SUD Program Privacy Rules Modified by CARES ACT

In this country, people who need Substance Use Disorder (SUD) treatment often choose not to pursue professional treatment, not because of the cost, but because there is a societal negative stigma attached to the disease.  In 1975, the federal government acted to eliminate the stigma and simultaneously encourage people suffering from SUD to voluntarily ask for help through enactment of vigorous regulations prohibiting the disclosure of SUD records created through programs receiving federal money.  The acknowledged benefits of the government’s 1975 solution are today incongruent with the need for information sharing of patient records through health information exchanges and the integration of behavioral and physical care.

The 1975 government regulations are referenced as “Part 2” protections for people suffering from SUD.  Some twenty years after the implementation of Part 2, the federal government sought to ease the exchange of protected health information without patient consent for purposes of treatment, payment, or certain health care operations.[1] The laws and regulations surrounding this initiative are referred to as the “HIPAA” privacy and security provisions.

As one might suspect, a natural struggle between the policy of information sharing under HIPAA and the policy of Part 2 information lockdown developed. The policy tension became more real as the integration of behavioral and physical health began to take center stage.  In part, the tension was created by individuals in need of treatment abusing the system through “doctor shopping” between their physical health practitioners and their behavioral health practitioners, and the clear and present dangers associated with a physician prescribing counter-indicated medications to individuals undergoing Medication-Assisted Treatment (MAT).  It was the clear and present danger that lead to Senators Joe Manchin (D-WV) and Shelley Moore Capito (R-WV) to introduce the Jessica Grubb’s Legacy Act in the 115^th Congress (S.1850) and twice again in the 116^th Congress (S.1012 and S.3374).  All versions of the Legacy Act were aimed at changing Part 2 protections with the goal of ensuring that medical providers do not accidentally prescribe potentially fatal medications to individuals in recovery as was the case with Jessica Grubbs.  Jessica, having battled SUD for 7 years, was sober and in recovery.  While rebuilding her life in Michigan and training for a marathon, she suffered an injury requiring surgery.  Without any knowledge of Jessica’s SUD history, the discharging physician sent her home with 50 oxycodone. Jessica consequently died from an overdose.  

On Friday, March 27, 2020, President Trump cracked open the closed door of non-disclosure of SUD records by signing the Legacy Act. President Calvin Coolidge once said that “persistence and determination alone are omnipotent.” It took the coronavirus pandemic CARES Act to finally achieve the Legacy Act language in Section 3221. While taking up just shy of 11 pages of the 883 page Cares Act, Section 3221 packs a mighty punch.  In addition to formally erasing the phrase “Substance Abuse” in favor of the more politically correct phrase “Substance Use Disorder,” Section 3221 makes the following changes to Part 2 privacy provisions:

• Prior Written Consent, Purpose, & Re-disclosure.Part 2 records may now be used by a Part 2 program, a covered entity or a business associate for treatment, payment, or certain[2] health care operations upon execution of a single, revocable, prior-written consent applicable to all future use.
• Stronger Prohibitions against Use in Proceedings.Part 2 records may not be disclosed or used in any civil, criminal, administrative, or legislative proceeding conducted by any federal, state, or local authority, against a patient. This means Part 2 records cannot be entered as evidence, cannot be part of the record, cannot be used for law enforcement purposes or investigations, and cannot be used to obtain warrants.
• Stronger Anti-Discrimination Protections.With the loosing of some disclosure comes stronger non-discrimination protections applicable to both intentional and inadvertent disclosure. Entities are prohibited from discriminating against individuals relative to:
  • access to health care as well as admission and treatment;
  • employment (including receipt of worker’s compensation);
  • housing;
  • access to courts; and
  • government funded social services and benefits. Specifically, “[n]o recipient of Federal funds shall discriminate against an individual on the basis of information received by such recipient pursuant to an intentional or inadvertent disclosure of such records or information contained in [the Part 2 records] in affording access to the services provided with such funds.”
• Change in Penalties. Wrongful disclosures of Part 2 information were historically subject to the criminal penalty.The penalties for wrongful disclosure now range from a maximum of $50,000 fine and 1 year in prison for a wrongful disclosure, to a maximum of $100,000 and 5 years in prison if false pretenses were involved, to a maximum of $250,000 and 10 years in prison if the information was used for personal gain or to cause malicious harm.

If you have questions or concerns when navigating the new statutes during this public health emergency, please contact the Dickinson Wright Behavioral Health Law Group!