For the 2024 and 2025 course years, our HIPAA Training is being updated to include two new optional lessons: 1) Reproductive Health Information; and 2) Substance Use Disorder Information. This training may be required in certain circumstances. Please review the below information to determine if those topics are required in your practice. This article also includes FAQs and next steps on completing training.

Reproductive Health Information (RHI)

The Office for Civil Rights issued a Final Rule, entitled HIPAA Privacy Rule to Support Reproductive Health Care Privacy in 2024. The Final Rule strengthens the Privacy Rule by prohibiting the disclosure of protected health information related to lawful reproductive health care (reproductive health information or RHI) in certain circumstances. The Department of Health and Human Services (HHS) issued this Final Rule after hearing from communities that changes were needed to better protect patient confidentiality and prevent medical records from being used against people for providing or obtaining lawful reproductive health care. This Final Rule bolsters patient-provider confidentiality and helps promote trust and open communication between individuals and their healthcare providers or health plans, which is essential for high-quality healthcare.

Does RHI training apply to me?

These new requirements apply to any covered entity (and its business associates) that maintains protected health information (PHI) which includes reproductive health information (RHI) – whether the RHI was created by the covered entity or not.

RHI could become part of a medical or dental patient record if the patient history includes questions about:

• pregnancy status,
• medications taken (which could include birth control pills),
• date of last period,
• menopause status,
• past surgeries (which could include tubal ligation, vasectomy, hysterectomy, etc.), or
• if visit notes mention pregnancy status, etc.

So, while the answer is theoretically “yes, the new requirements are only applicable to entities that maintain RHI”, this is likely a broad swath of providers. A provider should be very careful when evaluating if it maintains any RHI anywhere in its patient records

Substance Use Disorder (SUD)

The regulations at 42 CFR part 2 (“Part 2”) protect the confidentiality of substance use disorder (SUD) treatment records. These are “records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance abuse education prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States.” Confidentiality protections help address concerns that discrimination and fear of prosecution deter people from entering treatment for SUD.

The U.S. Department of Health & Human Services (HHS), through the Office for Civil Rights (OCR) in coordination with the Substance Abuse and Mental Health Services Administration (SAMHSA), announced a Final Rule modifying the confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR part 2 (“Part 2”). This Final Rule implements requirements of section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act (enacted March 27, 2020), which requires the Secretary to align certain aspects of Part 2 with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Rules and the Health Information Technology for Economic and Clinical Health (HITECH) Act.

Does SUD training apply to me?

The Part 2-related changes are only required for entities that meet Part 2’s definition of a “program.” These are:

• federally assisted programs that provide substance abuse education, prevention, training, treatment, rehabilitation, or research;
• if a provider is not a general medical care facility, an individual or entity that holds itself out as providing and provides alcohol or drug abuse diagnosis, treatment, or referral for treatment; and
• medical personnel or other staff in a general medical facility who are identified as providers whose primary function is to provide diagnosis, treatment, or referral for treatment for a SUD.

If a provider is not a Program, these Part 2 related changes and training requirements do not apply.

Frequently Asked Questions

1. I've determined one or both of these training topics apply to me. What do I do next?

If you've purchased and registered for 2024 or 2025 HIPAA training, access your training account and complete the two new lessons by December 23, 2024. If you do not yet have our HIPAA training, you may purchase and register for it here. 

2. I'm still not sure if this applies to me. How can I be sure?

If you have access to the 2024 or 2025 HIPAA training, we recommend reviewing the respective lessons to determine if they are applicable to you. If you're still not sure, please contact us. 

3. Is there a deadline to complete these new topics? What happens if I miss the deadline?

Yes, if these topics are applicable to you, the deadline to complete training is December 23, 2024. If you do not complete required training by this date, you may not be compliant with HIPAA regulations.

4. Can I take these new lessons anytime before the deadline?

Yes, you can complete the new lessons at your convenience anytime before the deadline of Dec. 23, 2024.

5. I've already completed the HIPAA course. Do I need to retake the whole training?

If you have already completed the course, you will only be required to complete the new lessons. Upon completion, you will receive an updated certificate.

6. My question is not listed here or I need something else.

Please contact us at support@gammacompliance.com, support.gammacompliance.com, or at 800-492-6958.