After a nearly two-year delay, the U.S. Department of Health & Human Services (HHS), through the Substance Abuse and Mental Health Services Administration (SAMHSA) and the Office for Civil Rights, promulgated a Final Rule modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations contained within 42 CFR Part 2 (Part 2). The rule implements provisions of Section 3221 of the Coronavirus Aid, Relief, and Economic Security Act of 2020, which requires HHS to align aspects of Part 2 with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy rules and the Health Information Technology for Economic and Clinical Health Act (HITECH). The Final Rule reflects the proposals published in the December 2, 2022 Notice of Proposed Rulemaking (NPRM) and public comments received from a variety of stakeholders, including patient advocacy groups, trade associations, health plans, and providers. HHS took more than a year to finalize the rule after the comment period ended.

Background

The Part 2 statute, which predates HIPAA, was passed to protect records of patients undergoing substance use disorder (SUD) treatment and help address concerns that discrimination and fear of prosecution deter people from seeking such treatment. While well intentioned, the initial Part 2 rule was burdensome to behavioral health providers because it required patient consent each time records needed to be sent to a new provider and for SUD records to be segmented from the patient's complete medical record to maintain privacy. This was potentially harmful to patients, since their medical providers did not have complete records when treating for issues outside of behavioral health.

Aligning Part 2 with HIPAA

The Final Rule aligns Part 2 with HIPAA in the following ways:

• Patient Consent: The single most important change is to patient consent. The new rule allows a single consent for all future uses and disclosures of SUD treatment records for treatment, payment, and healthcare operations. Additionally, HIPAA-covered entities and business associates that receive records under this consent can now redisclose the records in accordance with HIPAA regulations.
• Other Uses and Disclosures: Public authorities may now have access to de-identified records without patient consent as is allowed under HIPAA. However, records cannot be used for testimony in legal proceedings without patient consent or a court order.
• Other Areas of HIPAA Alignment: The Final Rule also aligns requirements for penalties, breach notification, and safe harbors with those contained under the HIPAA regulations.

Changes Made to NPRM Due to Stakeholder Engagement During the Comment Period

Advocacy during the comment period spurred a number of nuanced changes to the Final Rule, which ultimately strengthened patient protection. For example, HHS:

• Clarifies that any investigating agency must follow specific steps to be eligible for a safe harbor
• Includes an express statement that records no longer need to be segregated to comply with the new rule
• Adds a right to file a complaint directly with the Secretary for an alleged violation of Part 2
• Prohibits combining patient consent for the use and disclosure of records for legal proceedings with patient consent for any other use or disclosure
• Requires a separate patient consent for the use and disclosure of SUD counseling notes
• Requires that each disclosure made with patient consent include a copy of the consent or a clear explanation of the scope of the consent and
• Creates a new right for patients to opt out of receiving fundraising communications

What Has Not Changed in Part 2?

Overall, the Final Rule continues to protect patient privacy by not allowing SUD treatment records to be used to investigate or prosecute the patient without written patient consent or a court order, while ensuring that providers have a comprehensive picture of a patient's health issues when prescribing treatment.

What Comes Next?

While the Part 2 Final Rule has taken great strides to align the treatment of SUD records with how any other medical record is treated under HIPAA, some fear the statute and ensuing Final Rule have not gone far enough. As implementation begins, attention will turn to whether the rule makes the flow of information easier in practice, and consideration will be given to the interaction of the Final Rule with state regulations.