Persons with a substance use disorder (SUD) or history of SUD treatment will have easier access to fully-informed, comprehensive healthcare with the passage of the Protecting Jessica Grubb’s Legacy Act (The Legacy Act). The Legacy Act was included in the Coronavirus Aid, Relief, and Economic Security (CARES) Act passed by Congress and signed into law on March 27, 2020. It will be actuated upon issuance of a new Final Rule by the Substance Abuse and Mental Health Services Administration (SAMHSA).
The Legacy Act modifies 42 U.S.C. § 290dd-2, the statute on which the 42 CFR Part 2 substance use treatment privacy rule is based, aligning it more closely with the privacy and security regulations under the Health Insurance Portability and Accountability Act (HIPAA). It also supports the ultimate goal of consent—that any person be able to easily share his or her health data with their healthcare providers if they so desire. The Legacy Act also includes heightened privacy restrictions on use of SUD data in legal, administrative and legislative proceedings, and an unprecedented set of anti-discrimination protections related to SUD health records.
The Act includes a simplified consent process that will help prevent delays in diagnosis and treatment for persons with a SUD, many of whom have untreated co-occurring medical conditions. A patient may, if they choose to do so, sign a consent to allow their SUD treatment program or a Covered Entity, such as their physician, to use or disclose their Part 2 SUD treatment records for the purposes of Treatment, Payment and Health Care Operations (TPO) under HIPAA. This permits the redisclosure of Part 2 health data, in accordance with HIPAA, with hospitals, health systems, clinics, mental health treatment providers, SUD treatment programs, health plans, managed care organizations, and others providing services on behalf of those entities and individuals, without the need for multiple subsequent consents. For example, the doctor who obtained the initial consent could include the patient’s SUD treatment and prescribing information in a referral to a specialist, just as they can for a patient with diabetes or chronic obstructive pulmonary disease (COPD). This makes it easier for patients to coordinate care with all their treating providers and furnishes those providers with a complete health record. Patients may opt-out by not signing a consent for their Part 2 records to be shared and may revoke consent at any time.
To ensure that these disclosures are appropriate, each will be subject to the accounting of disclosures requirements under the Health Information Technology for Economic and Clinical Health (HITECH) Act.
Although Part 2 currently contains stringent prohibitions and protections against the use of Part 2 information in criminal or civil proceedings, the Legacy Act includes a heightened array of safeguards and limitations beyond those in existing Part 2 statute.
Under the Legacy Act, a person’s Part 2 information may not be disclosed or used in any civil, criminal, administrative or legislative proceeding conducted by any federal, state or local authority, against a patient.
A record or testimony shall not:
Existing Part 2 regulations do not address the stigma or discrimination that many SUD patients experience based upon their condition or treatment. The Legacy Act adds explicit protections against discrimination based upon Part 2 information whether or not disclosed in accordance with Part 2 requirements. Specifically, entities cannot discriminate against a patient based upon Part 2 information in:
In addition, recipients of federal funds may not discriminate against a patient based upon Part 2 information in affording access to the services they provide with those funds.
To further protect against inappropriate use or disclosure of Part 2 information, the Legacy Act applies the HIPAA Breach Notification Rule to Part 2 programs, regardless of whether they are considered Covered Entities.
Previously, Part 2 was considered a criminal regulation and enforced by the U.S. Attorney based upon complaints filed. To date, there have been no recorded enforcement actions taken under Part 2. In contrast, there were 29,853 enforcement resolutions under HIPAA in 2019 alone. The Legacy Act adds significant legal consequences for violations by transitioning the penalties from Title 18 of the U.S. Code to sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d–5 and 42 U.S.C. 1320d–6), which are the penalties imposed for HIPAA violations. HIPAA penalties are extensive. For example, offenses committed with the intent to sell, transfer or use individually identifiable health information for commercial advantage, personal gain or malicious harm permit fines of $250,000 and imprisonment for up to 10 years.
The Department of Health and Human Services Office for Civil Rights (OCR) would appear to have a defined set of corresponding penalties under HIPAA and could rely upon the precedent and extensive enforcement guidance already in place. It is likely that designation of the enforcement agency for this provision will be made in the SAMHSA Final Rule related to the implementation of the Legacy Act.
The Legacy Act also includes guidance, Congressional preferences and other interpretive aids for the revised Part 2 Final Rule that will be issued by SAMHSA:
Netsmart advocated for this legislation for a number of years on behalf of its human services and post-acute clients and other providers, as they seek to provide fully-informed care diagnosis, treatment and services. We were an early and active member of the Partnership to Amend 42 CFR Part 2, a coalition of addiction treatment, patient advocacy and behavioral health provider organizations, including the American Society of Addiction Medicine, the National Association of Addiction Treatment Providers, the National Alliance on Mental Illness (NAMI) and Centerstone. We were also engaged in three previous SAMHSA rulemaking processes on this topic in the last three years and will continue that involvement when SAMHSA initiates the upcoming rulemaking process for the Legacy Act.
Jessica Grubb died in 2016 at age 30 from an overdose of oxycodone after being prescribed the medication at discharge from a hospital following surgery. Despite letting doctors know she was in recovery from opioid addiction, the information was not listed on her chart. The Protecting Jessica Grubb’s Legacy Act gives patients the choice to share their SUD-related health information with their healthcare providers if they wish to do so…and assures it will be included in their health record. The Legacy Act also reduces the risk to patients from potential prescribing or medical errors, and enables providers to deliver coordinated, fully-informed care based on a complete view of the patient’s health.
Questions: Contact Dave Kishler, Netsmart Senior Industry Relations Strategist, email@example.com
Thursday, January 07 | Thought Leadership,Post-Acute Care,Human Services
Healthcare agencies are extremely vulnerable to cybersecurity breaches, regardless of size. In this webinar, industry experts answered audience questions about the threat landscape and shared strategies for risk mitigation.More
Tuesday, December 22 | Human Services,Client Success Stories
2020 has had its fair share of challenges and adversities, but Seven Counties Services never faltered from supporting and serving their community, often for clients in their most vulnerable positions.More
Thursday, December 03 | Human Services,Care Coordination,Partnerships and Collaboration,Value-based Care
Learn how organizations can properly assist justice-involved individuals experiencing mental health issues both before and after incarceration through programs and technologies designed with care coordination in mind.More