On March 27th 2020, congress passed the CARES Act. This legislation contained unexpected surprises for the addiction treatment community in the form of long-awaited updates to 42 C.F.R. Part 2, commonly referred to simply as “Part 2.” These changes are “good news” for the community in that they will make operations more efficient, but they do require providers to make some important changes to their ROI forms and disclosure procedures.
Part 2 governs all of the special privacy laws that addiction treatment providers must follow when storing and disclosing patient SUD records. Part 2 was designed to address the specific concerns of addiction treatment for patients who are anxious about privacy issues when it comes to their medical records and substance use.
Part 2 always had a complicated relationship to HIPAA, which also governs addiction treatment records. The new updates to the CARES Act streamlines Part 2’s relationship to HIPAA and makes it a little easier for addiction treatment providers to disclose SUD records under certain situations.
Today, we’ll look at the 3 big changes that the CARES act made to Part 2 and learn what action steps addiction treatment providers need to take in response to these changes.
The CARES Act Loosend Part 2 Disclosure Restrictions
The biggest changes the CARES Act made to Part 2 are with regards to the disclosure restrictions on SUD records.
Before the CARES Act was passed, Part 2 required a court order or patient consent for each and every disclosure of SUD patient records to a third party. No re-disclosure was allowed, except with another court order or in case of a true medical emergency.
While well-meaning, these rules made some aspects of billing and coordination of care very awkward and inefficient for addiction treatment providers. Part 2 rules went above and beyond standard HIPAA laws, which allow re-disclosure of PHI for the purposes of payment, treatment, and healthcare operations activities.
The CARES Act updated Part 2’s rules around disclosure to more closely conform to standard HIPAA disclosure laws. Consent is still absolutely required for any disclosure, but only once. After a patient gives consent to disclose their SUD records to a third party, that consent can be used to justify subsequent disclosures to that third party. These changes will make payment for healthcare services much more efficient for addiction treatment providers.
The CARES Act Updates Part 2’s Anti-Discrimination Provisions
While there are many anti-discrimination laws that apply to those suffering from SUD, the CARES Act strengthened these protections for our patients. The CARES Act’s anti-discrimination provisions forbid any discrimination against our patients based on information contained in their medical records. These anti-discrimination provisions explicitly extend to important areas such as healthcare access, hiring and firing decisions in the work place, and housing discrimination protections.
The CARES Act Includes a Part 2 Breach Notification Rule
The last major change the CARES act made to Part 2 concerns “breach notification.” In the event that a patient’s records are improperly “leaked” without consent, addiction treatment providers are now required to follow HIPAA procedures for breach notifications. For most addiction treatment providers, this won’t affect operating procedures much, as HIPAA laws already co-govern the addiction treatment community. It is worth noting, however, that these changes mean that there are now two pieces of addiction treatment law that absolutely require providers to execute breach notifications if improper PHI disclosures are detected.
What Happens Now?
The US Department of Health and Human Services and SAMHSA have until March 2021 to implement the CARES Act changes to Part 2. Although addiction treatment providers won’t see revised guidance from those organizations until then, it’s a good idea to start thinking now about what changes you’ll need to make to the relevant policies and procedures at your organization.
Who will be in charge of monitoring changes? How will you know when it’s time to make those changes?
We’re Here to Help
If you don’t want to have to track changes to Part 2 and go through the process of revising all of your consent forms by hand, why not leave the details to us?
At BehaveHealth, we’re staying on top of the situation and all of our easy-fill cloud-based forms will automatically update to conform with the new Part 2 changes to keep your addiction treatment business 100% compliant and up-to-date with all privacy laws. You won’t even have to think about it. The changes will happen automatically.
Why not give BehaveHealth’s all-in-one software solution designed especially for addiction treatment providers a try today? Claim your free trial now.