Proposed Rule Would Prioritize Patient Consent In Dealing With Mental Health Data

The Health and Human Services Department issued a proposed rule change to strengthen the confidentiality of data on patients seeking treatment for substance use disorder and protect that information from unauthorized disclosures. 

Announced on Monday, the HHS’s Office for Civil Right and Substance Abuse and Mental Health Services Administration developed a proposed change to Title 42 of the United States Code of Federal Regulations that strengthens patient information consent protocols and enhances coordination abilities between covered entities and health care providers. The rule’s goal is to reduce barriers to patients attempting to access substance abuse treatment programs by better streamlining privacy provisions with existing federal laws. 

“Varying requirements of privacy laws can slow treatment, inhibit care and perpetuate negative stereotypes about people facing substance use challenges,” said HHS Secretary Xavier Becerra in a press release. “This proposed rule would improve coordination of care for patients receiving treatment while strengthening critical privacy protections to help ensure individuals do not forego life-saving care due to concerns about records disclosure.”

Parts of the CARES Act will be implemented as a result of this rule change, specifically pursuant to section 3221 on patient information confidentiality. This clause requires Becerra, as secretary, to update part 2 of Title 42 with federal health care privacy laws, specifically the Health Insurance Portability and Accountability Act, or HIPAA, and the Health Information Technology for Economic and Clinical Health Act, or HITECH. 

A highlight of the rule change includes the use and disclosure of substance abuse treatment records based on a single patient consent form that will apply to all of the patient’s future treatment, payment and health care operation disclosures. 

The new rule will also allow patients to release sensitive health care information to  legally covered entities, namely health care providers, and other select stakeholders in accordance with HIPAA privacy rules. It also allows patients to receive a record of their disclosures and ability to request restrictions on some disclosures.

Notably, the rule change also imposes new prohibitions on the usage of health data and information by law enforcement. Expanded restrictions include blocking sensitive patient information from being used as evidence in a criminal prosecution or civil case or other legal proceedings absent a court order or patient consent. 

The rule change will also apply HIPAA and HITECH provisions that require entities to notify affected individuals of data breaches. 

“This proposed rule helps decrease burdens on patients and providers, improves coordination and increases access to care and treatment, while protecting confidentiality of treatment records,” said OCR Director Melanie Fontes Rainer.

A comment period will be open to the public for 60 days following the proposed rule’s scheduled publication in the Federal Register on Dec. 2.