# Confidentiality of Substance Use Disorder (SUD) Patient Records > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2022-25784 ## Record - **Collection:** Federal Register - **Document type:** Proposed Rule - **Published:** December 2, 2022 - **Citation:** 87 FR 74216 ## Text DEPARTMENT OF HEALTH AND HUMAN SERVICES Office of the Secretary 42 CFR Part 2 45 CFR Part 164 RIN 0945-AA16 Confidentiality of Substance Use Disorder (SUD) Patient Records AGENCY: Office for Civil Rights (OCR), Office of the Secretary, Department of Health and Human Services; Substance Abuse and Mental Health Services Administration (SAMHSA), Department of Health and Human Services. ACTION: Notice of proposed rulemaking. SUMMARY: The Department of Health and Human Services (HHS or “the Department”) is issuing this notice of proposed rulemaking (NPRM) to solicit public comment on its proposal to modify its regulations to implement section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act. DATES: Comments due on or before January 31, 2023. ADDRESSES: Written comments may be submitted through any of the methods specified below. Please do not submit duplicate comments. • Federal eRulemaking Portal: You may submit electronic comments at http://www.regulations.gov by searching for the Docket ID number HHS-OCR-0945-AA16. Follow the instructions at http://www.regulations.gov for submitting electronic comments. Attachments should be in Microsoft Word or Portable Document Format (PDF). • Regular, Express, or Overnight Mail: You may mail written comments (one original and two copies) to the following address only: U.S. Department of Health and Human Services, Office for Civil Rights, Attention: SUD Patient Records, Hubert H. Humphrey Building, Room 509F, 200 Independence Avenue SW, Washington, DC 20201. Inspection of Public Comments: All comments received by the accepted methods and due date specified above may be posted without change to content to http://www.regulations.gov, which may include personal information provided about the commenter, and such posting may occur after the closing of the comment period. However, the Department may redact certain content from comments before posting, including threatening language, hate speech, profanity, graphic images, or individually identifiable information about a third-party individual other than the commenter. Because of the large number of public comments normally received on Federal Register documents, OCR is not able to provide individual acknowledgments of receipt. Please allow sufficient time for mailed comments to be received timely in the event of delivery or security delays. Please note that comments submitted by fax or email and those submitted after the comment period will not be accepted. In addition, comments that are labeled as confidential business information or whose disclosure to the public is restricted by statute will not be accepted. Docket: For complete access to background documents or posted comments, go to http://www.regulations.gov and search for Docket ID number HHS-OCR-0945-AA16. FOR FURTHER INFORMATION CONTACT: Lester Coffer at (800) 368-1019 or (800) 537-7697 (TDD). SUPPLEMENTARY INFORMATION: The discussion below includes an Executive Summary and overview describing the need for the proposed rules, a description of the statutory and regulatory background of the proposed rules, a section-by-section description of the proposed modifications, and the impact statement and other required regulatory analyses. The Department solicits public comment on all aspects of the proposed rules. Persons interested in commenting on the provisions of the proposed rules can assist the Department by preceding discussion of any particular provision or topic with a citation to the section of the proposed rule being discussed. Table of Contents I. Executive Summary A. Overview B. Effective and Compliance Dates C. Summary of Major Proposals II. Background and Need for Proposed Rule A. Statutory and Regulatory Background B. Earlier Efforts To Align Part 2 With the HIPAA Rules C. Section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act III. Section-by-Section Description of Proposed Amendments to 42 CFR Part 2 A. § 2.1—Statutory Authority for Confidentiality of Substance Use Disorder Patient Records B. § 2.2—Purpose and Effect C. § 2.3—Civil and Criminal Penalties for Violations (Proposed Heading) D. § 2.4—Complaints of Violations (Proposed Heading) E. § 2.11—Definitions F. § 2.12—Applicability G. § 2.13—Confidentiality Restrictions and Safeguards H. § 2.14—Minor Patients I. § 2.15—Patients Who Lack Capacity and Deceased Patients (Proposed Heading) J. § 2.16—Security for Records and Notification of Breaches (Proposed Heading) K. § 2.17—Undercover Agents and Informants L. § 2.19—Disposition of Records by Discontinued Programs M. § 2.20—Relationship to State Laws N. § 2.21—Relationship to Federal Statutes Protecting Research Subjects Against Compulsory Disclosure of Their Identity O. § 2.22— Notice to Patients of Federal Confidentiality Requirements; and 45 CFR 164.520—Notice of Privacy Practices for Protected Health information P. § 2.23 —Patient Access and Restrictions on Use and Disclosure (Proposed Heading) Q. § 2.24—Requirements for Intermediaries (Redesignated and Proposed Heading) R. § 2.25—Accounting of Disclosures (Proposed Heading) S. § 2.26—Right To Request Privacy Protection for Records (proposed Heading) T. Subpart C—Uses and Disclosures With Patient Consent (Proposed Heading) U. § 2.31—Consent Requirements V. § 2.32—Notice To Accompany Disclosure (Proposed Heading) W. § 2.33—Uses and Disclosures Permitted With Written Consent (Proposed Heading) X. § 2.34 —Uses and Disclosures To Prevent Multiple Enrollments (Proposed Heading) Y. § 2.35—Disclosures to Elements of the Criminal Justice System Which Have Referred Patients Z. Subpart D—Uses and Disclosures Without Patient Consent (Proposed Heading) AA. § 2.51—Medical Emergencies BB. § 2.52—Scientific Research (Proposed Heading) CC. § 2.53—Management Audits, Financial Audits, and Program Evaluation (Proposed Heading) DD. § 2.54—Disclosures for Public Health (Proposed Heading) EE. Subpart E—Court Orders Authorizing Use and Disclosure (Proposed Heading) FF. § 2.61—Legal Effect of Order GG. § 2.62— Order Not Applicable to Records Disclosed Without Consent to Researchers, Auditors and Evaluators HH. § 2.63—Confidential Communications II. § 2.64—Procedures and Criteria for Orders Authorizing Uses and Disclosures for Noncriminal Purposes (Proposed Heading) JJ. § 2.65—Procedures and Criteria for Orders Authorizing Use and Disclosure of Records To Criminally Investigate or Prosecute Patients (Proposed Heading) KK. § 2.66—Procedures and Criteria for Orders Authorizing Use and Disclosure of Records To Investigate or Prosecute a Part 2 Program or Person Holding the Records (Proposed Heading) LL. § 2.67—Orders Authorizing the Use of Undercover Agents and Informants To Investigate Employees or Agents of a Part 2 Program in Connection With a Criminal Matter MM. § 2.68—Report to the Secretary (Proposed Heading) IV. Request for Comments V. Public Participation VI. Regulatory Impact Analysis A. Executive Orders 12866 and 13563 and Related Executive Orders on Regulatory Review 1. Summary of the Proposed Rule 2. Need for the Proposed Rule 3. Cost-Benefit Analysis 4. Consideration of Regulatory Alternatives 5. Request for Comments on Costs and Benefits B. Regulatory Flexibility Act C. Unfunded Mandates Reform Act D. Executive Order 13132—Federalism E. Assessment of Federal Regulation and Policies on Families F. Paperwork Reduction Act of 1995 1. Explanation of Estimated Annualized Burden Hours for 42 CFR Part 2 2. Explanation of Estimated Capital Expenses for 42 CFR Part 2 3. Explanation of Estimated Annualized Burden Hours for 45 CFR 164.520 Executive Summary Overview In this Notice of Proposed Rulemaking (NPRM), the Department proposes to modify certain provisions of part 2 of title 42 of the Code of Federal Regulations (42 CFR part 2 or “Part 2”) 1 to implement statutory amendments to section 290dd-2 of title 42 United States Code (42 U.S.C. 290dd-2) enacted in section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act. 2 1 For readability, the Department refers to specific sections of 42 CFR part 2 using a shortened citation with the “§ ” symbol except where necessary to distinguish title 42 citations from other CFR titles, such as title 45 CFR, and in footnotes where the full reference is used. 2 Public Law 116-136, 134 Stat. 281 (March 27, 2020). Part 2 currently imposes different requirements for substance use disorder (SUD) treatment records protected by Part 2 (“Part 2 records”) 3 than the Health Insurance Portability and Accountability Act of 1996 (HIPAA) 4 Privacy, Security, Breach Notification, and Enforcement Rules (“HIPAA Rules”) 5 apply to protected health information (PHI). 6 The statutory and regulatory schemes apply to different types of entities and create dual obligations and compliance challenges for HIPAA covered entities 7 and business associates 8 that maintain PHI and Part 2 records, and thus are subject to both sets of rules. 9 Treatment providers have also expressed concerns that they lack access to complete information when treating patients. 10 Section 290dd-2, as amended by section 3221 of the CARES Act, aligns certain Part 2 requirements more closely to requirements of the HIPAA Rules to improve the ability of entities that are subject to Part 2 to use and disclose Part 2 records and makes other changes to Part 2, as described in this preamble. 3 See 42 U.S.C. 290dd-2(a). “Records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance use disorder education, prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States shall, except as provided in subsection (e), be confidential and be disclosed only for the purposes and under the circumstances expressly authorized under subsection (b)”. 4 See the Administrative Simplification provisions of title II, subtitle F, of HIPAA (Public Law 104-191), 110 Stat. 1936 (August 21, 1996) which added a new part C to title XI of the Social Security Act (secs.1171-1179 of the Social Security Act, 42 U.S.C. 1320d-1320d-8), as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as title XIII of division A and title IV of division B of the American Recovery and Reinvestment Act of 2009 (ARRA), Public Law 111-5, 123 Stat. 226 (February 17, 2009). 5 See the Privacy Rule, 45 CFR parts 160 and 164, subparts A and E; the Security Rule 45 CFR parts 160 and 164, subparts A and C; the Breach Notification Rule, 45 CFR part 164, subpart D; and the Enforcement Rule, 45 CFR part 160, subparts C, D, and E. Breach notification requirements were added by the HITECH Act. 6 PHI is individually identifiable health information maintained or transmitted by or on behalf of a HIPAA covered entity. See 45 CFR 160.103 (definitions of “Individually identifiable health information ” and Protected health information ” ). 7 Covered entities are health care providers who transmit health information electronically in connection with any transaction for which the Department has adopted an electronic transaction standard, health plans, and health care clearinghouses. See 45 CFR 160.103 (definition of “Covered entity”). 8 A business associate is a person, other than a workforce member, that performs certain functions or activities for or on behalf of a covered entity, or that provides certain services to a covered entity involving the disclosure of PHI to the person. See 45 CFR 160.103 (definition of “Business associate”). 9 See “Part 2 Proposed Rule Brings Clarity and Reduces Regulatory Burdens for Substance Use Disorder Providers, but Challenges Remain” (September 2019), https://www.mintz.com/insights-center/viewpoints/2146/2019-09-part-2-proposed-rule-brings-clarity-and-reduces-regulatory; “HIPAA: A Trap for the Unwary” (May 2014), https://www.dykema.com/resources-alerts-HIPAA-A-Trap-for-the-Unwary_5-2014.html; and correspondence from Partnership to Amend 42 CFR part 2 (March 2019), https://www.pcpcc.org/sites/default/files/news_files/Response%20from%20Partnership%20to%20Amend%2042%20CFR%20Part%202.pdf. 10 See Published Comments—Request for Public Comment on the Confidentiality of Alcohol and Drug Abuse Patient Records, 79 FR 26929 (May 2014) Document 26, (June 23, 2014) at page 20, https://www.samhsa.gov/sites/default/files/about_us/who_we_are/comments-100-120.pdf; “Privacy Laws are Hurting the Care of Patients with Addiction” (July 2018 ), https://www.statnews.com/2018/07/13/privacy-laws-patients-addiction/. Paragraphs (b), (c), and (f) of section 290dd-2, as amended by section 3221 of the CARES Act, contain modified or new requirements for patient consent and redisclosure of Part 2 records; 11 new rights to obtain an accounting of disclosures made with consent 12 and to request restrictions on disclosures; 13 greater restrictions against the use and disclosure of records in civil, criminal, administrative, and legislative proceedings against patients; 14 and new civil money penalties (CMPs) for violations of Part 2. 15 Paragraphs (i), (j), and (k) of section 290dd-2, as amended by section 3221 of the CARES Act, add new requirements to prohibit discrimination, 16 impose breach notification obligations, 17 and incorporate definitions from the HIPAA Rules into Part 2. 18 Finally, section 3221(i) of the CARES Act requires the Department to update its Notice of Privacy Practices (NPP) requirements in the HIPAA Privacy Rule (“Privacy Rule”) at 45 CFR 164.520 to address uses and disclosures of Part 2 records and individual rights with respect to those records. 19 This NPRM contains proposals to implement the CARES Act provisions relating to health information privacy; the Department intends to develop a separate rulemaking to implement the CARES Act antidiscrimination prohibitions. 11 42 U.S.C. 290dd-2(b)(1). 12 42 U.S.C. 290dd-2(b)(1)(B). 13 42 U.S.C. 290dd-2(b)(1)(D). Additionally, section 3221 of the CARES Act further emphasizes the patient's right to request restrictions on disclosures in both the Rules of Construction and the Sense of Congress. See CARES Act secs. 3221(j)(1) and (k)(2), respectively. 14 42 U.S.C. 290dd-2(c). 15 42 U.S.C. 290dd-2(f). 16 CARES Act sec. 3221(g) added paragraph (i) to 42 U.S.C. 290dd-2 to insert an express prohibition against discrimination on the basis of information received pursuant to a disclosure of records. See 42 U.S.C. 290dd-2(i). 17 42 U.S.C. 290dd-2(j). 18 42 U.S.C. 290dd-2(k). 