Healthcare Information Security

HIPAA and Compliance News

House Debates Bill to Align SUD Rules with HIPAA Privacy Rule

Supporters and opponents of a bill that would align privacy protections for substance use disorder patients with the HIPAA Privacy Rule faced off during a May 8 House panel hearing.


Source: Thinkstock

By Fred Donovan

- Supporters and opponents of a bill that would align privacy protections for substance use disorder (SUD) patients with the HIPAA Privacy Rule faced off during a May 8 hearing of the House Energy and Commerce Committee’s health subcommittee.

The Overdose Prevention and Patient Safety Act (HR 3545) would amend 42 CFR Part 2, which is intended to protect the confidentiality of people who seek SUD treatment, to expand healthcare provider access to SUD patient records while maintaining privacy protections under HIPAA.

42 CFR Part 2 restricts the disclosure of patient records concerning addiction treatment by any federally assisted alcohol and drug abuse program without the written consent of the patient. Since most programs receive federal assistance or use a federally controlled substance for detoxification and treatment, the rule has widespread application.

Under the HIPAA Privacy Rule, health information may be used or disclosed by covered entities for the purposes of treatment, payment, and other healthcare operations—including case management, care coordination, and outcomes evaluation—without patient consent.

While 42 CFR Part 2 is designed to protect the privacy of people who seek SUD treatment, some healthcare organizations are advocating amending it, arguing that the strict confidentiality requirements have a negative impact on the healthcare of addicts.

READ MORE: Senate Bill Has Version of Jessie’s Law, Not Aligned with HIPAA Privacy Rule

“Clinicians treating patients for any condition need access to their complete medical histories, including information related to any substance use disorder (SUD), to ensure their patients’ safety, and delivery of the highest quality care,” argued American Hospital Association Executive Vice President Thomas P. Nickels in a letter sent to the House Energy and Commerce Committee leadership.

“Partitioning a patient’s record to keep SUD diagnoses and treatments hidden from the clinicians entrusted to care for the patient, as required by 42 CFR Part 2, is dangerous for the patient, problematic for providers and contributes to the stigmatization of mental and behavioral health conditions,” he continued.

Testifying before the House health subcommittee in favor of HR 3545 was Rep. Earl Blumenaur (D-Ore.), who sponsored the bill along with Rep. Markwayne Mullin (R-Okla.).

“Our bipartisan legislation would treat medical records generated at a substance use treatment facility that relate to treatment, payment, or healthcare operations in the exact same manner as all other medical records, removing the stigma that has for so long segregated those records from the rest of the healthcare system,” he said.

“Our legislation maintains and strengthens Part 2 protections to prevent disclosure of information. For example, it is currently illegal to share an individual’s substance use treatment record with an employer, law enforcement, or landlord; that wouldn’t change under this legislation. Indeed, we would strengthen the penalties for unauthorized disclosure,” Blumenaur added.

READ MORE: Considering HIPAA Privacy Rule with Mental Health Data

Two witnesses testified against amending 42 CFR Part 2 to bring it in line with HIPAA.

Faces and Voices of Recovery Executive Director Patty McCarthy Metcalf said that weakening 42 CFR Part 2 privacy protections will discourage individuals who need SUD treatment from seeking it.

“We do not want our highly sensitive personal information shared for the purposes of treatment payment, healthcare operations, or for any other purposes beyond the current rule without our expressed written consent,” she told the panel.

“The dismantling of 42 CFR Part 2 is the antithesis of the principle of patient-centered, integrated care, and is largely being pursued by groups who hold their own business interests ahead of the rights and interests of our community,” Metcalf said in her testimony.

“Beyond the significant harm that eliminating Part 2 would do to our communities, it is entirely unnecessary. There is far too much at stake here for those of us depending on these protections in order that we may heal and realize our full potential,” she concluded.

READ MORE: HIPAA Privacy Rules Considered in Recent Mental Health Bill

H. Westley Clark, dean’s executive professor in the Public Health Program at Santa Clara University, testified that lessening privacy protections for SUD patients would open them up to discrimination.

