H.R. 6082 amends the Public Health Service Act to permit substance use disorder (SUD) records to be shared among covered entities and Part 2 programs in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), for the purposes of treatment, payment, and healthcare operations. In order to protect individuals seeking and receiving SUD treatment, the bill enhances the protections on the disclosure of SUD treatment records to non-covered entities and non-Part 2 programs by, except for authorization by court order or by consent of the patient, prohibiting the use of these records in any criminal, civil, or administrative investigations, actions, or proceedings. The legislation increases the penalties in the event of unlawful disclosure of SUD treatment records and establishes breach notification requirements in accordance with the Health Information Technology for Economic and Clinical Health (HITECH) Act. Finally, the bill requires the Secretary of Health and Human Services to issue regulations prohibiting discrimination based on data disclosed from such medical records, to issue regulations requiring covered entities to provide written notice of privacy practices, and to develop model training programs and materials for health care providers and patients and their families.
The summary below was written by the Congressional Research Service, which is a nonpartisan division of the Library of Congress, and was published on Jun 13, 2018.
Overdose Prevention and Patient Safety Act
This bill amends the Public Health Service Act to align federal privacy standards for substance use disorder (SUD) patient records more closely with standards under the Health Insurance Portability and Accountability Act (HIPAA). Specifically, the bill authorizes the disclosure of SUD patient records without a patient's written consent to: (1) a covered entity for the purposes of treatment, payment, and health care operations, as long as the disclosure is made in accordance with HIPAA; and (2) a public health authority, as long as the content of the disclosure meets HIPAA standards regarding de-identified information. Current law authorizes disclosure of SUD patient records without a patient's written consent only to medical personnel in a medical emergency, to specified personnel for research or program evaluations, or pursuant to a court order.
The bill also repeals and replaces criminal penalties for certain violations involving SUD patient records with the HIPAA civil penalty structure. It also applies HIPAA criminal penalties to wrongful disclosures of SUD patient records. In addition, the bill expands the current prohibition against using SUD patient records in criminal proceedings to include any use in specified federal, state, and local criminal and civil actions.
The bill prohibits certain discrimination based on the release of SUD information under this bill.