Evan Dumas 

You’re listening to Group Practice Tech, a podcast by Person Centered Tech, where we help mental health group practice owners ethically and effectively leverage tech to improve their practices. I’m your co-host, Evan Dumas.

 

Liath Dalton 

And I’m Liath Dalton, and we are Person Centered Tech.

 

Liath Dalton 

This episode is brought to you by Therapy Notes. Therapy Notes is a robust online practice management and electronic health record system to support you in growing your thriving practice. Therapy Notes is a complete practice management system with all the functionality you need to manage client records, meet with clients remotely, create rich documentation, schedule appointments and bill insurance all right at your fingertips. To get two free months of Therapy Notes as a new Therapy Notes user go to therapynotes.com and use promo code PCT.

 

Evan Dumas 

Hello and welcome to Episode 605: 42 CFR Part 2, HIPAA, NPPs and the February 16 Deadline: What Actually Needs to Change?

 

Liath Dalton 

That is a mouthful of a title, but we figured we needed to give the full lay of the land, because we have been getting a lot of questions, understandably so, about exactly this, because a lot of folks are hearing that you need to update your Notice of Privacy Practices because of Part 2.

 

Evan Dumas 

Yeah.

 

Liath Dalton 

And while that is true, potentially all of that chatter about updating your HIPAA NPP is not including, at least from the majority of what we have seen thus far, clear guidance on who needs to update it,

 

Evan Dumas 

Yeah.

 

Liath Dalton 

and who doesn’t,

 

Evan Dumas 

Exactly.

 

Liath Dalton 

why, or how.

 

Evan Dumas 

Yeah.

 

Liath Dalton 

So.

 

Evan Dumas 

They just see a deadline, and they want to inspire fear from it, and fear creates your action, and probably purchasing things. So don’t, don’t, don’t be motivated by fear.

 

Liath Dalton 

Exactly. So there is an actual enforcement deadline of February 16, which is when the enforcement of the final rule from 2024 begins.

 

Evan Dumas 

Mhm.

 

Liath Dalton 

And so part of the final rule enforcement relates to required changes to the Notice of Privacy Practices regarding Part 2 records. If you are either a Part 2 program or a lawful holder, and we’re going to get into all of that. But basically, the major source of frustration at the moment for folks, and understandably so, is that while these changes were finalized, HHS did not release an updated model of the NPP. The expectation was that they would, because their prior model, Notice of Privacy Practices, was really the gold standard.

 

Evan Dumas 

Yeah.

 

Liath Dalton 

Not just in terms of what we recommend and recommended, but also HIPAA attorneys recommended. So now folks are in this kind of space of wondering what to do and how to do it, and we want to make sure that folks aren’t left just piecing together requirements from various legal articles or listserv chatters and having kind of frankensteined NPP that doesn’t really meet your your needs. So we’ve created a tangible resource to put in your hands that’s going to walk you through this.

 

Liath Dalton 

But before we introduce that, we just want to give a quick refresher as to what changed with Part 2, which essentially is that the 2024 final rule aligned some aspects of Part 2 with HIPAA. Those changes really can be distilled down to a single consent for treatment, payment, and health care operations, or TPO; that redisclosure is now aligned with HIPAA and that it’s given teeth because the Office of Civil Rights or the OCR, who are the HIPAA regulators, now also have enforcement authority.

 

Evan Dumas 

Mhm yeah.

 

Liath Dalton 

Really important to note that Part 2 still remains more restrictive than HIPAA,

 

Evan Dumas 

Yeah.

 

Liath Dalton 

particularly around youth with consent, without consent and legal proceedings. The legal proceedings part is really the big emphasis. So these changes weren’t about making Part 2 disappear. It was just about improving coordination and making it less administratively burdensome, but not about removing protections.

 

Liath Dalton 

So that said, the main source of confusion right now is whether or not these changes, and the requirements for specific content related to Part 2 records and information in a HIPAA Notice of Privacy Practices, whether or not that applies to a particular practitioner or their practice. A lot of providers will assume that, because they don’t run a substance use disorder program, which is a very specific type of program designation, that this does not apply.

 

Evan Dumas 

But-

 

Liath Dalton 

But, yes, Evan, why might it still apply?

 

Evan Dumas 

Yeah, there’s this new term called lawful holders. So say, maybe you work with the substance use disorder treatment program and maybe they send you some records. Or maybe you’ve got a client that also goes to one, and you you’ve got an ROI, and so you’ve got some of those records. Maybe this does apply. Maybe you’re a lawful holder, and you’ve got to notify people, because suddenly you’ve got these sort of like Part 2 records, even though you’re not a Part 2 program.

