On July 7, 2022, Pennsylvania Governor Tom Wolf signed House Bills 1561 and 1563 into law, as Act 32 of 2022 and Act 33 of 2022, respectively. Act 32 of 2022 amended the confidentiality provisions of the state Mental Health Procedures Act (the “MHPA”) and Act 33 amended the corresponding provisions of the Drug and Alcohol Abuse and Control Act (the “DAACA”). The amendments update Pennsylvania’s laws to allow sharing of patient information by and among health care providers, health care facilities and insurers, in alignment with the federal Health Insurance Portability and Accountability Act of 1996, known as HIPAA, and the HIPAA regulations.
Mental health and substance use disorder treatment advocates had long called for changes to the confidentiality provisions of the MHPA and the DAACA to allow for greater sharing of patient information between mental health and substance use disorder providers and physical health providers and payors to improve patient care and outcomes. The sponsor memo introducing House Bills 1561 and 1563 noted that both the MHPA and the DAACA were originally enacted in the 1970s, and their implementing regulations had largely gone unchanged since then. Both statutes and regulatory schemes predated the passage of HIPAA in 1996 and implementation of the initial final HIPAA regulations in 2003. Pennsylvania had been one of only a few states with confidentiality laws containing provisions that were stricter than federal laws and regulations, including HIPAA and the 42 C.F.R. Part 2 regulations governing the confidentiality of federally-funded substance use disorder programs.
Under HIPAA, stricter state laws governing confidentiality of patient information are not pre-empted by HIPAA. Thus, the stricter confidentiality provisions of the MHPA and DAACA applied instead of HIPAA, limiting information sharing with case managers, payors and other providers and creating barriers to information sharing and patient care for Pennsylvania patients.
Both bills enjoyed bipartisan support in the Pennsylvania General Assembly, in recognition of the need to “ensure health care providers have access to all of the information they need to appropriately treat their clients and patients, making … communities healthier and saving lives,” as noted by one of the sponsors of HB 1563, Speaker Bryan Cutler.
Acts 32 and 33 were effective immediately upon the Governor’s signature on July 7. Section 3 of Act 32 directed the Secretary of the Pennsylvania Department of Human Services to promulgate regulations to implement the changes to Section 111(a) within 180 days of the effective date. Act 33 states only that “The Department of Drug and Alcohol Programs (DDAP) shall not have the authority to promulgate or enforce a regulation that restricts any disclosure of records or information that is permitted by this act,” but does not specifically mandate promulgation of new regulations. DDAP noted in an announcement posted on July 25, that “Act 33 prohibits DDAP ‘from promulgating or enforcing a regulation that restricts any disclosure of records or information that is permitted by Act 33. DDAP is currently reviewing Act 33 to determine next steps as a regulatory agency and will be providing additional information and details via listserv and on its website in the near future.'”
Providers should review existing forms, policies and practices governing the use and disclosure of patient information under the MHPA and DAACA for consistency with the amended statutes and provide updated training to staff, as necessary.