The U.S. Division of Well being and Human Companies Workplace for Civil Rights (OCR) has introduced that for the primary time civil enforcement mechanisms can be used to guard the confidentiality of substance use dysfunction (SUD) affected person information.
OCR stated the brand new program executes the SUD confidentiality provisions of part 3221 of the CARES Act and its implementing regulation at 42 CFR half 2 (“Half 2”).
Starting Feb. 16, 2026, entities and individuals topic to the regulation defending the confidentiality of SUD affected person information should adjust to all relevant necessities. The penalties for noncompliance align with the penalties obtainable below HIPAA.
OCR investigations carried out below the brand new program could also be resolved via a spread of civil enforcement mechanisms. These embody OCR getting into into decision agreements, securing financial settlements, acquiring commitments for corrective motion, or imposing civil cash penalties for the failure to conform.
“OCR’s civil enforcement program will instill confidence in sufferers and encourage them to hunt SUD remedy from lined SUD suppliers. On the similar time, compliance with the up to date Half 2 regulation will enhance care coordination and scale back administrative burdens,” stated Paula M. Stannard, director of the HHS OCR, in an announcement. “OCR is uniquely positioned to implement affected person rights and the regulated neighborhood’s obligations given our intensive expertise administering compliance and enforcement applications for well being info privateness, safety, and breach notification below HIPAA.”
Starting Feb. 16, OCR will start accepting:
• Complaints alleging violations of the regulation that shield the confidentiality of SUD affected person information.
• Notification of breaches of SUD affected person information.
Listed below are a number of the methods the Half 2 rule was modified in 2024:
The Affected person Consent
• Permits a single consent for all future makes use of and disclosures for remedy, fee, and well being care operations.
• Permits HIPAA lined entities and enterprise associates that obtain information below this consent to redisclose the information in accordance with the HIPAA laws.
Different Makes use of and Disclosures
• Permits disclosure of information with out affected person consent to public well being authorities, supplied that the information disclosed are de-identified in keeping with the requirements established within the HIPAA Privateness Rule.
• Restricts using information and testimony in civil, felony, administrative, and legislative proceedings in opposition to sufferers, absent affected person consent or a courtroom order.
• Penalties: Aligns Half 2 penalties with HIPAA by changing felony penalties presently in Half 2 with civil and felony enforcement authorities that additionally apply to HIPAA violations.
• Breach Notification: Applies the identical necessities of the HIPAA Breach Notification Rule to breaches of information below Half 2.
• Affected person Rights: Offers new rights for sufferers below Half 2 to acquire an accounting of disclosures and to request restrictions on sure disclosures, as additionally granted by the HIPAA Privateness Rule. Observe, the compliance date for the accounting of disclosures can be set when the identical proper is revised within the HIPAA Privateness Rule.
•
Affected person Discover: Aligns Half 2 Affected person Discover necessities with the necessities of the HIPAA Discover of Privateness Practices.
OCR has additionally developed a mannequin affected person discover and up to date its mannequin HIPAA Notices of Privateness Practices for regulated entities to make use of in offering discover to sufferers on how federal legislation protects the confidentiality of SUD affected person information. OCR’s Half 2 webpage has extra info and sources.
