Protecting Jessica Grubb’s Legacy Act Updates 42 CFR Part 2

Persons with a substance use disorder (SUD) or history of SUD treatment will have easier access to fully-informed, comprehensive healthcare with the passage of the Protecting Jessica Grubb’s Legacy Act (The Legacy Act). The Legacy Act was included in the Coronavirus Aid, Relief, and Economic Security (CARES) Act passed by Congress and signed into law on March 27, 2020. It will be actuated upon issuance of a new Final Rule by the Substance Abuse and Mental Health Services Administration (SAMHSA).

The Legacy Act modifies 42 U.S.C. § 290dd-2, the statute on which the 42 CFR Part 2 substance use treatment privacy rule is based, aligning it more closely with the privacy and security regulations under the Health Insurance Portability and Accountability Act (HIPAA). It also supports the ultimate goal of consent—that any person be able to easily share his or her health data with their healthcare providers if they so desire. The Legacy Act also includes heightened privacy restrictions on use of SUD data in legal, administrative and legislative proceedings, and an unprecedented set of anti-discrimination protections related to SUD health records.

Updated consent process

The Act includes a simplified consent process that will help prevent delays in diagnosis and treatment for persons with a SUD, many of whom have untreated co-occurring medical conditions. A patient may, if they choose to do so, sign a consent to allow their SUD treatment program or a Covered Entity, such as their physician, to use or disclose their Part 2 SUD treatment records for the purposes of Treatment, Payment and Health Care Operations (TPO) under HIPAA. This permits the redisclosure of Part 2 health data, in accordance with HIPAA, with hospitals, health systems, clinics, mental health treatment providers, SUD treatment programs, health plans, managed care organizations, and others providing services on behalf of those entities and individuals, without the need for multiple subsequent consents. For example, the doctor who obtained the initial consent could include the patient’s SUD treatment and prescribing information in a referral to a specialist, just as they can for a patient with diabetes or chronic obstructive pulmonary disease (COPD). This makes it easier for patients to coordinate care with all their treating providers and furnishes those providers with a complete health record. Patients may opt-out by not signing a consent for their Part 2 records to be shared and may revoke consent at any time.

To ensure that these disclosures are appropriate, each will be subject to the accounting of disclosures requirements under the Health Information Technology for Economic and Clinical Health (HITECH) Act.

Heightened prohibitions on use of Part 2 data in criminal and civil proceedings

Although Part 2 currently contains stringent prohibitions and protections against the use of Part 2 information in criminal or civil proceedings, the Legacy Act includes a heightened array of safeguards and limitations beyond those in existing Part 2 statute.

Under the Legacy Act, a person’s Part 2 information may not be disclosed or used in any civil, criminal, administrative or legislative proceeding conducted by any federal, state or local authority, against a patient.

A record or testimony shall not:

• Be entered into evidence in any criminal prosecution or civil action before a federal or state court
• Form part of the record for a decision or otherwise be taken into account in any proceeding before a federal, state or local agency
• Be used by any federal, state or local agency for a law enforcement purpose or to conduct any law enforcement investigation
• Be used in any application for a warrant

Stronger anti-discrimination protections

Existing Part 2 regulations do not address the stigma or discrimination that many SUD patients experience based upon their condition or treatment. The Legacy Act adds explicit protections against discrimination based upon Part 2 information whether or not disclosed in accordance with Part 2 requirements. Specifically, entities cannot discriminate against a patient based upon Part 2 information in:

• Admission, access to, or treatment for healthcare
• Hiring, firing or terms of employment
• Receipt of worker’s compensation
• Sale, rental or continued rental of housing
• Access to federal, state or local courts
• Access to, approval of, or maintenance of social services and benefits provided or funded by federal, state or local governments

In addition, recipients of federal funds may not discriminate against a patient based upon Part 2 information in affording access to the services they provide with those funds.

More stringent penalties and violation enforcement under HIPAA

To further protect against inappropriate use or disclosure of Part 2 information, the Legacy Act applies the HIPAA Breach Notification Rule to Part 2 programs, regardless of whether they are considered Covered Entities.

Previously, Part 2 was considered a criminal regulation and enforced by the U.S. Attorney based upon complaints filed. To date, there have been no recorded enforcement actions taken under Part 2. In contrast, there were 29,853 enforcement resolutions under HIPAA in 2019 alone. The Legacy Act adds significant legal consequences for violations by transitioning the penalties from Title 18 of the U.S. Code to sections 1176 and 1177 of the Social Security Act (42 U.S.C. 1320d–5 and 42 U.S.C. 1320d–6), which are the penalties imposed for HIPAA violations. HIPAA penalties are extensive. For example, offenses committed with the intent to sell, transfer or use individually identifiable health information for commercial advantage, personal gain or malicious harm permit fines of $250,000 and imprisonment for up to 10 years.

The Department of Health and Human Services Office for Civil Rights (OCR) would appear to have a defined set of corresponding penalties under HIPAA and could rely upon the precedent and extensive enforcement guidance already in place. It is likely that designation of the enforcement agency for this provision will be made in the SAMHSA Final Rule related to the implementation of the Legacy Act.

The Legacy Act also includes guidance, Congressional preferences and other interpretive aids for the revised Part 2 Final Rule that will be issued by SAMHSA:

• No limit upon a patient’s right, under HIPAA, to request a restriction on the use or disclosure of a record (45 C.F.R. § 164.522)
• No restriction on a Covered Entity’s right, under HIPAA, to utilize the patient consent process (45 C.F.R. § 164.506)
• No uses or disclosures for the creation of de-identified health information or a limited data set, or fundraising for the benefit of a Covered Entity (however, the Act does permit the use or disclosure of de-identified information for certain public health purposes)
• Creation of a simplified Notice of Privacy Practices
• Encouragement of Part 2 programs to access State Prescription Drug Monitoring Programs (PDMPs) when clinically appropriate
• Incentives for Part 2 programs to explain the consent process and its benefits

Enabling “whole-person care”

Netsmart advocated for this legislation for a number of years on behalf of its human services and post-acute clients and other providers, as they seek to provide fully-informed care diagnosis, treatment and services. We were an early and active member of the Partnership to Amend 42 CFR Part 2, a coalition of addiction treatment, patient advocacy and behavioral health provider organizations, including the American Society of Addiction Medicine, the National Association of Addiction Treatment Providers, the National Alliance on Mental Illness (NAMI) and Centerstone. We were also engaged in three previous SAMHSA rulemaking processes on this topic in the last three years and will continue that involvement when SAMHSA initiates the upcoming rulemaking process for the Legacy Act.

Jessica Grubb died in 2016 at age 30 from an overdose of oxycodone after being prescribed the medication at discharge from a hospital following surgery. Despite letting doctors know she was in recovery from opioid addiction, the information was not listed on her chart. The Protecting Jessica Grubb’s Legacy Act gives patients the choice to share their SUD-related health information with their healthcare providers if they wish to do so…and assures it will be included in their health record. The Legacy Act also reduces the risk to patients from potential prescribing or medical errors, and enables providers to deliver coordinated, fully-informed care based on a complete view of the patient’s health.

Questions: Contact Dave Kishler, Netsmart Senior Industry Relations Strategist, dkishler@ntst.com