The U.S. Division of Well being and Human Providers Workplace for Civil Rights (OCR) has introduced that for the primary time civil enforcement mechanisms might be used to guard the confidentiality of substance use dysfunction (SUD) affected person data.
OCR stated the brand new program executes the SUD confidentiality provisions of part 3221 of the CARES Act and its implementing regulation at 42 CFR half 2 (“Half 2”).
Starting Feb. 16, 2026, entities and individuals topic to the regulation defending the confidentiality of SUD affected person data should adjust to all relevant necessities. The penalties for noncompliance align with the penalties out there underneath HIPAA.
OCR investigations performed underneath the brand new program could also be resolved by means of a variety of civil enforcement mechanisms. These embrace OCR getting into into decision agreements, securing financial settlements, acquiring commitments for corrective motion, or imposing civil cash penalties for the failure to conform.
“OCR’s civil enforcement program will instill confidence in sufferers and encourage them to hunt SUD remedy from coated SUD suppliers. On the identical time, compliance with the up to date Half 2 regulation will enhance care coordination and scale back administrative burdens,” stated Paula M. Stannard, director of the HHS OCR, in a press release. “OCR is uniquely positioned to implement affected person rights and the regulated neighborhood’s obligations given our intensive expertise administering compliance and enforcement packages for well being data privateness, safety, and breach notification underneath HIPAA.”
Starting Feb. 16, OCR will start accepting:
• Complaints alleging violations of the regulation that shield the confidentiality of SUD affected person data.
• Notification of breaches of SUD affected person data.
Listed here are a number of the methods the Half 2 rule was modified in 2024:
The Affected person Consent
• Permits a single consent for all future makes use of and disclosures for remedy, fee, and well being care operations.
• Permits HIPAA coated entities and enterprise associates that obtain data underneath this consent to redisclose the data in accordance with the HIPAA laws.
Different Makes use of and Disclosures
• Permits disclosure of data with out affected person consent to public well being authorities, supplied that the data disclosed are de-identified in accordance with the requirements established within the HIPAA Privateness Rule.
• Restricts using data and testimony in civil, legal, administrative, and legislative proceedings towards sufferers, absent affected person consent or a court docket order.
• Penalties: Aligns Half 2 penalties with HIPAA by changing legal penalties presently in Half 2 with civil and legal enforcement authorities that additionally apply to HIPAA violations.
• Breach Notification: Applies the identical necessities of the HIPAA Breach Notification Rule to breaches of data underneath Half 2.
• Affected person Rights: Gives new rights for sufferers underneath Half 2 to acquire an accounting of disclosures and to request restrictions on sure disclosures, as additionally granted by the HIPAA Privateness Rule. Word, the compliance date for the accounting of disclosures might be set when the identical proper is revised within the HIPAA Privateness Rule.
•
Affected person Discover: Aligns Half 2 Affected person Discover necessities with the necessities of the HIPAA Discover of Privateness Practices.
OCR has additionally developed a mannequin affected person discover and up to date its mannequin HIPAA Notices of Privateness Practices for regulated entities to make use of in offering discover to sufferers on how federal legislation protects the confidentiality of SUD affected person data. OCR’s Half 2 webpage has extra data and assets.