“Disclosure of information [on SUD treatment] can give rise to harm to the individual affected. These harms include loss of employment, loss of housing, loss of child custody, loss of benefits, stigma and discrimination, loss of privacy, shame, and the loss of autonomy,” Clark said.

Nor did Clark think HIPAA would provide SUD patients with privacy protections should 42 CFR Part 2 be amended.

“The healthcare operations exception found in HIPAA is a loophole in confidentiality that is so large you can drive a MAC truck through it. Neither providers nor regulators will be able to protect those with substance use disorders. The only choice for those who are most vulnerable is not to seek treatment,” he stressed.

During the question and answer period, Mullin challenged Clark on his descriptions of the harms that could result from amending 42 CFR Part 2.

“How would you discriminate legally? Is that just an assumption you’re making, because there is no legal way to do that? There are laws that protect the individual from that type of discrimination, is that not true?” asked Mullin.

“No, that is not true,” responded Clark. “If I am an active substance user, the ADA [Americans with Disabilities Act] does not protect me.”

Mullin said that as an owner of property companies, he cannot use information about substance use to deny someone housing. As an employer, he could not use the information to deny someone employment.

“You are making an assumption here that is not accurate,” Mullin said.

Dustin McKee, director of policy at the National Alliance on Mental Illness of Ohio, supported HR 3545, arguing that 42 CFR Part 2 is a barrier to integrating physical and behavioral health.

“We know that siloed treatment for mental illness and addiction is ineffective and leads to negative outcomes in both an individual’s mental health and substance use condition,” he said. “These burdensome consent requirements [under 42 CFR Part 2] that are not aligned with HIPAA further stigmatize mental illness and substance abuse as separate from the rest of the healthcare system.”

Gerald DeLoss, partner with the Chicago law office of Greenfelder, Hemker, and Gale, testified that the bill under consideration would not remove protections against disclosing SUD treatment information to employers, landlords, life insurance companies, or law enforcement.

It would allow disclosure of that information only to HIPAA covered entities—healthcare providers, health plans, and healthcare clearinghouses—not business associates or other third parties.

Jeremiah Gardner, manager for public affairs and advocacy at the Hazelden Betty Ford Foundation, said that the bill is about bringing down barriers to ensure the best care for SUD patients.

“The topic of privacy is rarely broached by the thousands who call the Hazelden Betty Ford Foundation for help each year. Most want to know, ‘Can you help?’ and ‘How can I pay for this?’” Gardner said.

“I believe this bill addresses those priorities that patients and their families care about most. I also believe that HIPAA is a sufficient and enforceable privacy standard, that discrimination can and must be prosecuted vigorously, and that this is an essential piece of the federal opioid response,” he concluded.

In a statement emailed to about the hearing, Centerstone Vice President of Adult and Family Services Linda Grove-Paul observed that “Part 2 provisions are not compatible with the way healthcare is delivered today. This provision, put into place in the early 1970s, was created decades before HIPAA or electronic health records existed.”

Centerstone is one of the largest nonprofit providers of community-based behavioral healthcare in the United States.

“Access to a patient’s entire medical record, including addiction records, ensures that providers have all the information necessary for safe, effective, high-quality careWe urge Congress to ensure that a patient’s addiction history is included as part of their otherwise complete medical record, so providers will be better equipped to deliver safe, effective, whole person care.”

The Senate is considering a similar bill, S 1850, which is languishing in the Senate Health, Education, Labor, and Pensions Committee. Healthcare organizations had been pushing for inclusion of the bill into Senate’s  comprehensive Opioid Crisis Response Act (S 2680) that passed that same Senate panel last month.

But S 2680 incorporated a watered-down version that would encourage SUD patients to give consent to sharing of information and have that consent prominently displayed in electronic health records.


SIGN UP and gain free access to articles, white papers, webcasts and exclusive interviews on

HIPAA Compliance
Data Breaches

Our privacy policy

no, thanks

Continue to site...