19 CARES Act sec. 3221(i)(2). In addition to changes mandated by the CARES Act, the Department proposes to address concerns about potential unintended consequences for government agencies of the change in enforcement authority and penalties for violations of Part 2. Specifically, the Department proposes to create a limitation on liability for agencies and persons acting on their behalf, that investigate and prosecute Part 2 programs (to be defined as “investigative agencies”) and unknowingly receive records subject to Part 2 before applying for the requisite court order, provided they first exercise reasonable diligence by attempting to determine if the targeted provider is a Part 2 program. The proposal would permit investigative agencies to seek a court order after obtaining records in such situations. An additional proposal would require agencies using this safe harbor to report annually to the Secretary. Effective and Compliance Dates The proposed effective date of a final rule would be 60 days after publication and the compliance date would be 22 months after the effective date. Entities subject to a final rule would have until the compliance date to establish and implement policies and practices to achieve compliance. Part 2 does not contain a standard compliance period for changes to the regulations; however, the HIPAA Rules generally require covered entities and business associates to comply with new or modified standards or implementation specifications no later than 180 days from the effective date of any such standards or implementation specifications, except as otherwise provided ( e.g., in a specific rulemaking). 20 While the proposed rule would make only minor modifications to the Privacy Rule, the Department proposes to provide the same, substantial compliance period for both the proposed modifications to 45 CFR 164.520 and the more extensive Part 2 modifications. Accordingly, the Department would begin enforcement of the new and revised standards, in both regulations, 24 months after publication of a final rule. This compliance period would allow Part 2 programs to revise existing policies and practices, complete other implementation requirements, and train their workforce members on the changes, as well as minimize administrative burdens on entities subject to the Privacy Rule. 20 See 45 CFR 160.105. The Department requests comment on whether the 22-month compliance period is an appropriate length of time for entities subject to a final rule to come into compliance and any benefits or unintended adverse consequences for entities or individuals of a shorter or longer compliance period. Additionally, for the proposed accounting of disclosures requirements, the Department proposes to toll the compliance date for Part 2 programs until the effective date of a final rule on the HIPAA accounting of disclosures standard, 45 CFR 164.528. This would ensure that Part 2 programs do not incur new compliance obligations before covered entities and business associates under the Privacy Rule are obligated to comply. Summary of Major Proposals The Department proposes the following changes to 42 CFR part 2 that revise, delete, replace, or add sections to implement statutory requirements enacted pursuant to section 3221 of the CARES Act. The Department also proposes to amend 42 CFR part 2 to reflect applicable standards in the HIPAA Rules, reflect language used in the HIPAA Rules, align regulatory text with statutory spelling, 21 and improve clarity or readability. Additionally, the Department proposes to modify the NPP requirements in 45 CFR 164.520 consistent with section 3221(i) of the CARES Act. 21 42 U.S.C. 290dd-2(b)(1)(B) provides in part that “[a]ny information so disclosed may be redisclosed in accordance with the HIPAA regulations.” To align with the statute's spelling of the term “redisclosed” and for drafting consistency, the Department proposes to modify the term “re-disclosed” (and related root words) to remove the hyphen, where appropriate, throughout this document. See, e.g., proposed §§ 2.12(d)(2)(i)(C); 2.12(d)(2)(ii); 2.32(a)(1); 2.33(c); 2.34(b); 2.35(d); 2.52(b)(2); 2.53(a). This section summarizes major proposals in this NPRM. Additional proposed revisions are not listed here because they are not considered major. 22 All proposed changes are discussed in detail in section III of this NPRM: 22 Generally, the proposals not listed make wording changes, not substantive changes. These proposals are reviewable in the regulatory text and include proposals to modify § 2.17, Undercover agents and informants; § 2.20, Relationship to state laws; § 2.21 Relationship to federal statutes protecting research subjects against compulsory disclosure of their identity; and § 2.34, Uses and Disclosures to prevent multiple enrollments (proposed heading). 1. § 2.1—Statutory authority for confidentiality of substance use disorder patient records. Revise § 2.1 to more closely reflect the authority granted in 42 U.S.C. 290dd-2(g), especially with respect to court orders authorizing the disclosure of records. 2. § 2.2—Purpose and effect. Amend paragraph (b) of § 2.2 to reflect that § 2.3(b) compels disclosures to the Secretary that are necessary for enforcement of this rule, using language adapted from the Privacy Rule at 45 CFR 164.502(a)(2)(ii). Add a new paragraph (b)(3) to this section to prohibit any limits on a patient's right to request restrictions on use of records for treatment, payment, or health care operations (TPO) or a covered entity's choice to obtain consent to use or disclose records for TPO purposes as provided in the Privacy Rule. 3. § 2.3—Civil and criminal penalties for violations (proposed heading). Amend the heading and replace title 18 U.S.C. enforcement with references to the HIPAA enforcement authorities in the Social Security Act at sections 1176 (civil enforcement, including the CMP tiers established by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009) and 1177 (criminal penalties), 23 as implemented in the Enforcement Rule. 24 Create a limitation on civil or criminal liability under Part 2 for investigative agencies that act with reasonable diligence before making a demand for records in the course of an investigation or prosecution of a Part 2 program or person holding the record, provided that certain conditions are met. 25 23 See Public Law 111-5, 123 Stat. 226 (February 17, 2009). Section 13410 of the HITECH Act (codified at 42 U.S.C. 17939) amended sections 1176 and 1177 of the Social Security Act (codified at 42 U.S.C. 1320d-5) to add civil and criminal penalty tiers for violations of the HIPAA Administrative Simplification provisions. 24 See 45 CFR part 160. 25 Although this provision is not expressly required by the CARES Act, it falls within the Department's general rulemaking authority in 42 U.S.C. 290dd-2(g), and is needed to address the logical consequences of the changes required by sec. 3221. 4. § 2.4—Complaints of violations (proposed heading). Amend the heading and insert requirements consistent with those applicable to HIPAA complaints under 45 CFR 164.530(d), (g), and (h), including: a requirement to establish a process for the Part 2 program to receive complaints, a prohibition against taking adverse action against patients who file complaints, and a prohibition against requiring individuals to waive the right to file a complaint as a condition of providing treatment, enrollment, payment, or eligibility for services. 5. § 2.11—Definitions. Add new terms and definitions to align with the following statutory and regulatory HIPAA terms: Breach, Business associate, Covered entity, Health care operations, HIPAA, HIPAA regulations, Payment, Person, Public health authority, Treatment, Unsecured protected health information, and Use. Create new defined terms Intermediary, Investigative agency, and Unsecured record, and modify the definitions of Informant, Part 2 program director, Patient, Program, Records, Third-party payer, Treating provider relationship, and Qualified service organization. 6. § 2.12—Applicability. Replace “Armed Forces” with “Uniformed Services” in paragraph (c)(2) of § 2.12. Incorporate four statutory examples of restrictions on the use or disclosure of Part 2 records to initiate or substantiate any criminal charges against a patient or to conduct any criminal investigation of a patient. Add language to qualify the term third-party payer with the phrase “as defined in this part.” Revise paragraph (e)(4)(i) to clarify when a diagnosis is not covered by Part 2. 7. § 2.13—Confidentiality restrictions and safeguards. Redesignate § 2.13(d) requiring a list of disclosures as new § 2.24 and modify the text for clarity. Amend the heading to distinguish the right to a list of disclosures made by intermediaries from the proposed new right to an accounting of disclosures made by a Part 2 program. 8. § 2.14—Minor patients. Change the verb “judges” to “determines” to describe a program director's evaluation and decision that a minor lacks decision making capacity. 9. § 2.15—Patients who lack capacity and deceased patients (proposed heading). Replace outdated language, clarify that paragraph (a) of this section refers to an adjudication by a court of a patient's lack of capacity to make health care decisions while paragraph (b) refers to a patient's lack of capacity to make health care decisions without court adjudication, and add health plans to the list of entities to which a program may disclose records without consent. 10. § 2.16—Security for records and notification of breaches (proposed heading). Apply the HITECH Act breach notification provisions 26 that are currently implemented in the Breach Notification Rule to breaches of records by Part 2 programs and retitle the provision to include breach notification to implement CARES Act provisions. Modify the provision to refer to the Privacy Rule de-identification standard at 45 CFR 164.514. 26 Section 13400 of the HITECH Act (codified at 42 U.S.C. 17921) defined the term “Breach”. Section 13402 of the HITECH Act (codified at 42 U.S.C. 17932) enacted breach notification provisions, discussed in detail below. 11. § 2.19—Disposition of records by discontinued programs. Add an exception to clarify that these provisions do not apply to transfers, retrocessions, and reassumptions of Part 2 programs pursuant to the Indian Self-Determination and Education Assistance Act (ISDEAA), in order to facilitate the responsibilities set forth in 25 U.S.C. 5321(a)(1), 25 U.S.C. 5384(a), 25 U.S.C. 5324(e), 25 U.S.C. 5330, 25 U.S.C. 5386(f), 25 U.S.C. 5384(d), and the implementing ISDEAA regulations. Modernize the language to refer to “non-electronic” records and include “paper” records as an example of non-electronic records. 12. § 2.22—Notice to patients of federal confidentiality requirements. Modify the Part 2 confidentiality notice requirements (hereinafter, “Patient Notice”) to align with the NPP and address protections required by 42 U.S.C. 290dd-2, as amended by section 3221 of the CARES Act, for entities that create or maintain Part 2 records. 13. § 2.23—Patient access and restrictions on use and disclosure (proposed heading). Add the term “disclosure” to the heading and body of this section to clarify that information obtained by patient access to their record may not be used or disclosed for purposes of a criminal charge or criminal investigation. 14. § 2.24—Requirements for intermediaries (redesignated and proposed heading). Retitle the redesignated section (to be moved from § 2.13(d)) as “Requirements for intermediaries” to clarify the responsibilities of recipients of records received under a consent with a general designation, such as health information exchanges, research institutions, accountable care organizations, and care management organizations. 15. § 2.25—Accounting of disclosures (proposed heading). Add this section to implement 42 U.S.C. 290dd-2(b)(1)(B), as amended by the section 3221 of the CARES Act, to incorporate into Part 2 the HITECH Act right to an accounting of certain disclosures of records for up to three years prior to the date the accounting is requested and add a right to an accounting of disclosures of records that mirrors the standard in the Privacy Rule at 45 CFR 164.528. 16. § 2.26—Right to request privacy protection for records (proposed heading). Add this section to implement 42 U.S.C. 290dd-2(b)(1)(B), as amended by the section 3221 of the CARES Act, to incorporate into Part 2 the HITECH Act rights implemented in the Privacy Rule at 45 CFR 164.522, namely: (1) a patient right to request restrictions on disclosures of records otherwise permitted for TPO purposes, and (2) a patient right to obtain restrictions on disclosures to health plans for services paid in full by the patient. 17. Subpart C—Uses and Disclosures With Patient Consent (proposed heading). Change the heading of subpart C to “Uses and Disclosures With Patient Consent” to reflect changes made to the provisions of this subpart related to the consent to use and disclose Part 2 records, consistent with 42 U.S.C. 290dd-2(b), as amended by the section 3221(b) of the CARES Act. 18. § 2.31—Consent requirements. Align the content requirements for Part 2 written consent with the content requirements for a valid HIPAA authorization and clarify how recipients may be designated in a consent to use and disclose Part 2 records for TPO. 19. § 2.32—Notice to accompany disclosure (proposed heading). Change the heading of this section and align the content requirements for the required notice that accompanies a disclosure of records (hereinafter “notice to accompany disclosure”) with the requirements of 42 U.S.C. 290dd-2(b), as amended by section 3221(b) of the CARES Act. 20. § 2.33—Uses and disclosures permitted with written consent (proposed heading). To align this provision with the statutory authority in 42 U.S.C. 290dd-2(b)(1), as amended by section 3221(b) of the CARES Act, replace the provisions requiring consent for uses and disclosures for payment and certain health care operations with permission to use and disclose records for TPO with a single consent given once for all such future uses and disclosures, until such time as the patient revokes the consent in writing. Create redisclosure permissions for two categories of recipients of Part 2 records pursuant to a written consent: (1) Permit a Part 2 program, covered entity, or business associate that receives Part 2 records pursuant to a written consent for TPO purposes to redisclose the records in any manner permitted by the Privacy Rule, except for certain proceedings against the patient; 27 and (2) Permit a lawful holder that is not a covered entity, business associate, or Part 2 program to redisclose Part 2 records for payment and health care operations to its contractors, subcontractors, or legal representatives as needed to carry out the activities in the consent. 27 See 42 U.S.C. 290dd-2(b)(1)(B) and (2)(c). 