Locke Lord QuickStudy: CARES Act Surprise: Substance Use Treatment Confidentiality Law Revised

The CARES Act made significant changes to the law governing the confidentiality of substance use treatment records. When the President signed the CARES Act on March 27, 2020, most of the focus was on the appropriations of significant financial assistance for health care providers, small businesses, airlines, universities, states, and local governments and to regulatory reforms, such as changes in telemedicine rules or coverage for diagnostic tests intended to make it easier for health care providers to care for patients during a pandemic. The changes to the substance use treatment record confidentiality law, while less well-known, are likely to have a significant impact on the health care system’s ability to provide coordinated care to patients suffering from substance use disorders. These changes will take effect on March 27, 2021.

Under prior law and associated regulations (sometime referred to as the “Part 2 Rules”), a federally assisted substance use treatment program was subject to very strict rules regarding the confidentiality of substance use treatment records, and most disclosures required a very specific, single use consent signed by the patient. Further, the confidentiality and consent requirements followed the information, so that recipients of the treatment records, such as hospitals, physicians, and health plans, became subject to the same consent requirements. Many health care providers felt that these special consent requirements greatly hampered care coordination for patients suffering from substance use disorders.  

The amendments include several key provisions. 

• Once a patient consents to the disclosure of his or her substance use treatment records to a HIPAA covered entity, then the covered entity or its business associate may disclose the records for treatment, payment or health care operations without obtaining further consent, so long as the disclosure is consistent with the HIPAA privacy regulations. Under prior law, any further disclosure for these purposes required an additional written consent.
  
  
• A patient may give written consents for all future uses of his or her treatment records for treatment, payment, or health care operations until the consent is revoked in writing. Under prior law, additional consents might have been needed, depending on the circumstances.
  
  
• Substance use treatment records may be disclosed to public health authorities on a de-identified basis, as defined by and in accordance with the de-identification standards under the HIPAA privacy rule.
  
  
• The ban on the use of substance use treatment records against patients in criminal proceedings has been extended to cover testimony in additional to written records, and the scope of the ban has been extended to civil, administrative, and legislative proceedings, and to applications for criminal warrants, as well. Prior law applied only to the use of records in criminal proceedings.
  
  
• Violations of the amended statute are now subject to the same civil monetary penalties and criminal penalties as apply to certain intentional violations of the HIPAA privacy rule. Under prior law, violations of the statute were minor criminal infractions, and enforcement was rare.
  
  
• The new law includes an anti-discrimination provision that bars discrimination against patients as a result of the disclosure of their substance use treatment records. The new law bars discrimination in the delivery of healthcare, employment, the receipt of workers ’ compensation benefits, the sale or rental of housing, access to courts, or access to social services and other government benefits.
  
  
• Breaches of substance use treatment records are now expressly subject to the HIPAA regulations governing breaches of unsecured protected health information. While this may have been true in most instances, the law will now apply to breaches occurring in substance use treatment programs that do not electronically bill health plans.

Overall, these amendments should greatly ease care coordination between substance use treatment programs and general medical providers, such as hospitals and physicians.  Additionally, many of the complexities of maintaining substance use treatment records have now been eliminated or reduced.  The flexibility created by these amendments will be welcomed by many health care providers and health plans.

At the same time, health care providers, health plans, and business associates should take note that the rules governing confidentiality of substance use treatment records will now be subject to the civil administrative penalties in the HIPAA privacy rule and that willful violations could be subject to the more severe criminal sanctions in the HIPAA statute, as well.

Visit our COVID-19 Resource Center often for up-to-date information to help you stay informed of the legal issues related to COVID-19.