Beyond providing economic relief and other responses to address the COVID-19 pandemic, the CARES Act includes a provision that makes significant changes to the federal law that imposes strict confidentiality requirements upon certain individuals and programs that treat substance use disorders (SUD) or refer for such treatment.  

The federal law, known primarily through its implementing regulations (42 CFR Part 2), imposes restrictions on programs subject to the law (Part 2 Programs) that are much more strict than the privacy requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). 

The changes to the federal SUD law are unrelated to the coronavirus pandemic, but were the result of a growing movement to align the federal SUD law with certain HIPAA provisions.  

The CARES Act has made the following changes to the federal SUD law:

• A patient can provide one written consent to disclose the patient’s Part 2 information for all future treatment, payment or health care operations purposes (as those terms are defined by HIPAA), until such time as the patient revokes consent. Any Part 2 information disclosed under such consent may be re-disclosed for any purposes permitted by HIPAA. 
• A HIPAA provision which requires an accounting of disclosures of patient information will apply to a Part 2 Program.  
• Applies the HIPAA breach notification requirements to Part 2 Programs. Previously, the federal SUD law did not require a Part 2 Program to notify the patient or any regulatory agency if the Part 2 Program discovered a breach (unauthorized access or disclosure) of a patient’s information.  
• Replaces the enforcement provision. Violation of the federal SUD law is a crime under federal criminal statute, so the U.S. Department of Justice is responsible for enforcement. With this change, the civil and criminal penalties under HIPAA will apply to Part 2 Programs, which could mean that enforcement of the SUD law may be more likely than in the past. 
• Permits disclosure of de-identified information to a public health authority. 
• Directs the U.S. Department of Health and Human Services (HHS) to promulgate a regulation requiring that Part 2 Programs provide a Notice of Privacy Practices to patients.  
• Prohibits discrimination against Part 2 Program patients in areas such as housing, employment, government benefits, and the provision of healthcare services.  

These changes to the federal SUD law go into effect in March 2021, one year after the CARES Act was enacted.  

Congress also directed HHS to revise any regulations as necessary to implement and enforce the changes made to the federal SUD law.