21. § 2.35—Disclosures to elements of the criminal justice system which have referred patients. For clarity, replace “individuals” with “persons” and clarify that permitted redisclosures of information are from Part 2 records. 22. Subpart D—Uses and Disclosures Without Patient Consent (proposed heading). Change the heading of subpart D to “Uses and Disclosures Without Patient Consent” to reflect changes made to the provisions of this subpart related to the consent to use and disclose Part 2 records, consistent with 42 U.S.C. 290dd-2 as amended by the CARES Act. 23. § 2.51—Medical emergencies. For clarity in § 2.51(c)(2), replace the term “individual” with the term “person.” 24. § 2.52—Scientific research (proposed heading). Revise the heading of § 2.52 to reflect statutory language. To further align Part 2 with the Privacy Rule, replace the requirements to render Part 2 data in research reports non identifiable with the Privacy Rule's de-identification standard in 45 CFR 164.514. 25. § 2.53—Management audits, financial audits, and program evaluation (proposed heading). Revise the heading of § 2.53 to reflect statutory language. To support implementation of 42 U.S.C. 290dd-2(b)(1), as amended by section 3221(b) of the CARES Act, add a provision to acknowledge the permission for use and disclosure of records for health care operations purposes based on written consent of the patient and the permission to redisclose such records as permitted by the HIPAA Privacy Rule if the recipient is a Part 2 program, covered entity, or business associate. 26. § 2.54—Disclosures for public health (proposed heading). Add a new § 2.54 to implement 42 U.S.C. 290dd-2(b)(2)(D), as amended by section 3221(c) of the CARES Act, to permit disclosure of records without patient consent to public health authorities provided that the records disclosed are de-identified according to the standards established in section 45 CFR 164.514. 27. Subpart E—Court Orders Authorizing Use and Disclosure (proposed heading). Change the heading of subpart E to reflect changes made to the provisions of this subpart related to the uses and disclosure of Part 2 records in proceedings consistent with 42 U.S.C. 290dd-2(b) and (2)(c), as amended by sections 3221(b) and (e) of the CARES Act. 28. § 2.61—Legal effect of order. Add the term “use” to clarify that the legal effect of a court order would include authorizing the use and disclosure of records, consistent with 42 U.S.C. 290dd-2(b) and (c), as amended by section 3221(e) of the CARES Act. 29. § 2.62—Order not applicable to records disclosed without consent to researchers, auditors, and evaluators. For clarity, replace the term “qualified personnel” with a reference to the criteria that define such persons. 30. § 2.63—Confidential communications. Revise paragraph (c) of § 2.63 to expressly include civil, criminal, administrative, and legislative proceedings as forums where the requirements for a court order under this part would apply, to implement 42 U.S.C. 290dd-2(c), as amended by section 3221(c) of the CARES Act. 31. § 2.64—Procedures and criteria for orders authorizing uses and disclosures for noncriminal purposes (proposed heading). Expand the types of forums where restrictions on use and disclosure of records in civil proceedings against patients apply 28 to expressly include administrative and legislative proceedings and also restrict the use of testimony conveying information in a record in civil proceedings against patients, absent consent or a court order. Add the term “uses” to the heading and in this section to align it with current statutory authority. 28 See 42 CFR part 2, subpart E. 32. § 2.65—Procedures and criteria for orders authorizing use and disclosure of records to criminally investigate or prosecute patients (proposed heading). Expand the types of forums where restrictions on uses and disclosure of records in criminal proceedings against patients apply 29 to expressly include administrative and legislative proceedings and also restrict the use of testimony conveying information in a Part 2 record in criminal proceedings against patients, absent consent or a court order. 29 Id. 33. § 2.66—Procedures and criteria for orders authorizing use and disclosure to investigate or prosecute a part 2 program or the person holding the records (proposed heading). Create requirements for investigative agencies to follow in the event they discover in good faith that they received Part 2 records during an investigation or prosecution of a Part 2 program or the person holding the records before seeking a court order as required under § 2.66. 34. § 2.67—Orders authorizing the use of undercover agents and informants to investigate employees or agents of a part 2 program in connection with a criminal matter. Add new criteria for issuance of a court order in instances where an application is submitted after the placement of an undercover agent or informant has already occurred, requiring an investigative agency to satisfy the conditions at § 2.3(b). 35. § 2.68—Report to the Secretary (proposed heading). Create new requirements for investigative agencies to file annual reports about the instances in which they applied for a court order after receipt of Part 2 records or placement of an undercover agent or informant as provided in § 2.66 and § 2.67. 36. 45 CFR 164.520—Notice of privacy practices for protected health information. Revise 45 CFR 164.520 to implement updates to the NPP to address Part 2 confidentiality requirements, as required by section 3221(i)(2) of the CARES Act. Background and Need for Proposed Rule There are approximately 16,066 publicly funded SUD treatment facilities 30 and 1.8 million HIPAA covered entities and business associates, with an unknown percentage of entities subject to both HIPAA and Part 2. Part 2 records often also meet the definition of PHI when maintained by HIPAA covered entities (or their business associates on the covered entities' behalf). To ensure compliance with both sets of regulatory requirements, dually regulated entities subject to both Part 2 and the HIPAA Rules ( i.e., covered entities that also are Part 2 programs) must track and segregate the records that are subject to Part 2 from the records that are subject only to the HIPAA Rules and obtain specific written consent for most uses and disclosures of Part 2 records (including uses and disclosures for non-emergency treatment purposes). The Department has been urged by many stakeholders to change Part 2 to eliminate the need for data segmentation. 31 30 See Substance Abuse and Mental Health Services Administration, National Survey of Substance Abuse Treatment Services (N-SSATS): 2020. Data on Substance Abuse Treatment Facilities. Rockville, MD: Substance Abuse and Mental Health Services Administration, 2021, https://www.samhsa.gov/data/sites/default/files/reports/rpt35313/2020_NSSATS_FINAL.pdf. 31 For example, the Ohio Behavioral Health Providers Network (Network) in an August 21, 2020, letter to SAMHSA, and the Partnership to Amend Part 2 in a similar January 8, 2021, letter to the U.S. Department of Health and Human Services (HHS), both urge that there should be no requirement for data segmentation or segregation after written consent is obtained and Part 2 records are transmitted to a health information exchange or care management entity that is a business associate of a covered entity covered by the new CARES Act consent language. In the letter, the Network states that such requirements are difficult to implement in federally qualified health centers and other integrated settings in which SUD treatment may be provided. See also public comments expressed and summarized in 85 FR 42986, https://www.federalregister.gov/documents/2020/07/15/2020-14675/confidentiality-of-substance-use- disorder-patient-records; and see https://aahd.us/wp-content/uploads/2021/01/PartnershipRecommendationsforNextPart2-uleLtrtoNomineeBecerra_01082021.pdf. The preamble to the 2000 Final Privacy Rule explained how entities subject to the Privacy Rule and Part 2 could comply with both rules because in most cases the rules do not conflict. The Privacy Rule permits, but does not require, some disclosures that are not permitted by Part 2. Complying with Part 2's prohibitions on such disclosures would not be a violation of the Privacy Rule. And in instances where Part 2 permits disclosures that would otherwise be restricted by the Privacy Rule, an entity that is subject to both sets of regulations would be able to comply with the Privacy Rule's restrictions without violating Part 2. 32 32 See 65 FR 82482 (December 28, 2000). Although the Department intended to facilitate compliance by entities subject to both regulatory schemes, significant differences in the statutorily permitted uses and disclosures of Part 2 records and PHI contributed to ongoing operational compliance challenges. For example, once a HIPAA covered entity or business associate disclosed PHI to a person who was not a covered entity or business associate, the information was no longer protected by the Privacy Rule, and thus the Privacy Rule's limitations on uses and disclosures did not apply. In contrast, Part 2 strictly limited the redisclosure of Part 2 records by any individual or entity that received a Part 2 record directly from a Part 2 program or other “lawful holder” of patient identifying information, absent written patient consent or as otherwise permitted under the regulations. 33 34 33 See 42 CFR 2.12(d)(2)(i)(C). 34 See 42 CFR 2.11, definitions of “Patient identifying information” and “Disclose”. Regarding Part 2 records, a treating provider that is not a Part 2 program could record information about the treatment of an individual's SUD in its non-Part 2 records, even if it gleaned the information from a Part 2 record, and the information in the non-Part 2 records would not be subject to Part 2; however, any Part 2 records received from a Part 2 program or other lawful holder would need to be segregated or segmented. 35 Previously, the need to segment Part 2 records from other health records created data “silos” that hampered the integration of SUD treatment records into covered entities' electronic record systems and billing processes. Some lawmakers have argued that these silos perpetuated negative stereotypes about persons with SUD and inhibited coordination of care 36 37 during the opioid epidemic. 38 In 2019, the National Association of Attorneys General (NAAG) urged Congress to update the 40-year-old Part 2 regulation that was created in a time of “intense stigma” surrounding SUD treatment because it now serves to “perpetuate that stigma, as the principle underlying these rules is that [SUD] treatment is shameful and records of it should be withheld from other treatment providers in ways that we do not withhold records of treatment of other chronic diseases.” 39 In that same year “nearly 50,000 people in the United States died from opioid-involved overdoses.” 40 During a congressional hearing, “The Opioid Crisis: The Role of Technology and Data in Preventing and Treating Addiction,” Senator Patty Murray (D-WA) observed that, “[t]echnology and data offer important opportunities to address the opioid crisis, to prevent addi[c]tion, and avoid the tragedy so many families are facing.” 41 35 See 42 CFR 2.12(d)(2)(ii). 36 See, e.g., remarks of U.S. Representative Earl Blumenauer: “If substance use disorder treatment is not included in your entire medical records, then they are not complete. It makes care coordination more difficult and can lead to devastating outcomes. This bill works to remove the stigma that comes with substance use disorders and ensures necessary information is available for safe, efficient, and transparent treatment for all patients.” See also remarks of U.S. Representative Markwayne Mullin: “It's time that we stop stigmatizing those struggling with opioid abuse and give physicians the tools they need to help their patients. Mental health and physical health have been treated in a silo for too long. Our bill breaks down those barriers so the doctor can treat the whole patient. I'm proud to introduce this bill with my colleagues so that we can provide 21st century care to those who need it the most”, https://blumenauer.house.gov/media-center/press-releases/blumenauer-and-mullin-introduce-bipartisan-legislation-address-opioid. 37 But see 85 FR 42986 (July 15, 2020), in which the Department finalized a rule permitting the disclosure of Part 2 records for care coordination by certain “lawful holders” that receive a record for payment or health care operation activities directly from a Part 2 program or other lawful holder. 38 In 2017, the Department declared a public health emergency related to the opioid crisis. See Public Health Emergency (October 26, 2017), https://www.hhs.gov/sites/default/files/opioid%20PHE%20Declaration-no-sig.pdf. https://www.phe.gov/emergency/news/healthactions/phe/Pages/opioids.aspx. 39 NAAG Requests Removal of Federal Barriers to Treat Opioid Use Disorder (August 5, 2019), at https://www.naag.org/policy-letter/naag-requests-removal-of-federal-barriers-to-treat-opioid-use-disorder/. 40 Opioid Overdose Crisis, National Institutes of Health National Institute on Drug Abuse (March 11, 2021), https://www.drugabuse.gov/drug-topics/opioids/opioid-overdose-crisis. See also CDC/NCHS, National Vital Statistics System, Mortality. CDC WONDER, Atlanta, GA: US Department of Health and Human Services, CDC; 2019, https://wonder.cdc.gov. 41 Hearing of the Committee on Health, Education, Labor, and Pensions United States Senate, “The Role of Technology and Data in Preventing and Treating Addiction.” (February 27, 2018), https://www.govinfo.gov/content/pkg/CHRG-115shrg28855/pdf/CHRG-115shrg28855.pdf. To address these concerns, Congress enacted the CARES Act, which requires the Department to promulgate regulations modifying the confidentiality requirements for Part 2 records. 42 This rulemaking proposes modifications to 42 CFR part 2 and the Privacy Rule that are necessary to implement the statutory amendments made to 42 U.S.C. 290dd-2, and additional modifications to Part 2 to better align certain provisions of Part 2 to the Privacy Rule and address concerns about potential liability for government agencies in the course of investigating and prosecuting Part 2 programs under the new penalties and enforcement scheme. 42 See sec. 3221(i) of the CARES Act. A. Statutory and Regulatory Background Congress enacted the first federal confidentiality protections for SUD records in section 333 of the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act of 1970. 