On February 8, 2024, the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) finalized long-awaited modifications to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 C.F.R. Part 2, which requires individuals or entities that receive federal funding and provide SUD treatment to implement additional privacy protections and obtain specific consent before using and disclosing SUD treatment records (see 42 C.F.R. § 2.11).

In December 2022, the Department published a notice of proposed rulemaking (NPRM) recommending modifications to Part 2 consistent with the requirements of the Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020. While the final rule adopts many of the proposals set forth in the NPRM, it also includes certain additional modifications that were informed by public comment. For example, the final rule adds an express statement that segregating or segmenting SUD treatment records is not required. For purposes of Part 2, a “SUD treatment record” is any record that (1) contains information (including information on referral and intake) or otherwise reflects a diagnosis that identifies the patient as having or having had a substance use disorder, and (2) is initially prepared by a Part 2 program in connection with the treatment or referral for treatment of a patient with a substance use disorder. See 42 C.F.R. § 2.2(e) (explanation of applicability).

The revisions to Part 2 aim to enhance a patient’s ability to access whole person treatment while continuing to apply stringent privacy protections to health information related to SUD treatment records. The final rule allows Part 2 Programs to increase care coordination efforts and reduce the information gaps between patients and providers. Moreover, it represents another step in the HHS’s efforts to harmonize the confidentiality protections afforded by Part 2 and the Health Insurance Portability and Accountability Act (HIPAA) as required by the CARES Act. Although not the focus on this Article, note that the CARES Act also increased patients right to access their health information. The CARES Act applied the Information Blocking rule at 45 C.F.R. Part 171 to healthcare providers, which prevents providers from interfering with patient access to electronic health information.

Some healthcare providers are required to comply with both HIPAA and Part 2 confidentiality requirements. Before this Final Rule, there were few and limited exceptions to the requirement that a Part 2 Program was required to obtain prior written consent from the patient before using or disclosing SUD treatment records to another person or entity, even another provider. HIPAA, on the other hand, allows providers to use and disclose protected health information for the treatment of the patient, payment of the treatment, and healthcare operations of the provider without the patient’s authorization. This difference in confidentiality requirements caused dually regulated entities to house, track, and segregate the health records that were subject only to the HIPAA rules from those that were subject to both regulations. Under the final rule, dually regulated entities face a reduced compliance burden.

The final rule is comprehensive and makes several significant changes to the Part 2 requirements, such as:

• Part 2 records may be used or disclosed for treatment, payment, and healthcare operations as defined at 45 C.F.R. § 164.501 based on a single patient consent. While Part 2 remains more stringent than HIPAA in that consent is required before disclosing SUD treatment information, requiring only a single consent is a much closer alignment to HIPAA disclosure permissions for purposes specifically related to coordinating, paying for, and providing the patient care.
• Generally, the final rule adopts the key HIPAA standard terms and definitions.
• Part 2 programs are not required to segment or segregate Part 2 regulated SUD treatment information from the general medical record.
• With certain exceptions, Part 2 records may be redisclosed in any manner permitted by the HIPAA Privacy Rule.
• Consistent with HIPAA, the final rule adds new patient rights for obtaining an accounting of disclosures and asking for restrictions on disclosures.
• The final rule expands prohibitions on the use and disclosure of Part 2 records in civil, criminal, and administrative proceedings. Specifically, it prohibits combining patient consent for the use and disclosure of records for civil, criminal, administrative, or legislative proceedings with patient consent for any other use or disclosure.
• The final rule outlines new breach notification requirements.

The Final Rule was published in the Federal Register on February 16, 2024, and can be found here. Part 2 programs must be in compliance with the final rule by February 16, 2026. We recommend that Part 2 programs, dually regulated entities, and healthcare providers considering offering SUD treatment services begin reviewing their policies and practices now in anticipation of the compliance date in 2026.