Substance Use Disorder Coordination, Access, Recovery Enhancement Act of 2018
A BILL
To amend the Controlled Substances Act to allow for more flexibility with respect to medication-assisted treatment for opioid use disorders and to amend the Public Health Service Act to protect the confidentiality of substance use disorder patient records.
Sec. 2 Allowing for more flexibility with respect to medication-assisted treatment for opioid use disorders
“(II) The applicable number is—
“(aa) 100 if, not sooner than 1 year after the date on which the practitioner submitted the initial notification, the practitioner submits a second notification to the Secretary of the need and intent of the practitioner to treat up to 100 patients;
“(bb) 100 if the practitioner holds additional credentialing, as defined in section 8.2 of title 42, Code of Federal Regulations (or successor regulations); or
“(cc) 100 if the practitioner provides medication-assisted treatment (MAT) using covered medications (as defined in section 8.2 of title 42, Code of Federal Regulations (or successor regulations)) in a qualified practice setting (as described in section 8.615 of title 42, Code of Federal Regulations (or successor regulations)).”
Sec. 3 Confidentiality and disclosure of records relating to substance use disorder
“(D) To a covered entity or to a program or activity described in subsection (a), for the purposes of treatment, payment, and health care operations, so long as such disclosure is made in accordance with HIPAA privacy regulation. Any redisclosure of information so disclosed may only be made in accordance with this section.”
“(E) To a public health authority, so long as such content does not include any individually identifiable health information and meets the standards established in section 164.514 of title 45, Code of Federal Regulations (or successor regulations) for creating de-identified information.”
“(3) Definitions—For purposes of this subsection:
“(A) Covered entity—The term “covered entity” has the meaning given such term for purposes of HIPAA privacy regulation.
“(B) Health care operations—The term “health care operations” has the meaning given such term for purposes of HIPAA privacy regulation.
“(C) HIPAA privacy regulation—The term “HIPAA privacy regulation” has the meaning given such term under section 1180(b)(3) of the Social Security Act.
“(D) Individually identifiable health information—The term “individually identifiable health information” has the meaning given such term for purposes of HIPAA privacy regulation.
“(E) Payment—The term “payment” has the meaning given such term for purposes of HIPAA privacy regulation.
“(F) Public health authority—The term “public health authority” has the meaning given such term for purposes of HIPAA privacy regulation.
“(G) Treatment—The term “treatment” has the meaning given such term for purposes of HIPAA privacy regulation.”
“(c) Use of records in criminal, civil, or administrative contexts—Except as otherwise authorized by a court order under subsection (b)(2)(C) or by the consent of the patient, a record referred to in subsection (a) may not—
“(1) be entered into evidence in any criminal prosecution or civil action before a Federal or State court;
“(2) form part of the record for decision or otherwise be taken into account in any proceeding before a Federal agency;
“(3) be used by any Federal, State, or local agency for a law enforcement purpose or to conduct any law enforcement investigation of a patient; or
“(4) be used in any application for a warrant.”
“(f) Penalties—The provisions of section 1176 of the Social Security Act shall apply to a violation of this section to the extent and in the same manner as such provisions apply to a violation of part C of title XI of such Act. In applying the previous sentence—
“(1) the reference to “this subsection” in subsection (a)(2) of such section 1176 shall be treated as a reference to “this subsection (including as applied pursuant to section 543(f) of the Public Health Service Act)”; and
“(2) in subsection (b) of such section 1176—
“(A) each reference to “a penalty imposed under subsection (a)” shall be treated as a reference to “a penalty imposed under subsection (a) (including as applied pursuant to section 543(f) of the Public Health Service Act)”; and
“(B) each reference to “no damages obtained under subsection (d)” shall be treated as a reference to “no damages obtained under subsection (d) (including as applied pursuant to section 543(f) of the Public Health Service Act)”.”
“(i) Antidiscrimination
“(1) In general—No entity shall discriminate against an individual on the basis of information received by such entity pursuant to a disclosure made under subsection (b) in—
“(A) admission or treatment for health care;
“(B) hiring or terms of employment;
“(C) the sale or rental of housing; or
“(D) access to Federal, State, or local courts.
“(2) Recipients of Federal funds—No recipient of Federal funds shall discriminate against an individual on the basis of information received by such recipient pursuant to a disclosure made under subsection (b) in affording access to the services provided with such funds.”
“(j) Notification in case of breach
“(1) Application of HITECH notification of breach provisions—The provisions of section 13402 of the HITECH Act (42 U.S.C. 17932) shall apply to a program or activity described in subsection (a), in case of a breach of records described in subsection (a), to the same extent and in the same manner as such provisions apply to a covered entity in the case of a breach of unsecured protected health information.
“(2) Definitions—In this subsection, the terms “covered entity” and “unsecured protected health information” have the meanings given to such terms for purposes of such section 13402.”