43 The statute authorized “persons engaged in research on, or treatment with respect to, alcohol abuse and alcoholism to protect the privacy of individuals who [were] the subject of such research or treatment” from persons not connected with the conduct of the research or treatment by withholding identifying information. 43 See sec. 333, Public Law 91-616, 84 Stat. 1853 (December 31, 1970) (codified at 42 U.S.C. 2688h). Section 408 of the Drug Abuse Office and Treatment Act of 1972 44 applied confidentiality requirements to records relating to drug abuse prevention authorized or assisted under any provision of the Act. Section 408 permitted disclosure, with a patient's written consent, for diagnosis or treatment by medical personnel and to government personnel for obtaining patient benefits to which the patient is entitled. The 1972 Act also established exceptions to the consent requirement to permit disclosures for bona fide medical emergencies; to qualified personnel for conducting certain activities, such as scientific research or financial audit or program evaluation, as long as the patient is not identified in any reports; and as authorized by court order granted after application showing good cause. 45 44 See sec. 408, Public Law 92-255, 86 Stat. 65 (March 21, 1972) (codified at 21 U.S.C. 1175). Section 408 also prohibited the use of a covered record for use or initiation or substantiation of criminal charges against a patient or investigation of a patient. Section 408 provided for a fine in the amount of $500 for a first offense violation, and not more than $5,000 for each subsequent offense. 45 Id. The Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act Amendments of 1974 46 expanded the types of records protected by confidentiality restrictions to include records relating to alcoholism, alcohol abuse, and drug abuse prevention, maintained in connection with any program or activity conducted, regulated, or directly or indirectly federally assisted by any United States agency. The 1974 Act also permitted the disclosure of records based on prior written patient consent only to the extent such disclosures were allowed under Federal regulations. Additionally, the 1974 Act excluded the interchange of records within the Armed Forces or components of the U.S. Department of Veterans Affairs (VA), then known as the Veterans' Administration, from the confidentiality restrictions. 47 46 See sec. 101, title I, Public Law 93-282, 88 Stat. 126 (May 14, 1974), providing that: “This title [enacting this section and sections 4542, 4553, 4576, and 4577 of this title, amending sections 242a, 4571, 4572, 4573, 4581, and 4582 of this title, and enacting provisions set out as notes under sections 4581 and 4582 of this title] may be cited as the ‘Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act Amendments of 1974”. 47 See sec. 408, title I, Public Law 92-255, 86 Stat. 79 (March 21, 1972) (originally codified at 21 U.S.C. 1175). See 21 U.S.C. 1175 note for complete statutory history. In 1992, section 131 of the Alcohol, Drug Abuse, and Mental Health Administration Reorganization Act (ADAMHA Reorganization Act) 48 added section 543, Confidentiality of Records, to the Public Health Service Act (PHSA) (codified at 42 U.S.C. 290dd-2) (“Part 2 statute”), which narrowed the grounds upon which a court could grant an order permitting disclosure of such records from “good cause” ( i.e., based on weighing the public interest in the need for disclosure against the injury to the patient, physician patient relationship and treatment services) 49 to “the need to avert a substantial risk of death or serious bodily harm.” 50 Congress also established criminal penalties for Part 2 violations under title 18 of the United States Code, Crimes and Criminal Procedure. 51 Finally, section 543 granted broad authority to the Secretary to prescribe regulations to carry out the purposes of section 543 and provide for safeguards and procedures, including criteria for the issuance and scope of court orders to authorize disclosure of SUD records, “as in the judgment of the Secretary are necessary or proper to effectuate the purposes of this section, to prevent circumvention or evasion thereof, or to facilitate compliance therewith.” 52 48 See sec. 131, Public Law 102-321, 106 Stat. 323 (July 10, 1992) (codified at 42 U.S.C. 201 note). 49 See sec. 333, Public Law 91-616, 84 Stat. 1853 (December 31, 1970). 50 See sec. 131, Public Law 102-321, 106 Stat. 323 (July 10, 1992) (codified at 42 U.S.C. 201 note). 51 Id., adding sec. 543(b)(2)(C) to the PHSA. 52 Id., adding sec. 543(g) to the PHSA. In 1975, the Department, promulgated the first federal regulations implementing statutory SUD confidentiality provisions at 42 CFR part 2. 53 In 1987, the Department published a final rule making substantive changes to the scope of Part 2 to clarify the regulations and ease the burden of compliance by Part 2 programs within the parameters of the existing statutory restrictions. 54 After the 1992 enactment of the ADAMHA Reorganization Act (Pub. L. 102-321), the Department later clarified the definition of “program” in a 1995 final rule to narrow the scope of Part 2 regulations pertaining to medical facilities to cover only those entities or units within a general medical facility that hold themselves out as providing diagnosis, treatment, or referral for treatment, or specialized personnel (who are identified as providing such services as a primary function) and which directly or indirectly receive federal assistance. 55 53 See 40 FR 27802 (July 1, 1975). 54 See 52 FR 21796 (June 9, 1987). See also Notice of Decision to Develop Regulations, 45 FR 53 (January 2, 1980) and 48 FR 38758 (August 25, 1983). 55 See 60 FR 22296 (May 5, 1995). See also 59 FR 42561 (August 18, 1994) and 59 FR 45063 (August 31, 1994). The ambiguity of the definition of “program” was identified in United States v. Eide, 875 F. 2d 1429 (9th Cir. 1989) where the court held that the general emergency room is a “program” as defined by the regulations. HIPAA and the HITECH Act In 1996, Congress enacted HIPAA, 56 which included Administrative Simplification provisions requiring the establishment of national standards 57 to protect the privacy and security of individuals' health information and establishing civil money and criminal penalties for violations of the requirements, among other provisions. 58 The Administrative Simplification provisions and implementing regulations apply to covered entities, which are health care providers who conduct covered health care transactions electronically, health plans, and health care clearinghouses. 59 Certain provisions of the HIPAA Rules also apply directly to business associates of covered entities. 60 56 See Public Law 104-191, 110 Stat. 1936 (August 21, 1996). 57 Cited at fn. 3. See also sec. 264 of HIPAA (codified at 42 U.S.C. 1320d-2 note). 58 See 42 U.S.C. 1320d-1-1320d-9. With respect to privacy standards, Congress directed the Department to “address at least the following: (1) The rights that an individual who is a subject of individually identifiable health information should have. (2) The procedures that should be established for the exercise of such rights. (3) The uses and disclosures of such information that should be authorized or required.” 42 U.S.C. 1320d-2 note. 59 See 42 U.S.C. 1320d-1 (applying Administrative Simplification provisions to covered entities). 60 See “Office for Civil Rights Fact Sheet on Direct Liability of Business Associates under HIPAA” (May 2019) for a comprehensive list of requirements in the HIPAA Rules that apply directly to business associates (available at https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/factsheet/index.html ). The Privacy Rule, including provisions implemented as a result of the HITECH Act, 61 regulates the use and disclosure of PHI by covered entities and business associates, requires covered entities to have safeguards in place to protect the privacy of PHI, and requires covered entities to obtain the written authorization of an individual to use and disclose the individual's PHI unless otherwise permitted by the Privacy Rule. 62 The Privacy Rule includes several use and disclosure permissions that are relevant to this NPRM, including the permissions for covered entities to use and disclose PHI without written authorization from an individual for TPO; 63 to public health authorities for public health purposes; 64 and for research in the form of a limited data set 65 or pursuant to a waiver of authorization by a Privacy Board or Institutional Review Board. 66 The Privacy Rule also establishes the rights of individuals with respect to their PHI, including the rights to: receive adequate notice of a covered entity's privacy practices; to request restrictions of certain uses and disclosures; to access ( i.e., to inspect and obtain a copy of) their PHI; to request an amendment of their PHI; and to receive an accounting of certain disclosures of their PHI. 67 Finally, the Privacy Rule specifies standards for de-identification of PHI such that, when applied, the information is no longer individually identifiable health information and subject to the HIPAA Rules. 68 61 The HITECH Act extended the applicability of certain Privacy Rule requirements and all of the Security Rule requirements to the business associates of covered entities; required HIPAA covered entities and business associates to provide for notification of breaches of unsecured PHI (implemented by the Breach Notification Rule); established new limitations on the use and disclosure of PHI for marketing and fundraising purposes; prohibited the sale of PHI; required consideration of whether a limited data set can serve as the minimum necessary amount of information for uses and disclosures of PHI; and expanded individuals' rights to access electronic copies of their PHI in an EHR, to receive an accounting of disclosures of their PHI with respect to ePHI, and to request restrictions on certain disclosures of PHI to health plans. In addition, subtitle D strengthened and expanded HIPAA's enforcement provisions. See subtitle D of title XIII of the HITECH Act, entitled “Privacy”, for all provisions (codified in title 42 of U.S.C.). 62 See 45 CFR 164.502(a). 63 See 45 CFR 164.506. 64 See 45 CFR 164.512(b). 65 See 45 CFR 164.514(e)(1-4). 66 See 45 CFR 164.512(i). 67 See 45 CFR 164.520, 164.522, 164.524, 164.526 and 164.528. 68 See 45 CFR 164.514(a-c). The Security Rule, codified at 45 CFR parts 160 and 164, subparts A and C, requires covered entities and their business associates to implement administrative, physical, and technical safeguards to protect electronic PHI (ePHI). Specifically, covered entities and business associates must ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain, or transmit; 69 protect against reasonably anticipated threats or hazards to the security or integrity of the information 70 and reasonably anticipated impermissible uses or disclosures; 71 and ensure compliance by their workforce. 72 69 See 45 CFR 164.306(a)(1). 70 See 45 CFR 164.306(a)(2). 71 See 45 CFR 164.306(a)(3). 72 See 45 CFR 164.306(a)(4). The Breach Notification Rule, codified at 45 CFR parts 160 and 164, subparts A and D, implements HITECH Act requirements 73 for covered entities to provide notification to affected individuals, the Secretary, and in some cases the media, following a breach of unsecured PHI. The Breach Notification Rule also requires a covered entity's business associate that experiences a breach of unsecured PHI to notify the covered entity of the breach. A breach is, generally, an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of “unsecured” PHI, subject to three exceptions: 74 (1) the unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a covered entity or business associate, if such acquisition, access, or use was made in good faith and within the scope of authority; (2) the inadvertent disclosure of PHI by a person authorized to access PHI at a covered entity or business associate to another person authorized to access PHI at the covered entity or business associate, or organized health care arrangement (OHCA) in which the covered entity participates; and (3) the covered entity or business associate making the disclosure has a good faith belief that the unauthorized person to whom the impermissible disclosure was made, would not have been able to retain the information. 73 See sec. 13402 of the HITECH Act (codified at 42 U.S.C. 17932). 74 See 45 CFR 164.402 para. (1). The Breach Notification Rule provides that a covered entity may rebut the presumption that such impermissible use or disclosure constituted a breach by demonstrating that there is a low probability that PHI has been compromised based on a risk assessment of at least four required factors: (1) the nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification; (2) the unauthorized person who used the PHI or to whom the disclosure was made; (3) whether the PHI was actually acquired or viewed; and (4) the extent to which the risk to the PHI has been mitigated. 75 75 Ibid. para. (2). The Enforcement Rule, codified at 45 CFR part 160, subparts C, D, and E, includes standards and procedures relating to investigations into complaints about noncompliance with the HIPAA Rules, compliance reviews, the imposition of (CMPs), and procedures for hearings. The Enforcement Rule states generally that the Secretary will impose a CMP upon a covered entity or business associate if the Secretary determines that the covered entity or business associate violated a HIPAA Administrative Simplification provision. 76 However, the Enforcement Rule also provides for informal resolution of potential noncompliance, 77 which occurs through voluntary compliance by the regulated entity, corrective action, or a resolution agreement with the payment of a settlement amount to OCR. 76 Criminal penalties may be imposed by the Department of Justice for certain violations under 42 U.S.C. 1320d-6. 77 See 45 CFR 160.304. See also 45 CFR 160.416 and 160.514. The Department promulgated or modified key provisions of the HIPAA Rules as part of the 2013 Omnibus Final Rule, in which the Department implemented applicable provisions of the HITECH Act, among other modifications. For example, the Department strengthened privacy and security protections for PHI, finalized breach notification requirements, and enhanced enforcement by increasing potential CMPs for violations, including establishing tiers of penalties based on entities' level of culpability. 78 The Secretary of HHS delegated authority to OCR to make decisions regarding the implementation and interpretation of the Privacy, Security, Breach Notification, and Enforcement Rules. 79 80 78 See 78 FR 5566 (January 25, 2013). 