On July 15, 2020, HHS revised the Confidentiality of Alcohol and Drug Abuse Patient Records regulations, 42 C.F.R. Part 2, to further facilitate better coordination of care in response to the opioid epidemic while maintaining its confidentiality protections against unauthorized disclosure and use. The revised rule reduces delays and burdens in care coordination by more closely aligning Part 2 with the Health Insurance Portability and Accountability Act (HIPAA), while maintaining privacy protections.

The revised rule changed and clarified several sections of Part 2, including:

• Treatment records created by non-Part 2 providers and based on their own patient encounters are not explicitly covered by the rule unless the substance use disorder (SUD) records were previously received from a Part 2 program are incorporated into those records;
• When a SUD patient sends an incidental message to the personal device of an employee of a Part 2 program, the employee will be able to fulfill the Part 2 requirement for “sanitizing” the device by deleting that message;
• SUD patients may now consent to the disclosure of Part 2 treatment records without naming a specific person as the recipient for the disclosure; and
• Non-OTP (opioid treatment program) and non-central registry treating providers are now eligible to query a central registry, in order to determine whether their patients are already receiving opioid treatment through a member program.

The revised rule does not alter the prior basic framework for confidentiality protection of SUD patient records created by federally assisted SUD treatment programs. The rule continues to permit a federally assisted SUD program to disclose patient identifying information only with the individual’s written consent, as part of a court order, or under a few limited exceptions.

The HHS fact sheet is available here. A copy of the Final Rule is available here.