As the mid-February compliance deadline approaches for a rule change better aligning federal regulations for the confidentiality of substance use disorder records with HIPAA, federally-funded treatment practices face several critical unanswered questions, said attorney Aleksandra Vold, a partner at the law firm BakerHostetler.
That includes how quickly federal regulators will move to enforce the changes, details about how records should be technically flagged and protected when mixed with a patient’s other electronic health records, and how records should – or should not – be used in artificial intelligence efforts.
The changes modify Part 2 of Section 42 of the Code of Federal Regulations. The U.S. Department of Health and Human Services assigned the responsibility for Part 2 enforcement to the Office for Civil Rights, the small and seemingly always under-resourced agency that also enforces HIPAA (see: Tiny US Agency to Enforce Substance About Regs, HIPAA).
HHS OCR on Monday unveiled online guidelines containing a collection of agency documents pertaining to mental health and substance use disorder data privacy issues.
But those materials don’t address how HHS OCR plans to tackle the agency’s new enforcement duties, as well as some other related critical issues.
Theoretically, “Part 2 noncompliance will be very much checked on and investigated,” Vold said. “There’s a lot of teeth to this.”
But realistically, whether HHS OCR has the bandwidth to begin breach investigations and other activities related to Part 2 programs anytime soon – in the aftermath of HHS layoffs and on top of the agency’s other HIPAA and civil rights priorities – is unclear, she said.
In the interview (see audio link below photo), Vold also discussed:
- HIPAA breach reporting obligations involving Part 2 records;
- Issues involving the use of Part 2 records for data analytics and AI;
- Other critical considerations involving compliance with Part 2 and HIPAA changes.
Vold is a partner at law firm BakerHostetler, where she advises healthcare systems, insurers and technology companies on complex privacy, cybersecurity and regulatory matters. Her work focuses on guiding clients through high stakes incidents involving unauthorized access, HIPAA obligations, substance use disorder confidentiality matters under 42 CFR Part 2, AI in healthcare and evolving federal and state data privacy requirements.