79 See Office for Civil Rights; Statement of Delegation of Authority, 65 FR 82381 (December 28, 2000); Office for Civil Rights; Delegation of Authority, 74 FR 38630 (August 4, 2009); Statement of Organization, Functions and Delegations of Authority, 81 FR 95622 (December 28, 2016). 80 See 65 FR 82381 (December 28, 2000). Earlier Efforts To Align Part 2 With the HIPAA Rules Prior to amendment by the CARES Act, section 290dd-2 provided that records could be disclosed only with the patient's specific written consent for each disclosure, with limited exceptions. 81 The exceptions related to records maintained by VA or the Armed Forces and, for example, disclosures for continuity of care in emergency situations or between personnel who have a need for the information in connection with their duties that arise out of the provision of the diagnosis, treatment, or referral for treatment of patients with SUD. 82 The exceptions did not include, for example, a disclosure of Part 2 records by a Part 2 program to a third-party medical provider to treat a condition other than SUD absent an emergency situation. Therefore, the current Part 2 implementing regulations require specific patient consent for most uses and disclosures of Part 2 records, including for non-emergency treatment purposes. In contrast, the Privacy Rule permits covered entities to use and disclose an individual's PHI for TPO without the individual's valid HIPAA authorization. 83 81 The limited exceptions are codified in current regulation at 42 CFR 2.12(c), 42 CFR part 2 subpart D, and 42 CFR 2.33(b). 82 See 42 CFR 2.12(c)(3). These disclosures are limited to communications within a Part 2 program or between a Part 2 program and an entity having direct administrative control over the Part 2 program. 83 See 45 CFR 164.501. The Department has modified and clarified Part 2 several times to align certain provisions more closely with the Privacy Rule, 84 address changes in health information technology, and provide greater flexibility for disclosures of patient identifying information within the health care system, while continuing to protect the confidentiality of Part 2 records. 85 For example, the Department clarified in a 2017 final rule that the definition of “patient identifying information” in Part 2 includes the individual identifiers listed in the Privacy Rule at 45 CFR 164.514(b)(2)(i) for those identifiers that are not already listed in the Part 2 definition. 86 84 See 85 FR 42986 and 83 FR 239 (January 3, 2018). 85 82 FR 6052 (January 18, 2017). See also 81 FR 6988 (February 9, 2016). 86 See 82 FR 6052, 6064. In 2018, the Department issued a final rule clarifying the circumstances under which lawful holders and their legal representatives, contractors, and subcontractors could use and disclose Part 2 records related to payment and health care operations in § 2.33(b) and for audit or evaluation-related purposes. The Department clarified that previously listed types of payment and health care operations uses and disclosures under the lawful holder permission in § 2.33(b) were illustrative, and not necessarily definitive so as to be included in regulatory text. 87 The Department also acknowledged the similarity of the list of activities to those included in the Privacy Rule definition of “health care operations” but declined to fully incorporate that definition into Part 2. 88 The Department specifically excluded care coordination and case management from the list of payment and health care operations activities permitted without patient consent under Part 2 based on a determination that these activities are akin to treatment. The Department also codified in regulatory text language for an abbreviated notice to accompany disclosure of Part 2 records. 89 Although the rule retained the requirement that a patient must consent before a lawful holder may redisclose Part 2 records for treatment, 90 the Department explained that the purpose of the Part 2 regulations is to ensure that a patient is not made more vulnerable by reason of the availability of a treatment record than an individual with a SUD who chooses not to seek treatment. The Department simultaneously recognized the legitimate needs of lawful holders to obtain payment and conduct health care operations as long as the core protections of Part 2 are maintained. 91 87 See 83 FR 239, 241-242. 88 Id. at 242. 89 83 FR 239 (January 3, 2018). See also 82 FR 5485 (January 18, 2017). 90 Id. at 242. 91 Id. In a final rule published July 15, 2020, 92 the Department retained the requirement that programs obtain prior written consent before disclosing Part 2 records in the first instance (outside of recognized exceptions). At the same time the Department reversed its previous exclusion of care coordination and case management from the list of payment and health care operations in § 2.33(b) for which a lawful holder may make further disclosures to its contractors, subcontractors, and legal representatives. 93 The Department based this change on comments received on the proposed rule in 2019 and on section 3221(d)(4) of the CARES Act, which incorporated the Privacy Rule definition of health care operations, including care coordination and case management activities, into paragraph (k)(4) of 42 U.S.C. 290dd-2. 94 The July 2020 final rule also modified the consent requirements in § 2.31 by establishing special requirements for written consent 95 when the recipient of Part 2 records is a health information exchange (HIE) (as defined in 45 CFR 171.102 96 ). In this NPRM, the Department now proposes a definition for the term “intermediary” 97 to further facilitate the exchange of Part 2 records in new models of care, including those involving an HIE, a research institution providing treatment, an accountable care organization, or a care management organization. 92 85 FR 42986. See also 84 FR 44568. 93 See 42 CFR 2.33(b). 94 See 85 FR 42986, 43008-009. Sec. 3221(k)(4) expressed the Sense of Congress that the Department should exclude clause (v) of paragraph 6 of 45 CFR 164.501 (relating to creating de-identified health information or a limited data set, and fundraising for the benefit of the covered entity) from the definition of “health care operations” in applying the definition to these records. 95 See 85 FR 42986, 43006. 96 See 85 FR 42986, 43006, See also 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program, 85 FR 25642 (May 1, 2020). 97 See proposed 42 CFR 2.11, Definitions: Intermediary means a person who has received records under a general designation in a written patient consent to be disclosed to one or more of its member participants for the treatment of the patient— e.g., a health information exchange, a research institution that is providing treatment, an accountable care organization, or a care management organization. The Department again modified Part 2 on December 14, 2020, 98 by amending the confidential communications section of § 2.63(a)(2), which enumerated a basis for a court order authorizing the use of a record when “the disclosure is necessary in connection with investigation or prosecution of an extremely serious crime allegedly committed by the patient.” The December 2020 final rule removed the phrase “allegedly committed by the patient,” explaining that the phrase was included in previous rulemaking by error, and clarifying that a court has the authority to permit disclosure of confidential communications when the disclosure is necessary in connection with investigation or prosecution of an extremely serious crime that was allegedly committed by either a patient or an individual other than the patient. 98 85 FR 80626 (December 14, 2020). Section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act On March 27, 2020, Congress enacted the CARES Act 99 to provide emergency assistance to individuals, families, and businesses affected by the COVID-19 pandemic. Section 3221 of the CARES Act, Confidentiality and Disclosure of Records Relating to Substance Use Disorder, substantially amended 42 U.S.C. 290dd-2 to more closely align federal privacy standards applicable to Part 2 records with HIPAA and HITECH Act privacy use and disclosure standards, breach notification standards, and enforcement authorities that apply to PHI, among other modifications. 99 Public Law 116-136, 134 Stat. 281 (March 27, 2020). Significant components of section 3221 are codified at 42 U.S.C. 290dd-2 as further detailed in this NPRM. The requirements in sections 42 U.S.C. 290dd-2(b), (c), and (f), as amended by section 3221 of the CARES Act, with respect to patient consent and redisclosures of SUD records, now align more closely with Privacy Rule provisions permitting uses and disclosures for TPO and establish certain patient rights with respect to their Part 2 records consistent with provisions of the HITECH Act; restrict the use and disclosure of Part 2 records in legal proceedings; and set civil and criminal penalties for violations, respectively. Section 3221 also amended 42 U.S.C. 290dd-2j) and (k) by adding HITECH Act breach notification requirements and new terms and definitions consistent with the HIPAA Rules and the HITECH Act, respectively. Finally, section 3221 requires the Department to modify the NPP 100 requirements at 45 CFR 164.520 so that covered entities and Part 2 programs provide notice to individuals regarding privacy practices related to Part 2 records, including patients' rights and uses and disclosures that are permitted or required without authorization. 100 Section 3221(i) requires the Secretary to update 45 CFR 164.520, the Privacy Rule requirements with respect to the NPP. Paragraph (b) of section 3221, Disclosures to Covered Entities Consistent with HIPAA, adds a new paragraph (1), Consent, to section 543 of the PHSA 101 and expands the ability of covered entities, business associates, and Part 2 programs to use and disclose Part 2 records for TPO. The text of section 3221(b) adding paragraph (1)(B) to 42 U.S.C. 290dd-2 states that once prior written consent of the patient has been obtained, those contents may be used or disclosed by a covered entity, business associate, or a program subject to this section for the purposes of treatment, payment, and health care operations as permitted by the HIPAA regulations. Any disclosed information may then be redisclosed in accordance with the HIPAA regulations. 101 Paragraph (1) is codified at 42 U.S.C. 290dd-2(b). To the extent that 42 U.S.C. 290dd-2(b)(1) now provides for a general written consent covering all future uses and disclosures for TPO “as permitted by the HIPAA regulations,” and expressly permits the redisclosure of Part 2 records received for TPO “in accordance with the HIPAA regulations,” the Department believes that this means that the entity receiving the records based on such general consent, and then redisclosing the records, must be a covered entity, business associate, or Part 2 program. The Department's proposals throughout this NPRM are premised on its reading of section 3221(b) as applying to redisclosures of Part 2 records by covered entities, business associates, and Part 2 programs, including those covered entities that are Part 2 programs. In addition to the provisions of section 3221 described above, paragraph (g) of section 3221, Antidiscrimination, adds a new provision (i)(1) to 42 U.S.C. 290dd-2 to prohibit discrimination against an individual based on their Part 2 records in: (A) admission, access to, or treatment for health care; (B) hiring, firing, or terms of employment, or receipt of worker's compensation; (C) the sale, rental, or continued rental of housing; (D) access to Federal, State, or local courts; or (E) access to or maintenance of social services and benefits provided or funded by Federal, State, or local governments. 102 Further, the new paragraph (i)(2) prohibits discrimination by any recipient of Federal funds against individuals based on their Part 2 records. 103 As a recent legal analysis noted, “The decision to protect individuals whose disclosed patient records reveal or appear to reveal current illegal use of drugs is also consistent with Section 3221's specific purpose to remove well-founded fear of discrimination as a barrier to treatment.” 104 Patients with SUD who are currently using illegal drugs are not protected from discrimination on the basis of their illegal drug use under existing law of the Rehabilitation Act of 1973, 105 Americans with Disabilities Act (ADA), 106 the Affordable Care Act, 107 and the Fair Housing Act. 108 The CARES Act nondiscrimination provision, in conjunction with the newly applicable HITECH Act penalty tiers, will serve to protect the treatment records of all patients with SUD, whether or not they are currently using illicit drugs. The Department intends to implement the CARES Act antidiscrimination provisions in a separate rulemaking. 102 See sec. 3221(g) of the CARES Act. 103 Id. 104 See Dineen, Kelly K., & Pendo, Elizabeth, “Substance Use Disorder Discrimination and the CARES Act: Using Disability Law to Inform Part 2 Rulemaking” (February 2, 2021) (available at https://arizonastatelawjournal.org/wp-content/uploads/2021/02/02-Dineen-_-Pendo.pdf ) and Johnson, Kimberly, “COVID-19: Isolating the Problems in Privacy Protection for Individuals with Substance Use Disorder” (May 1, 2021) (available at https://ssrn.com/abstract=3837955 ). See also remarks of U.S. Representative Michael C. Burgess: “Current [P]art 2 law does not protect individuals from discrimination based on their treatment records and, to this date, there have been no criminal actions undertaken to enforce [P]art 2.” (available at https://www.congress.gov/congressional-record/2018/06/20/house-section/article/H5325-1 ). 105 See sec. 504, Public Law 93-112, 86 Stat. 355 (September 26, 1973) (codified at 29 U.S.C. 701, 705). 106 See Public Law 101-336, 104 Stat. 327 (July 26, 1990) (codified at 42 U.S.C. 12101, 12210). 107 See sec. 1557, Public Law 111-148, 124 Stat. 119 (March 23, 2010) (codified at 42 U.S.C. 18001, 18116). 