Feds Launch Portal to Report Substance Use Disorder Breaches

The U.S. Department of Health and Human Services has launched a program – including a new breach reporting website – to support enforcement mandates to protect substance use disorder records that went into effect Monday.

See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense

HHS’ Office for Civil Rights called its new program a “landmark” in providing civil enforcement mechanisms for protecting the confidentiality of substance use disorder patient records covered by 42 CFR Part 2 regulations.

HHS OCR’s enforcement authority enables the agency to impose civil monetary penalties and negotiate resolution agreements, monetary settlements and corrective actions for failing to comply with the regulations. Potential penalties for breaches align with HHS OCR’s civil enforcement options for HIPAA breaches (see: Tiny US Agency to Enforce Substance About Regs, HIPAA).

“OCR’s civil enforcement program will instill confidence in patients and encourage them to seek SUD treatment from covered SUD providers. At the same time, compliance with the updated Part 2 regulation will improve care coordination and reduce administrative burdens,” said Paula Stannard, HHS OCR director, in a statement on Friday.

42 CFR Part 2 rules – or more commonly “Part 2” – apply to any federally assisted program that provides substance use disorder diagnosis, treatment or referral for treatment. The Part 2 requirements also apply to people and organizations that receive Part 2 records, including other healthcare providers, qualified service organizations – or QSOs, HIPAA-covered entities and business associates, intermediaries and investigative agencies.

In 2024, HHS finalized rulemaking to better align Part 2 with HIPAA and the HITECH Act, which was required under provisions of the Coronavirus Aid, Relief and Economic Security – or CARES Act, enacted in March 2020 (see: HHS Rule Aligns Substance Disorder Privacy Regs with HIPAA).

A top goal of the changes was to improve care coordination among healthcare providers for patients with substance abuse disorders and behavioral health conditions – while protecting patient privacy.

Compared with HIPAA, Part 2 regulations had previously imposed different privacy requirements for the handling of records for patients receiving substance disorder treatments, including requiring more stringent written consents by patients for the use and disclosure of their records compared with HIPAA.

Under the change, the public has the ability to file complaints alleging violations of the Part 2 confidentiality provisions, and it requires Part 2 programs to provide notification of breaches.

Similar to HHS OCR’s longstanding HIPAA Breach Reporting Tool website for protected health information compromises affecting 500 or more people, HHS OCR on Monday rolled out a new breach reporting portal for the submission and public viewing of breach reports pertaining to Part 2 records compromises affecting 500 or more patients.

Both HIPAA and Part 2 breaches affecting 500 or more people must be reported to HHS within 60 days of discovery.

Like HIPAA breaches, Part 2 breaches affecting fewer than 500 patients must be reported to HHS within 60 days after the end of the calendar year in which the breach was discovered.

Feb. 16 was the deadline for Part 2 healthcare providers and programs to comply with the regulatory changes. Besides breach reporting mandates for privacy and security compromises of Part 2 records, the changes also called for Part 2 organizations to make modifications to patient consent and privacy notices to reflect the changes.

Murky Waters

Some of the details involving the new Part 2 compliance mandates have been a source of confusion that still need further clarification by HHS OCR, some experts said.

“We would like to see OCR provide guidance regarding what language it considers sufficient when providing a description of the scope of the consent” under 42 CFR Part 2, said regulatory attorney Aleksandra Vold, a partner at the law firm BakerHostetler.

“We would also like to see guidance about how to navigate when a state licensing body is investigating a doctor for being intoxicated while providing care, when the hospital has Part 2 records about the provider,” she said.

In addition to rolling out a new Part 2 breach reporting portal for privacy and security compromises, HHS OCR updated the homepage of its longstanding HIPAA breach reporting website to reflect the agency’s new authority to investigate and enforce both HIPAA and Part 2 breaches.

The updated page says that HHS OCR investigates all breaches of protected health information under HIPAA and Part 2 records that affect 500 or more people. “Breaches affecting fewer than 500 individuals may be investigated based on departmental resources and enforcement priorities,” HHS said.

Also, sometimes a Part 2 breach involving patient records could very well be a reportable HIPAA breach, HHS indicated. “A breach of health information that is both PHI and a Part 2 record should be reported separately as a HIPAA breach and a Part 2 breach.”

That’s another murky area, Vold said. “Having two separate forms is likely to cause confusion,” she said.

“In reality, we rarely see breaches of whole electronic health records – we more often see entire file shares being stolen. Parsing out when a document on a file share is still within a hospital-run Part 2 program versus in the hospital’s position as lawful holder [of a Part 2 record] is going to be difficult.”

Some experts question whether HHS OCR realistically has the bandwidth to enforce compliance with the new Part 2 mandates – including Part 2 breach investigations – on top of the tiny agency’s growing mountain of HIPAA breach reports, rulemaking and other duties.

“I am going to wait for what I anticipate will be many questions about how the rule is to operate,” said privacy attorney David Holtzman, retired founder of the consultancy HITprivacy. “OCR does not have the staff or funding to expand its expertise to SUD operations,” said Holtzman, a former senior advisor at HHS OCR.