CARES Act Changes Privacy Rules for Substance Use Disorder Records

The Coronavirus Aid, Relief, and Economic Security Act (CARES Act), signed into law on March 27, made some substantial changes to the confidentiality rules for substance abuse and mental health records to bring them in line with HIPAA confidentiality rules. In addition, references to “substance abuse” have been updated to “substance use disorder.”

1.  Patient Consent for Use and Disclosure for Treatment, Payment and Health Care Operations Purposes

Notably, the previous rules required prior patient written consent for each use and disclosure of records which contained the identity, diagnosis, prognosis, or treatment of any patient in connection with any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States (“Substance Abuse Records”). This required affected individuals to obtain a separate written consent for each use or disclosure of a Substance Abuse Record, which caused administrative hurdles and delays with respect to ordinary business operations.

The CARES Act has now incorporated by reference an exception for the use and disclosure of relevant Substance Abuse Records by a covered entity or business associate. After obtaining a patient’s prior written consent, it is now permissible for a covered entity or business associate to use or disclose Substance Abuse Records for the purposes of treatment, payment or health care operations, as permitted by the HIPAA regulations. A patient’s prior written consent may be given once for all such future uses or disclosures for purposes of treatment, payment and health care operations, until such time as the patient revokes the consent in writing. Any information so disclosed may be redisclosed in accordance with HIPAA regulations. HITECH Act rules related to accountings of disclosures apply to all such disclosures for treatment, payment or health care operations purposes.

Although these changes vastly improve the previous restrictions for covered entities and business associates, it should be noted that a patient may request restrictions on the use and disclosure of such substance use disorder information, which could restrict uses and disclosures to third parties for the purpose of treatment, payment and health care operations.

2.  De-Identification and Disclosure to Public Health Authority

The CARES Act amends the Public Health Service Act to add that de-identified Substance Abuse Records may be disclosed to a public health authority, so long as such content meets the standards established in the HIPAA regulations related to creation of de-identified information.

3.  HIPAA Breach and Substance Use Disorder Records

The CARES Act also added the concept of a “breach” with respect to Substance Abuse Records. The reporting of a “breach” under the HITECH Act now applies to Substance Abuse Records to the same extent and in the same manner such provisions apply to a covered entity in the case of a breach of unsecured protected health information. The CARES Act, in effect, broadens the definition in the HIPAA Regulations of “covered entity” for the purposes of protection and notice of a breach to include all parties that maintain Substance Abuse Records. Furthermore, penalties associated with a violation of HIPAA will also apply to a violation of these extended rules.

4.  Notice of Privacy Practices

Within one year of the enactment of the CARES Act, regulations will be promulgated so that covered entities creating or maintaining Substance Abuse Records must provide notice of privacy practices regarding the rights of the patients and the purpose for which the covered entity is permitted or required to disclose protected health information, including Substance Abuse Records.

5.  Use of Records in Criminal, Civil or Administrative Contexts

The CARES Act substantially expands the previous law regarding use of Substance Abuse Records in criminal proceedings. Except as otherwise authorized by a court order or by consent of a patient, a Substance Abuse Record, or testimony relaying the information contained therein, may not be disclosed or used in any civil, criminal, administrative, or legislative proceeding conducted by any federal, state or local authority against a patient. Specifically, such Substance Abuse Record or testimony may not (1) be entered into evidence in any criminal prosecution or civil action before a federal or state court, (2) form part of the record for decision or otherwise be taken into account in any proceeding before a federal, state or local agency, (3) used by any federal, state or local agency for a law enforcement purpose or to conduct any law enforcement investigation, or (4) used in any application for a warrant.