 

Liath Dalton 

Exactly.

 

Liath Dalton 

So essentially, there are three distinct categories. There’s the Part 2 programs, and you’ll know if you are a Part 2 program or not. The lawful holder category is less clear, but if you are a lawful holder, there are still requirements for how your HIPAA Notice of Privacy Practices needs to be updated. And then, of course, the third category is that there are some practices that are totally outside of Part 2. But the most common mistake and pitfall that folks can make is that the analysis stops at we don’t provide substance use disorder treatment. So again, you can be a lawful holder without providing substance use disorder care specifically. And this is where practices most over correct and can miss something really important.

 

Liath Dalton 

So that’s, that’s where where we are, and we already went over kind of how challenging it is that we don’t have the updated model Notice of Privacy Practices from HHS and that folks are now in this situation of the requirements are going to start being enforced in very short order, but they don’t have a specific guidance on how to manage meeting those requirements. Enter our resource.

 

Evan Dumas 

Yeah, we got a guide.

 

Liath Dalton 

We got a guide. And essentially it has a decision tree workflow that walks you through determining whether Part 2 applies to you, differentiating between being a Part 2 program or a lawful holder and what the different obligations are, and then provides category specific sample language.

 

Evan Dumas 

Mhm, mhm.

 

Liath Dalton 

Really important to state, of course, that this does not

 

Evan Dumas 

Nope.

 

Liath Dalton 

replace legal advice.

 

Evan Dumas 

Oh, no.

 

Liath Dalton 

PCT is not a law firm.

 

Evan Dumas 

We are not.

 

Liath Dalton 

Evan and I are not lawyers. This is not an official HHS template, and we are not advising that practices put in place Part 2 language into their Notice of Privacy Practices if this doesn’t apply to them, right? The goal is really accuracy, not maximum restriction.

 

Liath Dalton 

So if you haven’t reviewed your Notice of Privacy Practices yet, please don’t panic. Start with applicability, not the specific language. Like you really need to first make the determination of whether or not you are a lawful holder. If you are a lawful holder, then review the sample language for inclusion in your Notice of Privacy Practices. You don’t want to mix and match the language for Part 2 programs with the language for lawful holders.

 

Liath Dalton 

So use this resource alongside your actual workflows and your referral and intake patterns, and of course, have the final Notice of Privacy Practices reviewed by legal counsel as appropriate. If you don’t have good legal counsel that’s specific to HIPAA and mental health, then our guidance there is that your best source for identifying such legal counsel is going to be through the local chapter of your professional association. If, in some wild turn of events, they do not have a designated legal counsel option that they work with, and that’s part of the association, then check out your sort of sister profession, professional associations. So if you’re a social worker and the local chapter of the NASW doesn’t have a legal counsel recommendation, then check what the ACA chapter, the American Counseling Association chapter, has, or the APA, that sort of thing.

 

Liath Dalton 

So we hope this is helpful and provide some clarity and reassurance. While we can’t control what HHS did not give us, we can give you a little clarity and structure that’s that’s supportive. And again, what I really want to emphasize is that don’t just stop at, well, I’m not a Part 2 program. Really evaluate the lawful holder consideration and then just follow the process.

 

Evan Dumas 

Mhm, exactly, because this actually is, it’s more strict than HIPAA, and you want to be able to offer that like nice confirmation and security to people who may have these records, saying, Hey, these are even more protected. And you want to let them know.

 

Liath Dalton 

Exactly. And then, along with the link to our resource guide, basically, it’s a decision guide and some sample language provided of course for educational purposes. We are also linking to the HHS fact sheet and then a great article from JD Supra, and one of the law firms that contributes to them that summarizes what the specific changes are.

 

Liath Dalton 

And of course, our template language, or sample language, I want to be precise there, sample language is reflective of that information. Because HHS did specify that you need particular headings for each of the NPP change components. So it’s it’s not like we’re just throwing a, having to throw a dart and hope it lands where it should, in terms of sample language, so that at least is helpful. So check out those resources and use in good health, and we’ll chat to you folks next week.

 

Evan Dumas 

Yeah, have a great week, everybody. Talk to you next time.

 

Liath Dalton 

This has been Group Practice Tech. You can find us at personcenteredtech.com. For more podcast episodes, you can go to personcenteredtech.com/podcast or click podcast on the menu bar.