108 See sec. 3601-19, Public Law 90-284, 82 Stat. 81 (April 11, 1968) (codified at 42 U.S.C. 3601, 3602). Section-by-Section Description of Proposed Amendments to 42 CFR Part 2 Below, the Department describes the proposals in this NPRM to amend 42 CFR part 2 and 45 CFR 164.520 to implement changes made to 42 U.S.C. 290dd-2, as amended by section 3221 of the CARES Act. Some of the Department's proposals are not expressly required by the CARES Act, but are proposed to align the language of this part with that in the Privacy Rule and to clarify already-existing Part 2 permissions or restrictions. The Department believes these additional proposals fall within the Department's scope of regulatory authority and are necessary to facilitate implementation of the CARES Act. For example, consistently throughout this NPRM, the Department proposes to re-order the terms “disclosure and use” to “use and disclosure” 109 to better align the language of Part 2 with the Privacy Rule which generally regulates the “use and disclosure” of PHI. 110 The Department does not believe these proposed changes are substantive, but requests comment on this assumption. In another example, the Department proposes to add the term “use” to where only the term “disclose” exists in regulatory text, or in some cases to add the term “disclose” to an existing “use” because it more accurately describes the scope of the activity that is the subject of the regulatory provision or could be within the scope of the activity. These changes are aligned with changes made to 42 U.S.C. 290dd-2 paragraph (b)(1)(A) by section 3221(b) of the CARES Act (providing that Part 2 records may be used or disclosed in accordance with prior written consent); to 42 U.S.C. 290dd-2(b)(1)(B) and (b)(1)(C) by section 3221(b) of the CARES Act (providing that the contents of Part 2 records may be used or disclosed by covered entities, business associates, or programs in accordance with the HIPAA Rules for TPO purposes); and to paragraph 42 U.S.C. 290dd-2(c) by section 3221(e) of the CARES Act (prohibiting disclosure and use of Part 2 records in proceedings against the patient). The Department describes these proposed additions of terms in each section of this NPRM where applicable. 111 The Department requests comment on its proposals to reorder the terms “use” and “disclosure” as described, and to add the term “use” to clarify these regulations as described above. 109 See e.g., proposed regulatory text at §§ 2.2(a)(2), (a)(3), and (b)(1), Purpose and effect; 2.12(c)(5) and (c)(6), Applicability; 2.13(a) and (b), Confidentiality restrictions and safeguards; 2.21(b), Relationship to federal statutes protecting research subjects against compulsory disclosure of their identity; 2.34(b), Disclosures to prevent multiple enrollments; 2.35(d), Disclosures to elements of the criminal justice system which have referred patients; 2.53(a), (b)(1)(iii), (e)(1)(iii), (e)(6), (f), Management audits, financial audits, and program evaluation (proposed heading); subpart E, Court Orders Authorizing Use and Disclosure (proposed heading); 2.61(a), Legal effect of order; 2.62, Order not applicable to records disclosed without consent to researchers, auditors and evaluators; 2.65 heading, 2.65(a) and (d), 2.65(e), (e)(1), and (e)(3), Procedures and criteria for orders authorizing use and disclosure of records to criminally investigate or prosecute patients (proposed heading); 2.66 heading, 2.66(a)(1) and 2.66(d), Procedures and criteria for orders authorizing use and disclosure of records to investigate or prosecute a part 2 program or the person holding the records (proposed heading). 110 Consistently, the Department refers to “uses and disclosures” or “use and disclosure” in the Privacy Rule. See, e.g., 45 CFR 164.502 Uses and disclosures of protected health information: General rules. 111 See, e.g., proposed §§ 2.12(a)(1), (c)(3) and (c)(4), (d)(2), and (e)(3), Applicability; 2.13(a), Confidentiality restrictions and safeguards; 2.14(a) and (b), Minor patients; 2.15(a)(2), (b)(1) and (b)(2), Patients who lack capacity and deceased patients; 2.20, Relationship to state laws; 2. 23 Patient access and restrictions on use and disclosure (proposed heading) and 2.33(b); Subpart C—Uses and Disclosures With Patient Consent (proposed heading); 2.31(a), (a)(1) and (2), (a)(4)(ii)(B), (a)(10), and (a)(10)(i) and (ii), Consent requirements; 2.33 Uses and disclosures permitted with written consent (proposed heading), and paragraphs 2.33(a), (b), (b)(1), and (b)(2); Subpart D—Uses and Disclosures Without Patient Consent (proposed heading); 2.53(e)(5), Management audits, financial audits, and program evaluation 2.61(a) and (b)(1) and (b)(2), Legal Effect of order; 2.64 heading, Procedures and criteria for orders authorizing uses and disclosures for non-criminal purposes (proposed heading), and paragraphs (a) and (e); 2.65(a) Procedures and criteria for orders authorizing use and disclosure of records to criminally investigate or prosecute patients (proposed heading); 2.67 (d)(3), Orders authorizing the use of undercover agents and informants to investigate employees or agents of a part 2 program in connection with a criminal matter. In addition, the Department proposes changes to subpart E, Court Orders Authorizing Use and Disclosure, relying on both the Secretary's broad rulemaking authority under section 543 of the PHSA and on the authority granted in section 3221 of the CARES Act. The Department proposes to heighten protections against use or disclosure of records in proceedings against patients by aligning the regulatory language regarding the scope of proceedings to which subpart E applies with the amended statute to expressly include administrative and legislative proceedings 112 and to expressly include testimony that relays information contained in records. 113 Additionally, the Department is adopting the HIPAA phrasing of “use and disclosure” in most instances where only one of those terms is used in the current regulation, including throughout subpart E. 112 See proposed §§ 2.63, 2.64, 2.65. 113 See proposed §§ 2.64. 2.65, 2.66. The Department also proposes additional changes to facilitate compliance by investigative agencies when they seek records for investigations and prosecutions of Part 2 programs pursuant to applicable authorities. In particular, the Department proposes to limit liability for violations when an investigative agency unknowingly receives Part 2 records in the course of investigating a Part 2 program or person holding Part 2 records, provided the agency takes certain actions, and to require annual reporting to the Secretary by investigative agencies about the use of the proposed safe harbor. The Department is proposing these changes because the Department believes the proposals are a necessary consequence of the new enforcement penalties for violations of Part 2 114 pursuant to 42 U.S.C. 290dd-2(f) as amended by section 3221 (f) and the expanded scope of proceedings where a court order is required 115 pursuant to 42 U.S.C. 290dd-2(c) as amended by section 3221(e). In particular, the Department understands that investigative agencies could potentially become subject to the new penalties for violations in the event that they are unaware that a provider under investigation is subject to Part 2 and as a result they fail to follow the requirements of subpart E before obtaining the provider's records. The Department requests comment on these additional proposed changes. 114 See proposed § 2.3. 115 E.g., Expressly including legislative and administrative proceedings and testimony relaying information contained in records, as discussed above. The Department further requests comment on all proposals described in the following paragraphs of this NPRM, including those expressly implementing CARES Act amendments to section 290dd-2, those the Department describes as necessary to further align this part with the Privacy Rule, and those proposals described as necessary to clarify the full scope of activities that it is regulating in this part. The Department also requests comment on all aspects of the Regulatory Impact Analysis, including the assumptions and estimates about the costs and benefits of the proposed changes, and the alternatives the Department considered when developing the proposals in this NPRM. The Department proposes the following amendments to this part: A. § 2.1—Statutory Authority for Confidentiality of Substance Use Disorder Patient Records The Department proposes to revise § 2.1 to more closely align this section with the statutory text of 42 U.S.C. 290dd-2(g) and add references to subsection 290dd-2(b)(2)(C) related to the issuance of court orders authorizing disclosures of Part 2 records. § 2.2—Purpose and Effect Section 2.2 of 42 CFR part 2 establishes the purpose and effect of regulations imposed in this part upon the use and disclosure of Part 2 records. The Department proposes to add language to paragraph (b) of § 2.2 to conform that paragraph to changes proposed to § 2.3(b) that would compel disclosures to the Secretary that are necessary for enforcement of this rule. The new language is adapted from a similar provision of the Privacy Rule at 45 CFR 164.502(a)(2)(ii). The Department also proposes to replace the phrase “disclosure and use” by re-ordering the phrase to “use or disclosure” at §§ 2.2(a), (a)(4), and 2.2(b)(1), to align the language with that used in the Privacy Rule. The Department proposes several changes in § 2.2 that would facilitate implementation of the CARES Act in general. For example, in §§ 2.2(a)(2), (a)(3), and (b)(1), the Department proposes to add the phrase “uses and” in front of the existing term “disclose” or “disclosures.” The Department proposes these additions in §§ 2.2(a)(2) and (3), which list subparts C and D of this part, to conform to changes the Department proposes to the heading titles of subparts C and D. In those heading titles, the Department proposes to refer to “Uses and Disclosures with Patient Consent” and “Uses and Disclosures without Patient Consent” respectively. In § 2.2(b)(1), Effect, the Department proposes to refer to “use and disclosure” instead of only “disclosure” to better describe how the regulations in this part, as modified by the CARES Act, prohibit the “use and disclosure” of Part 2 records. The Department proposes to modify the end of § 2.2(b)(1) to provide that the regulations generally do not generally require the use or disclosure of Part 2 records under any circumstance except when disclosure is required by the Secretary to investigate or determine a person's compliance with this part pursuant to § 2.3(b), now proposed for modification to reflect newly required civil and criminal penalties for violations of this part. Finally, the Department proposes to add a new paragraph (b)(3) to § 2.2 to incorporate the rules of construction in section 3221(j)(1) and (2) of the CARES Act. Accordingly, the proposed paragraphs would provide that nothing in this part shall be construed to limit a patient's right to request restrictions on use of records for TPO or a covered entity's choice to obtain consent to use or disclose records for TPO purposes as provided in the Privacy Rule. In addition to the above-described proposed amendments to § 2.2, the Department proposes minor wording changes to improve readability or conform the use of terms to newly proposed definitions. These proposals are reflected in proposed regulatory text and may be reflected throughout this NPRM and include: • Inserting a parenthetical reference to “records” to reflect how the Department proposes to refer to SUD records; and • Striking the word “patient” from in front of the term “record”. The Department requests comments on all proposed changes to this section. § 2.3—Civil and Criminal Penalties for Violations (Proposed Heading) Section 2.3 of 42 CFR part 2 currently requires that any person who violates any provision of the Part 2 regulations be criminally fined in accordance with title 18 U.S.C. As amended by section 3221(f) of the CARES Act, 42 U.S.C. 290dd-2(f) applies the provisions of §§ 1176 and 1177 of the Social Security Act to a Part 2 program for a violation of 42 CFR part 2 in the same manner as they apply to a covered entity for a violation of part C of title XI of the Social Security Act. Therefore, the Department proposes to replace title 18 criminal enforcement with civil and criminal penalties under §§ 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d-5, 1320d-6), respectively, as implemented in the Enforcement Rule. Specifically, the Department proposes to rename § 2.3 as Civil and criminal penalties for violations and reorganize § 2.3 into section paragraphs 2.3(a), (b), and (c). Proposed § 2.3(a) would incorporate the penalty provisions of 42 U.S.C. 290dd-2(f), which apply the civil and criminal penalties of §§ 1176 and 1177 of the Social Security Act, respectively, to violations of Part 2. After consultation with the Department of Justice, the Department proposes in § 2.3(b) to create a limitation on civil or criminal liability for persons acting on behalf of investigative agencies when, in the course of investigating or prosecuting a Part 2 program or other person holding Part 2 records, they may unknowingly receive Part 2 records without first obtaining the requisite court order, provided that specified conditions are met. Such a safe harbor, as proposed, would be limited to only instances where records are obtained for the purposes of investigating a program or person holding the record, not a patient. Investigative agencies are required to follow Part 2 requirements for obtaining, using, and disclosing Part 2 records as part of an investigation or prosecution; such requirements include seeking a court order, filing protective orders, maintaining security for records, and ensuring that records obtained in program investigations are not used in legal actions against patients who are the subjects of the records. Investigative agencies' potential liability for violating Part 2 has increased due to the expanded application of HIPAA/HITECH Act penalties for violations, codified at 42 U.S.C. 1320d-5 (CMPs) and 1320d-6 (criminal penalties), to violations of Part 2. In addition, the need for investigation and prosecution of bad actors has increased in accordance with the intensity and duration of the opioid overdose epidemic. 116 The Department solicits comments on the need for investigation of Part 2 programs and holders of Part 2 records and a related safe harbor for law enforcement due to proposed changes in enforcement of Part 2 requirements. 