On February 8, 2024, the U.S. Department of Health and Human Services, through its Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA), released final rule (Final Rule) modifications to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR part 2 (Part 2). Such modifications were initially proposed on December 2, 2022, in a notice of proposed rulemaking pursuant to Section 3221 of the Corona Virus Aid, Relief, and Economic Security (CARES) Act. The Final Rule both implements the provisions of the CARES Act and is a step closer to aligning with the requirements of Part 2, which apply to federally assisted substance use disorder (SUD) programs (Part 2 Programs) and their SUD-related records (SUD Records), with the Health Insurance Portability and Accountability Act of 1996, and the implementation regulations thereunder (HIPAA).

The Final Rule is set for publication in the Federal Register on February 16, 2024. Until then, more information can be found in the prepublication version of the Final Rule, the HHS’ press release, and the accompanying FAQ sheet.

The Final Rule will be effective 60 days after its date of publication in the Federal Register, with a compliance date of February 16, 2026.

The following are key modifications to the Part 2 requirements made by the Final Rule.

• Changes to Patient Consent Requirements
  • Uses and Disclosures by Part 2 Programs: While continuing to require a written patient consent prior to a Part 2 Program disclosing SUD Records, the Final Rule permits the use of a more general consent for the disclosure of SUD Records for treatment, payment, and health care operations activities (excluding the use and disclosure of “SUD counseling notes” as described below).
  • Redisclosures of SUD Records. The Final Rule modifications allow a HIPAA-covered entity or business associate that receives SUD Records pursuant to a patient consent to redisclose the SUD Records in accordance with the HIPAA regulations (excluding uses and disclosures in legal and administrative proceedings), rather than having to obtain a Part 2-compliant consent for such re-disclosure.
  • Consents for Judicial and Administrative Proceedings. Disclosure of SUD Records in civil, criminal, administrative, and legislative proceedings against patients still requires obtaining a specific Part 2-compliant consent from the patient or a subpoena and court order that meets all Part 2 requirements. The Final Rule prohibits combining patient consent for the use and disclosure of SUD Records for civil, criminal, administrative, or legislative proceedings with patient consent for any other use or disclosure. Additionally, SUD Records obtained in an audit or evaluation of a Part 2 Program cannot be used to investigate or prosecute patients, absent written consent of the patients or a court order that meets Part 2 requirements.
  • SUD Counseling Notes. The Final Rule creates a subset of SUD Records – “SUD counseling notes,” which are similar to psychotherapy notes, as defined by HIPAA. A patient separate consent is required for the use and disclosure of SUD counseling notes.
  • Copy of Consent or Scope Description. The Final Rule requires that each disclosure made with patient consent include a copy of the consent or a clear explanation of the scope of the consent.
• Patients’ Rights and Notice
  • The Final Rule substantially aligns certain patients’ rights under Part 2 with certain rights provided to individuals under the HIPAA Privacy Rule, including with regard to complaints and patient notice.
  • OCR added a note to the FAQs sheet accompanying the release of the Final Rule that it plans to finalize changes to the HIPAA Notice of Privacy Practices (NPP) requirements in an upcoming final rule modifying the HIPAA Privacy Rule to address uses and disclosures of protected health information that are also protected by Part 2, along with other changes to the NPP requirements.
  • The Final Rule also creates a new right for patients of Part 2 Programs to opt out of receiving fundraising communications.
• Penalties
  • The Final Rule aligns Part 2 penalties with HIPAA by replacing criminal penalties currently in Part 2 with civil and criminal enforcement authorities that also apply to HIPAA violations.
• Breach Notification
  • The Final Rule applies the HIPAA Breach Notification Rule to Part 2 Programs with respect to breaches of unsecured SUD Records in the same manner the Breach Notification Rule applies to Breaches of Unsecured Protected Health Information.
• Safe Harbor for Investigative Agencies
  • Importantly, the Final Rule creates a limit on civil or criminal liability for investigative agencies that act with reasonable diligence to determine whether a provider is subject to Part 2 before making a demand for SUD Records for an investigation, including looking for the provider in SAMSHA’s online treatment facility locator and checking the provider’s Patient Notice or NPP to determine whether the provider is subject to Part 2. The safe harbor requires investigative agencies to take certain steps in the event they discover they received SUD Records without having first obtained the requisite court order.
• Segregation of Part 2 Data
  • In response to public comments, the Final Rule adds an express statement that segregating or segmenting SUD Records from those not subject to Part 2 is not required.
• Research and Counselor Notes
  • The Final Rule aligns Part 2 requirements for human subjects research and “counseling notes” with HIPAA requirements for such research and psychotherapy notes, respectively.

We recommend that clients closely review their policies and procedures and operations addressing these modified Part 2 requirements to ensure that such policies and procedures and operations align with the changes made by the Final Rule.