A coming realignment of federal regulations governing the confidentiality of drug disorder patient records with other patient privacy requirements made by HIPAA won’t be easy to implement, said attorney David Holtzman, founder of HITprivacy LLC.
“The Part 2 regulation is changing dramatically. But it’s not changing in a way that’s clear-cut or easy to understand,” he said, referring to Section 42 of the Code of Federal Regulations.
42 CFR Part 2 is a longstanding rule governing confidentiality of substance use disorder patient records maintained by federally assisted programs, such as those under Medicare and Medicaid.
The move to better align Part 2 with HIPAA is meant to ease and improve care coordination between medical practices bound by the regulation and those only governed by HIPAA. “It’s now a mishmash of what was already existing in Part 2, and provisions of the HIPAA rules that are being parachuted into this regulation, and the fit is not always clean or concise,” Holtzman said.
The changes to better align Part 2 with HIPAA and the HITECH Act was required under provisions of the Coronavirus Aid, Relief and Economic Security – or CARES Act – enacted in March 2020 (see: Tiny US Agency to Enforce Substance About Regs, HIPAA).
The U.S. Department of Health and Human Services finalized the Part 2 and HIPAA alignment rulemaking in 2024 and compliance goes into effect on Feb. 16.
In the interview (see audio link below photo), Holtzman also discussed:
- The evolution of why changes to Part 2 privacy regulations are necessary to better coordinate patient care;
- The main components of HIPAA-related changes that Part 2 entities need to implement in order to comply with the updated regulations;
- Resources that can help entities comply with the new Part 2 requirements.
Holtzman is the retired founder of HITprivacy LLC where he advised public and private organizations on health information privacy and security. Holtzman previously served on the health information privacy team at HHS OCR. There he led many OCR initiatives including integration of the administration and enforcement of the HIPAA security rule, and health information technology policies. After his time at HHS OCR, Holtzman went on to provide services through the privacy and security consultancy firm formerly known as CynergisTek, before it was acquired by competitor Clearwater.