Align SUD protections with HIPAA

To provide whole-person care, clinical care teams need patient information related to mental health, substance use, and physical health. However, 42 CFR Part 2, a discriminatory provision of federal law, places severe restrictions on the sharing of SUD patient information that go far beyond HIPAA’s requirements. This restriction further stigmatizes SUDs and hinders the integration of SUD care with mental and physical health care. These separate rules have put patient safety at risk by inhibiting sharing of patient information among teams of clinicians (e.g., a physical health care provider might unknowingly prescribe an opioid to an individual with opioid use disorder). These restrictions have also decreased the overall quality of SUD care by making it harder to address patients co-occurring SUD, mental health, and physical health needs, and hindering clinical research that has been made more difficult by keeping SUD data segregated from mental and physical health data.[1]

To address these problems, Congress passed the Protecting Jessica Grubb’s Legacy Act as part of the 2020 Coronavirus Aid, Relief, and Economic Security (CARES) Act.[2][3] The law takes steps to align 42 CFR Part 2 with HIPAA by facilitating the sharing of clinical information with care teams that are essential to accurately diagnose, treat, and provide whole-person care. While HHS has proposed rules that effectively implement many of the CARES Act regulations, the proposed rules do not go far enough. The Congressional sponsors – as well as advocates – have urged HHS to ensure the final rule has patient consent requirements that allow the sharing of SUD information simple and straightforward.[4][5] For example, it is essential that the consent process be folded into the existing HIPAA consent process. HHS should also ensure that SUD patient data does not need to be segregated from other HIPAA-protected data once data has been transmitted between providers. In short, HHS must ensure that the intent of the CARES Act provisions is implemented and that it does not leave barriers that effectively result in a patient’s SUD information, after consent has been given, not being integrated with other patient health information.[1]

If HHS does not effectively address these longstanding barriers in its final regulations, Congress should simply eliminate any discriminatory distinctions between SUD and other patient health information, which are all currently subject to HIPAA’s requirements.