The March 2024 issue of Greenberg Traurig’s quarterly Behavioral Health Law Ledger discusses HHS’s final rule modifying the confidentiality regulations applicable to substance use disorder treatment records, the introduction of a new funding model intended to test approaches for addressing the physical and behavioral health needs of people with Medicaid and Medicare, and Colorado’s new commissioner of the Behavioral Health Administration.

HHS Publishes Final Rule Modifying 42 C.F.R. Part 2

On Feb. 16, 2024, the U.S. Department of Health and Human Services (HHS) published the final rule modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records (the Final Rule) codified at 42 C.F.R. Part 2 (Part 2). Part 2 protects the confidentiality of SUD treatment records and applies to “[r]ecords of identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance use abuse education prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States.” The Final Rule takes effect April 16, 2024.

The original Part 2 regulations were developed in the 1970s to address discrimination and stigmas that SUD patients faced when seeking treatment. Although the original regulations were intended to ensure individuals’ rights to privacy and confidentiality, they lacked consideration for a predominantly electronic information environment and presented differing standards than those on regular health care records imposed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). In 2022, HHS released a Proposed Rule on the Confidentiality of Substance Use Disorder (SUD) Patient Records (the Proposed Rule) to align Part 2 patient rights and provider obligations with those under HIPAA, as instructed by the 2020 CARES Act.

The Final Rule codifies several important changes to patient rights and provider obligations regarding Part 2 records:

• Aligns the Part 2 patient notice requirements with the HIPAA Notice of Privacy Practices (NPP) requirements. HHS will be publishing a subsequent final rule modifying the HIPAA Privacy Rule to account for NPP changes.
   
• Aligns Part 2 consent requirements with HIPAA patient authorization requirements by permitting a single patient consent form for future uses and disclosures for treatment, payment, and health care operations. While easing some disclosures via this consent alignment, the Final Rule also expands the prohibitions on the use and disclosure of Part 2 records in civil, administrative, or legislative proceedings absent patient consent or a court order to retain patient protections against use of Part 2 records in legal proceedings.
   
• Patients now have a right to obtain an accounting of Part 2 record disclosures for the previous three years and the right to request restrictions on disclosures of Part 2 records. Notably, the Final Rule does not grant patients an explicit right to access their own SUD records (consistent with the prior Part 2 regulatory text).
   
• The Final Rule delineates tiers of entities subject to Part 2, including those Part 2 programs that are also subject to HIPAA versus those that are not. The Final Rule also defines “lawful holder” and omits family, friends, and close caregivers from such definition (i.e., such parties are not subject to Part 2). The Final Rule goes on to specify redisclosure allowances and restrictions for these tiers relating to treatment, payment, and health care operations redisclosures.
   
• Applies the HIPAA/HITECH breach notification requirements to breaches of Part 2 records by covered entities (but, notably, not qualified service organizations).
   
• Defines “SUD counseling notes” akin to HIPAA’s definition of psychotherapy notes and imposes greater protections on SUD counseling notes, including a separate patient consent to authorize the disclosure of SUD counseling notes.
   
• No longer requires Part 2 records to be segregated from other medical records for HIPAA-regulated recipients of Part 2 records, although Part 2 restrictions still apply to all Part 2 records.
   
• Disposes of the prior criminal penalty provisions of Part 2 and replaces them with the HIPAA/HITECH tiered civil monetary penalties and criminal penalty structure.
   
• Creates a safe harbor for investigative agencies against penalties under Part 2 who act with “reasonable diligence” to determine whether they have lawfully received records from a Part 2 provider prior to using such records in a legal proceeding.

Part 2 programs and other lawful holders of Part 2 records may need to revise consent forms and patient notices to account for the Final Rule’s key changes. Parties should also explore recordkeeping system modifications and evaluate process weaknesses that could result in Part 2 violations given the breach notification and penalty changes, as well as develop processes to fulfill accounting and restriction requests if they do not already have those processes in place pursuant to HIPAA. Part 2 programs should also sufficiently train their staff on these key changes to ensure compliance therewith prior to the compliance/enforcement date of Feb. 16, 2026.

CMS Announces Innovation in Behavioral Health Model to Improve Integration and Advanced Value-Based Payment in Behavioral Health

On Jan. 19, 2024, the U.S. Department of Health and Human Services (HHS), through the Centers for Medicare & Medicaid Services (CMS), announced the Innovation in Behavioral Health (IBH) Model intended to test approaches for addressing the physical and behavioral health needs of people with Medicaid and Medicare. The IBH Model aims to connect patients with behavioral, physical, and social supports needed to manage their care, and to promote health information technology (health IT) by bolstering infrastructure payments through a value-based payment model to providers participating in the IBH Model. States selected to participate in the IBH Model will also receive cooperative agreement funding to facilitate the IBH Model on a state level.

IBH Model participants will be community-based behavioral health organizations and providers, including both mental health and SUD providers. HHS states that the IBH Model will incentivize participants to “work collaboratively to screen, assess, and coordinate between individuals’ physical and behavioral health needs.” Participants will also be equipped with resources to build and improve health IT infrastructure, including electronic health records, practice transformation, and technical assistance.

The IBH Model is HHS’s next step in aligning the HHS Roadmap for Behavioral Health Integration with President Biden’s 2022 Agenda on addressing and treating mental illness and substance use disorders (SUD). The IBH Model also builds on earlier HHS efforts to include community-based behavioral health practices in value-based care.

The IBH Model will launch in fall 2024 and is anticipated to operate for eight years in up to eight states. HHS and CMS will release a Notice of Funding Opportunity in spring 2024, after which states may apply to participate in the IBH Model.

Colorado Governor Appoints Dannette R. Smith Commissioner of the Behavioral Health Administration

On Feb. 8, 2024, Colorado Governor Jared Polis appointed Dannette R. Smith as the new commissioner of the Behavioral Health Administration (BHA). Incoming Commissioner Smith is experienced in leading human services departments across the country and most recently served as the CEO at the Nebraska Department of Health and Human Services, where she led the Behavioral Health, Children and Family Services, Developmental Disabilities, Medicaid & Long-Term Care, and Public Health divisions. Incoming Commissioner Smith will begin her role March 18, 2024.