and Not-for-Profit Corporations May Hold Virtual Shareholder, Member Meetings for the Time Being

This site uses cookies to give you the best experience possible on our site and in some cases direct advertisements to you based upon your use of our site.

By clicking [I agree], you are agreeing to our use of cookies. For information on what cookies we use and how to manage our use of cookies, please visit our Privacy Statement.

I AgreeOpt-Out