116 See Opioid Enforcement Effort, Department of Justice, Consumer Protection Branch, https://www.justice.gov/civil/consumer-protection-branch/opioid and Understanding the Epidemic, Centers for Disease Prevention and Control, https://www.cdc.gov/drugoverdose/epidemic/index.html. To address concerns about potential liability for Part 2 violations arising from investigators who, in good faith, unknowingly receive Part 2 records, the Department proposes at § 2.3(b) to create a limitation on civil or criminal liability for persons acting on behalf of investigative agencies if they unknowingly receive Part 2 records without first obtaining the required court order while investigating or prosecuting a Part 2 program or other person holding Part 2 records (or their employees or agents). The limitation on liability would be available for uses or disclosures inconsistent with Part 2 when the person acted with reasonable diligence to determine in advance whether Part 2 applied to the records or program. Paragraph (b)(1) would also clarify what constitutes “reasonable diligence” in determining whether Part 2 applies to a record or program before an investigative agency makes an investigative demand or places an undercover agent with the program or person holding the records. Reasonable diligence would require acting within a reasonable period of time, but no more than 60 days prior to, the request for records or placement of an undercover agent or informant. Reasonable diligence would include taking the following actions to determine whether a health care practice or provider (where it is reasonable to believe that the practice or provider provides SUD diagnostic, treatment, or referral for treatment services) provides such services by: (1) checking a prescription drug monitoring program in the state where the provider is located, if available and accessible to the agency under state law; or (2) checking the website or physical location of the provider. In addition, § 2.3(b) would require an investigative agency to meet any other applicable requirements within Part 2 for any use or disclosure of the records that occurred, or will occur, after the investigative agency knew, or by exercising reasonable diligence would have known, that it received Part 2 records. The Department has added applicable requirements in § 2.66 and § 2.67, discussed below, and requests comment on the impact of the proposed safe harbor on patient privacy and access to SUD treatment. The proposed safe harbor could promote public safety by permitting government agencies to investigate or prosecute Part 2 programs and persons holding Part 2 records for suspected criminal activity, in good faith without risk of HIPAA/HITECH Act penalties. The current rule contains no mechanism for an investigative agency to correct an error if it unknowingly obtains Part 2 records and as a result fails to obtain the required court order in advance. By proposing a pathway for investigative agencies to seek the required court order after the fact (a pathway that is only available for agencies that have first exercised reasonable diligence to determine in advance whether Part 2 applies), the proposal creates an incentive for investigative agencies to take steps that should reduce the need for “after the fact” court orders. Thus, investigative agencies that follow the proposed reasonable diligence steps and yet unknowingly receive Part 2 records and then seek a court order would be less likely to be denied on the basis of a procedural shortcoming and would not risk incurring HIPAA/HITECH Act penalties. Investigative agencies that do not use reasonable diligence as proposed at § 2.3(b)(1) would be precluded from seeking a court order to use or disclose Part 2 records that they later discover in their possession. The Department acknowledges that proposed § 2.3(b) may be viewed as a reduction in privacy protection, but believes that the exclusive application to investigations and prosecution of programs and holders of records affords an overall benefit without harming patient confidentiality when the proposed additional protections in §§ 2.66 and 2.67 are applied. 117 The Department has limited the proposed safe harbor to investigative agencies that unknowingly obtain Part 2 records and relies on the CMP tiers to allow appropriate flexibility when a Part 2 program has unknowingly violated Part 2. However, the Department solicits comments on situations for which a safe harbor should be considered for SUD providers that unknowingly hold Part 2 records and unknowingly disclose them in violation of Part 2. As mentioned above, the Department also solicits comments on the impact of this proposed safe harbor to patient privacy and access to SUD treatment. 117 For example, using “John Doe” in the application for a court order and keeping records that contain patient identifying information under seal. The Department does not intend to modify the applicability of § 2.12 or § 2.53 for investigative agencies, but to make the proposed safe harbor available in those situations where a court order would otherwise be required for a government agency to use or disclose records under these regulations. Thus, under § 2.12(c) an agency with direct administrative control over a Part 2 program still would not be subject to the Part 2 limits on communications between the program and the agency for purposes of diagnosis, treatment, or referral of patients, although the agency is also an investigative agency due to its supervisory role. Similarly, the disclosure permission under § 2.53 would continue to apply to audits and evaluations conducted by a health oversight agency without patient consent. The Department does not believe that the text of section 3221(e) of the CARES Act indicates congressional intent to alter the established oversight mechanisms for Part 2 programs, including those that provide services reimbursed by Medicare, Medicaid, and Children's Health Insurance Program (CHIP). Proposed § 2.3(c) would specify that the Enforcement Rule 118 shall apply to violations of Part 2 in the same manner as they apply to covered entities and business associates for violations of part C of title XI of the Social Security Act and its implementing regulations with respect to PHI. 119 The Department requests comment on the likely benefits and costs of these proposed changes. 118 See 45 CFR part 160, subparts C (Compliance and Investigations), D (Imposition of Civil Money Penalties), and E (Procedures for Hearings). See also sec. 13410 of the HITECH Act (codified at 42 U.S.C. 17929). 119 This proposal would implement the required statutory framework establishing that civil and criminal penalties apply to violations of this part, as the Secretary exercises only civil enforcement authority. The Department of Justice has authority to impose criminal penalties where applicable. See 68 FR 18895, 18896 (April 17, 2003). § 2.4—Complaints of Violations (Proposed Heading) Paragraphs (a) and (b) of this section currently provide that reports of violations of the Part 2 regulations may be directed to the U.S. Attorney for the judicial district in which the violation occurs and reports of any violation by an opioid treatment program may be directed to the U.S. Attorney and also to the Substance Abuse and Mental Health Services Administration (SAMHSA). Section 290dd-2(f), as amended by section 3221(f) of the CARES Act, grants civil enforcement authority to the Department, which currently exercises its HIPAA enforcement authority under 1176 of the Social Security Act in accordance with the Enforcement Rule. To implement the change from U.S. Attorney enforcement, the Department proposes to re-title the heading to this section, replacing “Reports of violations” with “Complaints of violations,” and to replace the existing provisions about directing reports of Part 2 violations to the U.S. Attorney's Office and to SAMHSA with provisions about filing complaints of potential violations with a Part 2 program or the Secretary. The Department notes that SAMHSA continues to regulate opioid treatment programs (OTPs) and may receive reports of alleged violations by OTPs of federal opioid treatment standards, including privacy and confidentiality requirements. Specifically, the Department proposes to add § 2.4(a) to require a Part 2 program to have a process to receive complaints concerning the program's compliance with the Part 2 regulations. Proposed § 2.4(b) would provide that a program may not intimidate, threaten, coerce, discriminate against, or take other retaliatory action against any patient for the exercise of any right established, or for participation in any process provided for, in Part 2, including the filing of a complaint. The Department also proposes to add § 2.4(c) to prohibit a program from requiring patients to waive their right to file a complaint as a condition of the provision of treatment, payment, enrollment, or eligibility for any program subject to Part 2. The proposed changes to § 2.4 would align Part 2 with Privacy Rule provisions concerning complaints. Section 2.4(a) is consistent with the administrative requirements in 45 CFR 164.530(d), Standard: Complaints to the covered entity. Proposed § 2.4(b) would align with the Privacy Rule provision at 45 CFR 164.530(g), Standard: Refraining from intimidating or retaliatory acts. The proposed § 2.4(c) would be consistent with the Privacy Rule provision at 45 CFR 164.530(h), Standard: Waiver of rights. Thus, Part 2 programs that are also covered entities already have these administrative requirements in place, but programs that are not covered entities would need to adopt new policies and procedures. The Department requests comment on these proposed changes, including any concerns about potential unintended negative consequences on programs or patients of aligning § 2.4 with the cited provisions of the Privacy Rule. § 2.11—Definitions Section 2.11 includes definitions for key regulatory terms in 42 CFR part 2. The Department proposes to add thirteen defined regulatory terms and modify the definitions of ten existing terms. The proposed new or modified definitions would be: Breach, Business associate, Covered entity, Health care operations, HIPAA, HIPAA regulations, Informant, Intermediary, Investigative agency, Part 2 program director, Patient, Payment, Person, Program, Public health authority, Qualified service organization, Records, Third-party payer, Treating provider relationship, Treatment, Unsecured protected health information, Unsecured record, and Use. Most of these terms and definitions would be added or modified by referencing existing HIPAA regulatory terms in 45 CFR parts 160 and 164, either in accordance with the adoption of such definitions by section 3221(d) of the CARES Act, which added paragraph (k) (containing definitions) to 42 U.S.C. 290dd-2, or as a logical outgrowth of CARES Act amendments. Several other definitions would be modified for clarity and consistency, as described below. The Department requests comment on all proposals to add new or modify existing definitions to this part. Breach. The proposed definition of Breach would adopt the Breach Notification Rule definition by reference to 45 CFR 164.402, but as applied to Part 2 records rather than to PHI. The Department proposes this definition to implement paragraph (k) of 42 U.S.C. 290dd-2, added by section 3221(d) of the CARES Act, requiring that the term in this part be given the same meaning of the term for the purposes of the HIPAA regulations. Because the CARES Act requires Part 2 programs to comply with HITECH Act breach notification requirements, a Part 2 regulatory definition of breach is necessary to implement and enforce these requirements. Business associate. The Department proposes to adopt the same meaning of this term as is used in the HIPAA Rules. This proposal would implement the new paragraph (k) of 42 U.S.C. 290dd-2, added by section 3221(d) of the CARES Act, requiring the term in this part be given the same meaning of the term for the purposes of the HIPAA regulations. Covered entity. The Department proposes to adopt the same meaning of this term as is used in the HIPAA Rule. This proposal would implement the new paragraph (k) of 42 U.S.C. 290dd- 2, added by section 3221(d) of the CARES Act, requiring the term in this part be given the same meaning of the term for the purposes of the HIPAA regulations. Health care operations. The proposal would incorporate the HIPAA Privacy Rule definition for health care operations. 120 120 See 45 CFR 164.501 (definition of “Health care operations”). HIPAA. Although not required by the CARES Act, the Department proposes to add a definition of HIPAA that encompasses the statutory and regulatory provisions pertaining to the privacy, security, breach notification, and enforcement standards with respect to PHI. This definition would exclude other components of the HIPAA statute, such as insurance portability, and other HIPAA regulatory standards, such as the standard electronic transactions regulation, which are not relevant to this proposed rule. The Department proposes this definition to make clear the specific components of the relevant statutes that would be incorporated into this part. HIPAA regulations. The current rule does not define HIPAA regulations. The proposed definition is based on the statutory definition added by the CARES Act and has the same meaning as “HIPAA Rules,” which refers to the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules, when used in this document, OCR rulemaking, and OCR's guidance and other materials. For purposes of this rulemaking, the term does not include Standard Unique Identifiers, Standard Electronic Transactions, and Code Sets, 42 CFR part 162—Administrative Requirements. Informant. Within the definition of “informant,” the Department proposes to replace the term “individual” with the term “person” as is used in the HIPAA Rules and discussed below. Intermediary. The current rule uses the term intermediary in § 2.13(d)(2) 121 without providing a definition. To improve understanding of the requirements for intermediaries, and to distinguish those requirements from the proposed accounting of disclosure requirements, the Department proposes to establish a definition of intermediary. 