Tiny US Agency to Enforce Substance Abuse Regs

The U.S. Department of Health and Human Services has put its Office for Civil Rights in charge of investigating and penalizing organizations that breach the confidentiality of substance abuse disorder records. Some fear the agency doesn’t have the bandwidth to enforce both HIPAA and 42 CFR Part 2 regulations.

See Also: Using the Netskope HIPAA Mapping Guide

The move, announced by HHS Secretary Robert F. Kennedy Jr.in a “statement of delegation authority published in the Federal Register on Tuesday, was met with skepticism by some experts.

“For years OCR has been seeking additional budget and staffing,” said privacy attorney Adam Greene of the law firm David Wright Tremaine. “Instead, they have been decimated by recent staffing cuts. Between these cuts, the addition of Part 2 and an agency focus on other Trump administration priorities, I expect that OCR investigations will take significantly longer to resolve over the coming years.”

The change of authority comes after HHS in February 2024, through the Substance Abuse and Mental Health Services Administration, or SAMHSA – which until now enforced 42 CFR Part 2 regulations for many years – and OCR finalized a rule modifying Part 2 to better align with certain aspects of the HIPAA rules and HITECH Act (see: HHS Rule to Ease Record Sharing, Guard Substance Abuse Data).

The 2024 final rulemaking by HHS to better align 42 CFR Part 2 with HIPAA and the HITECH Act was required under provisions of the Coronavirus Aid, Relief and Economic Security – or CARES Act, which was enacted in March 2020 (see: Feds Issue More HIPAA Guidance in Push for Patient Access).

HHS said that the final rule gives the public the ability to file complaints alleging violations of the Part 2 confidentiality provisions, requires Part 2 programs to provide notification of breaches of Part 2 records and implements the regulation for HHS’s civil enforcement authority – giving HHS OCR the ability to investigate, subpoena witnesses, assess civil penalties and negotiate resolution agreements with corrective action plans.

Better Alignment

Compared with HIPAA, 42 CFR Part 2 regulations had previously imposed different privacy requirements for the handling of records for patients receiving substance disorder treatments from federally assisted programs. That included requiring more stringent written consents by patients for the use and disclosure of their records, compared with HIPAA.

A top goal of the 2024 rulemaking changes was to better align 42 CFR Part 2 with HIPAA to improve care coordination among healthcare providers for patients with substance abuse disorders and behavioral health conditions – while protecting patient privacy.

“There are two changes that I think best align HIPAA and Part 2,” said Greene, a former senior adviser at HHS OCR.

“First, HHS revised the Part 2 consent requirements to make it easier to draft a Part 2 consent that also complies with HIPAA. Second, HIPAA-regulated entities who receive Part 2 records pursuant to certain patient consents for treatment, payment and healthcare operations now can generally treat these records no different than other protected health information under HIPAA,” he said.

But he cautioned that “it still remains extremely challenging for Part 2 programs to comply with Part 2 due to the technical and operational challenges of segregating Part 2 records from other health information.”

Stretched Thin?

SAMHSA, which formerly administered and enforced 42 CFR Part 2, was among the HHS agencies that were essentially gutted under a HHS downsizing and restructuring earlier this year. SAMHSA, as well as several others, including the Office of the Assistant Secretary for Health, the Health Resources and Services Administration, the Agency for Toxic Substances and Disease Registry and the National Institute for Occupational Safety and Health, were consolidated under a new HHS unit, the Administration for a Healthy America, or AHA (see: RFK Jr. Cuts at HHS Affect, HIPAA, Cyber Response Units).

But HHS’ overall downsizing and restructuring, which included the elimination of about 20,000 workers, has also cut deep into HHS OCR’s resources and staffing.

OCR is already one of the smaller HHS agencies. Melanie Fontes Rainer, former director of HHS OCR under President Biden, said that during her tenure, OCR had a staff of between 120 and 150 employees, supported by about 90 contracted investigators.

While the HITECH Act gives HHS OCR the ability to use the money it collects from HIPAA settlements and fines for its enforcement efforts, the agency has continually told Congress that it is underfunded and can’t keep up with the increase in HIPAA-related breach investigations. As of Wednesday, HHS OCR was investigating 785 major breach cases reported within the last 24 months, according to its HIPAA Breach Reporting Tool website.

“OCR has had nearly flat appropriations for 20 years, even with OCR’s continued requests for additional appropriations and resources, which has resulted in unsustainable workloads,” the agency said in a statement to ISMG in November 2024 in response to a HHS Office of Inspector General report criticizing its long-dormant HIPAA audit program.

While privacy attorney Iliana Peters of the law firm Polsinelli doesn’t disagree with moving civil enforcement of the Part 2 regulations to HHS OCR, particularly after the recent joint HIPAA and Part 2 rulemaking, including the civil enforcement of Part 2, she said, “I am not sure how OCR will find the resources to undertake such increased enforcement.”

“OCR lost five regional offices and a significant number of federal career services professionals as well as contract staff as part of recent federal reduction efforts,” she said. In the meantime, HHC OCR continues to maintain an increasing HIPAA case load, “particularly with regard to breach investigations, which are taking longer and longer to resolve,” said Peters, also a former senior adviser at HHS OCR.

“My main concern is that when OCR starts to investigate potential Part 2 violations, such investigations will also take many years to resolve, which is a lose-lose-lose scenario for patients, regulated entities and HHS.”

Greene said HHS should also consider addressing some remaining areas of common confusion involving 42 CFR Part 2 in terms of how those regulations mesh with HIPAA.

“The 2024 Part 2 amendments are not clear regarding when a HIPAA-regulated entity that receives records from a Part 2 program may treat these records as protected health information under HIPAA,” he said. “Some provisions indicate that HIPAA compliance is generally sufficient when records are received based on a patient’s consent for treatment, payment or healthcare operations. Other provisions only reconcile Part 2 and HIPAA based on a consent for treatment, payment and healthcare operations,” he said.

“It seems like a very technical distinction, but the difference has a huge impact on the extent that HIPAA-regulated entities must maintain a separate Part 2 compliance program based on the nature of patients’ consents.”

Although HHS OCR is now deemed the administrator and enforcer of 42 CFR Part 2 regulations, SAMHSA is likely to continue to play a key role in supporting HHS’ efforts to address mental health issues, including supporting the availability of substance use disorder treatment, Greene said. “The removal of Part 2 from their portfolio does not change this.”

HHS did not immediately respond to Information Security Media Group’s request for additional details about the 42 CFR Part 2 enforcement changes.