121 Section 2.13(d)(2) refers to the description of an intermediary in § 2.31(a)(4)(ii)(B). Examples of an intermediary include, but are not limited to, a health information exchange, a research institution that is providing treatment, an accountable care organization, or a care management organization. In contrast, a research institution that is not providing treatment or a health app that is providing individual patients with access to their records would not be considered an intermediary. Member participants of an intermediary refers to health care provider practices or health-related organizations. It does not include individual health plan subscribers or workforce members who share access to the same electronic health record system. In the current rule, if a patient provides a written consent that is specific to treatment, the general designation of a recipient entity who is an intermediary may be used and the patient would have a right to obtain a list of recipients to whom the intermediary has disclosed their record. Under section 3221 of the CARES Act, a patient consent may contain a general designation of recipients for treatment, payment, and health care operations. Without regulatory clarification this could result in the recipients exchanging health information through an HIE/HIN or other means without triggering the intermediary requirements. To avoid this unintended consequence, the Department proposes additional changes to § 2.31(a)(4) to ensure that intermediaries continue to be named whenever they are used to exchange Part 2 records. Under this proposal, an intermediary would be a person who has received records, under a general designation in a written patient consent, for the purpose of disclosing the records to one or more of its member participants who has a treating provider relationship with the patient. The term intermediary is based on the function of the person—receiving records and disclosing them to other providers as a key element of its role—rather than on a title or category of an organization or business. For example, an electronic health record vendor that enables entities at two different health systems to share records likely would be an intermediary. That same vendor would not be an intermediary when used by employees in different departments of a hospital to access the same patient's records. Where an intermediary is also a business associate under the HIPAA Rules, it would be subject to the requirements of both an intermediary and a business associate. The requirements for intermediaries would remain unchanged but would be redesignated from § 2.13(d), Lists of disclosures, to new § 2.24, Requirements for intermediaries. These proposed modifications are discussed separately below. Investigative agency. The Department proposes to create a new definition for “investigative agency” to describe those government agencies with responsibilities for investigating and prosecuting Part 2 programs and persons holding Part 2 records, such that they would be required to comply with subpart E when seeking to use or disclose records against a Part 2 program or lawful holder. In conjunction with proposed changes to subpart E pertaining to use and disclosure of records by law enforcement, the Department proposes to define an investigative agency as “A state or federal administrative, regulatory, supervisory, investigative, law enforcement, or prosecutorial agency having jurisdiction over the activities of a part 2 program or other person holding part 2 records.” By creating a definition of investigative agency, the Department does not intend to change the applicability of § 2.53 or subpart E, but only to establish a limitation on liability for such agencies in certain circumstances when a court order is otherwise required by these regulations. Part 2 program director. Within the definition of “part 2 program director,” the Department proposes to replace the first instance of the term “individual” with the term “natural person” and the other instances of the term “individual” with the term “person” as used in the HIPAA Rules and discussed below. Patient. The Department proposes to add language to the existing definition to clarify that when the HIPAA regulations apply to Part 2 records, a patient is an individual as that term is defined in the HIPAA regulations. Payment. The Department proposes to adopt the same definition for this term as in the HIPAA Rules. This proposal would implement the new paragraph (k) of 42 U.S.C. 290dd-2, added by section 3221(d) of the CARES Act, requiring the term in this part be given the same meaning of the term for the purposes of the HIPAA regulations. Person. The term “person ” is currently defined as “an individual, partnership, corporation, federal, state or local government agency, or any other legal entity, (also referred to as “individual or entity”).” Thus, the current Part 2 regulation uses the term “individual” in reference to someone who is not the patient and therefore not the subject of the Part 2 record. In contrast, the HIPAA Rules at 45 CFR 160.103 define the term “individual” to refer to the subject of PHI, and “person” to refer to “a natural person, trust or estate, partnership, corporation, professional association or corporation, or other entity, public or private.” To further the alignment of Part 2 and the HIPAA Rules and provide clarity for programs and entities that must comply with both sets of requirements, the Department proposes to replace the Part 2 definition of “person” with the HIPAA definition in 45 CFR 160.103. As an extension of this clarification, the Department also proposes to replace the term “individual” with “patient” when the regulation refers to someone who is the subject of Part 2 records, to use the term “person” when it refers to someone who is not the subject of the records at issue, and to modify the definition of “patient” in Part 2 to include an “individual” as that term is used in the HIPAA Rules. The Department believes that this combination of modifications would promote the understanding of both Part 2 and the HIPAA Rules and requests comment on whether this or other approaches would provide more clarity. Program. Within the definition of “program,” the Department proposes to replace the term “individual or entity” with the term “person” as is used in the HIPAA Rules and discussed above. Public health authority. The Department proposes to adopt the same meaning for this term as in the Privacy Rule. This proposal would implement the new paragraph (k) of 42 U.S.C. 290dd-2, added by section 3221(d) of the CARES Act, requiring the term in this part be given the same meaning of the term for the purposes of the HIPAA regulations. Qualified service organization. The Department proposes to modify the definition of Qualified service organization (QSO) by adding HIPAA business associates to the regulatory text to clarify that they are QSOs in circumstances when Part 2 records also meet the definition of PHI ( i.e., when a Part 2 program is also a covered entity). The Department believes this proposal would facilitate the implementation of the CARES Act with respect to disclosures to QSOs. The HIPAA Rules generally permit disclosures from a covered entity to a person who meets the definition of a business associate ( i.e., a person who works on behalf of or provides services to the covered entity) 122 without individual authorization, when based on a business associate agreement that incorporates certain protections. 123 Similarly, the use and disclosure restrictions of this part do not apply to the communications between a Part 2 program and QSO when the information is needed by the QSO to provide services to the Part 2 program. This definition is proposed in conjunction with a proposal to modify § 2.12, Applicability, to clarify that QSOs also use Part 2 records received from programs to work “on behalf of” the program. 122 See 45 CFR 160.103 (definition of “Business associate”). 123 See, e.g., 45 CFR 164.504(e). The Department also proposes a wording change to replace the phrase “individual or entity” with the term “person” as now proposed to comport with the HIPAA meaning of the term. Records. The definition of records specifies the scope of information that Part 2 protects. The Department proposes to remove the last sentence of the definition as unnecessary. 124 In the five decades since the promulgation of the Part 2 regulation, health information technology has become widely adopted and it is evident that records include both paper and electronic formats. The Department does not intend to change the meaning or understanding of records with this proposed modification, but only to streamline the description. 124 The last sentence reads “For the purpose of the regulations in this part, records include both paper and electronic records.” 42 CFR 2.11 (definition of “Record”). The Department offers clarification here about how the definition of Part 2 records operates in relation to the HIPAA definitions of PHI, designated record set, and psychotherapy notes. These issues are most pertinent with respect to the right individuals have to access their records under the HIPAA Rules, as explained below (Part 2 does not contain a parallel patient right of access to records). Generally, the HIPAA Privacy Rule gives individuals the right to access all of their PHI in a designated record set. 125 A designated record set is a group of records maintained by or for a covered entity that are a provider's medical and billing records, a health plan's enrollment, payment, claims adjudication, and case or medical management record systems, and any other records used, in whole or in part, by or for the covered entity to make decisions about individuals. 126 A covered entity's Part 2 records usually fall into these categories, and thus are part of the designated record set. This is true when a Part 2 program is a covered entity, as well as when a covered entity receives Part 2 records but is not a Part 2 program. In the latter situation, the Part 2 records become PHI when they are received by or for the covered entity, and part of a designated record set. As such, they are subject to the Privacy Rule's right of access requirements. 125 See 45 CFR 164.524. 126 See 45 CFR 164.501 (definition of “Designated record set”). However, the Privacy Rule right of access excludes psychotherapy notes. 127 If SUD treatment is provided by a mental health professional that is a Part 2 program and a covered entity, and the provider creates notes of counseling sessions that are kept separate from the individual's medical record, those notes would be psychotherapy notes as well as Part 2 records. In this case, the individual would not have a Privacy Rule right of access to those records, but a provider may voluntarily provide access upon request by the individual patient. Additionally, psychotherapy notes created by a Part 2 program that is a covered entity could only be disclosed with a separate written authorization or consent. 127 See 45 CFR 164.524(a)(1)(i); see also 45 CFR 164.501 (definition of “Psychotherapy notes”). The Department is considering whether to create a new definition similar to psychotherapy notes that is specific to the notes of SUD counseling sessions by a Part 2 program professional. Such notes would be Part 2 records, but could not be disclosed based on a general consent for TPO. They could only be disclosed with a separate written consent that is not combined with a consent to disclose any other type of health information. The Department solicits comments on the benefits and burdens of creating such additional privacy protection for SUD counseling notes that are maintained primarily for use by the originator of the notes, similar to psychotherapy notes as defined in the Privacy Rule. Under consideration is a definition such as this: SUD counseling notes means notes recorded (in any medium) by a Part 2 program provider who is a SUD or mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the patient's record. SUD counseling notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: Diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date. As with psychotherapy notes under the Privacy Rule, the separate consent requirement, if adopted, would not apply to SUD counseling notes in the following situations: 1. Use by the originator of the SUD counseling notes for treatment; 2. Use or disclosure by the program for its own training programs in which students, trainees, or practitioners in SUD treatment learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; 3. For the program to defend itself in a legal action or other proceeding brought by the patient; 4. Required for the reporting of child abuse or neglect; 5. Required by law; 6. Required for oversight of the originator of the SUD counseling notes; 7. To a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law; or 8. When necessary to lessen a serious and imminent threat to the health or safety of a person or the public and is to a person or persons reasonably able to prevent or lessen the threat, including the target of the threat. Third-party payer. The term third-party payer refers to an entity with a contractual obligation to pay for a patient's Part 2 services and includes some health plans, which by definition are covered entities. The current regulation, at § 2.12, limits disclosures by third-party payers to a shorter list of purposes than the Privacy Rule allows for health plans. The Department proposes to exclude covered entities from the definition of third-party payer to facilitate implementation of 42 U.S.C. 290dd-2(b)(1)(B), as amended by section 3221(b) of the CARES Act, which enacted a permission for certain recipients of Part 2 records to redisclose them according to the HIPAA standards. The result of this proposed change would be that the current Part 2 disclosure restrictions continue to apply to a narrower set of entities, such as grant-funded programs. The Department believes that this approach would carry out the intent of the CARES Act, while preserving the privacy protections that apply to payers that are not covered entities. The Department also proposes a wording change to replace the phrase “individual or entity” with the term “person” as now proposed to comport with the HIPAA meaning of the term. The Department welcomes comments on the number and type of third-party payers that would not be considered health plans. Treating provider relationship. The Department proposes to modify the Part 2 definition of “treating provider relationship” by replacing the phase “individual or entity” with “person,” in accordance with the proposed changes to the definition of “person” described above. Treatment. The Department proposes to modify the Part 2 definition of “treatment” by adopting the Privacy Rule definition by reference. This proposal would implement the new paragraph (k) of 42 U.S.C. 290dd-2, added by section 3221(d) of the CARES Act, requiring that the term in this part be given the same meaning of the term for the purposes of the HIPAA regulations. By replacing the existing language, the Department does not intend to change the scope of activities that constitute treatment. Thus, it remains true, as provided in the prior definition, that treatment includes the care of a patient suffering from an SUD, a condition which is identified as having been caused by the SUD, or both, in order to reduce or eliminate the adverse effects upon the patient. Unsecured protected health information. The Department proposes to adopt the same meaning of this term as used in the HIPAA Rules. This proposal would implement the new paragraph (k) of 42 U.S.C. 290dd-2, added by section 3221(d) of the CARES Act, requiring that the term in this part be given the same meaning as the term in the purposes of the HIPAA regulations. Unsecured record. To a [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2022-25784. Public record. Not legal advice.