It’s widely known but seldom said that many of the biggest challenges in our healthcare system stem from how its laws and regulations were written by many hands working decades apart. Inevitably, as revisions and overlapping legislation pile up, inefficiencies and redundancies arise. At the same time, emerging areas of healthcare can experience years of under-regulation when technological progress outstrips the pace of new legislation. Figuratively, the vast canopy of regulatory code is rather like a barn full of cobwebs: some areas become densely layered, while others appear threadbare. Among the most poignant illustrations of this imbalance is Title 42 CFR Part 2, a law established half a century ago to safeguard healthcare privacy for patients seeking addiction treatment. Though drafted with noble intentions, stakeholders in substance abuse treatment have long contended that it creates unnecessary obstacles that can compromise the quality of care.

The genesis of Title 42 CFR Part 2 offers some insight into the issue. Enacted in 1975 to implement the 1970 Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment and Rehabilitation Act and the Drug Abuse Prevention, Treatment and Rehabilitation Act of 1972, it aimed to dismantle a significant barrier to substance abuse treatment: the hesitation among individuals with substance use disorders to seek help, driven by fears of legal consequences and social stigma. This concern was particularly acute in light of the distressing situation of returning Vietnam veterans, of whom an estimated 10%-20% developed opioid dependencies abroad. Despite the existence of federally sponsored treatment programs, apprehensions about confidentiality and the potential for exposure by healthcare providers dissuaded many from seeking the help they desperately needed. In response, 42 CFR Part 2 was crafted to grant patients rigorous control over their substance use disorder treatment records (SUD Records), mandating explicit written consent for the release of their personal medical information. This measure was implemented to span all phases of treatment, including billing, consultations, referrals, and lab work, thereby safeguarding patient autonomy over their medical data throughout the recovery journey.

With the passage of time, much of the stigma associated with substance use disorders quietly waned, and healthcare privacy protections expanded to encompass all aspects of healthcare, notably with the enactment of the Health Insurance Portability and Accountability Act (HIPAA) in 1996. Paradoxically, the intersection of HIPAA and Part 2 highlighted an anomaly: substance abuse treatment records were subject to a level of regulatory scrutiny not applied to other medical records. The need for SUD patients to repeatedly authorize consent forms was seen as a hindrance, leading to delays and communication breakdowns among healthcare providers trying to coordinate care.

It was not until the COVID-19 pandemic—a crisis of unprecedented scale—that significant regulatory changes were initiated. The Coronavirus Aid, Relief, and Economic Security (CARES) Act, passed in March 2020, and facilitated a pivotal shift by amending 42 CFR Part 2. The CARES Act aimed to harmonize certain aspects of Part 2 with the HIPAA rules and streamline the sharing of medical records through the adoption of one-time consent forms for the release of SUD Records. This reform, while contentious for some who feared the dilution of patient protections, was largely welcomed by healthcare stakeholders advocating for its permanent implementation post-pandemic.

In response, the Department of Health and Human Services announced on February 8, 2024, a final rule to further align Part 2 with HIPAA and incorporate provisions of the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH). This new rule introduces a more streamlined consent model for SUD Records, enhancing information sharing within the healthcare system without the need for repetitive consent forms. It broadens the scope for sharing such records and establishes stricter protections for counseling notes, requiring distinct consent for their release. Patient rights were expanded to allow more control over personal health information. Additionally, the rule enforces stricter penalties for misuse of records and mandates immediate breach reporting. Key points of the final rule include:

• Streamlined Consent: A single consent suffices for using and disclosing SUD Records for treatment, payment, and healthcare operations, aligning with HIPAA’s practices.
• Expanded Redisclosure Scope: Part 2 records can be redisclosed by HIPAA-covered entities and business associates (as defined under HIPAA), that receive SUD Records under this consent and in accordance with the HIPAA regulations.
• Stronger Safeguards for Counseling Notes: Specific consent is required for releasing SUD counseling notes, mirroring HIPAA’s approach to psychotherapy notes.
• Enhanced Patient Autonomy: Patients gain more rights, including the ability to request an accounting of disclosures and impose restrictions on their records.
• Stricter Legal Protections: The rule establishes robust prohibitions against using Part 2 records in legal actions without proper consent.
• Unified Breach Notification: Breach notification requirements are consistent with HIPAA, ensuring timely reporting of any Part 2 data breaches.
• Authorized Disclosures for Public Health: De-identified Part 2 records can be disclosed to public health authorities for critical public health purposes without patient consent. To ensure that patient privacy is not compromised, this permission is limited solely to deidentified records.
• Aligned Patient Notification: Part 2 notification procedures match HIPAA’s, with an express statement that data segregation of Part 2 Records is not required.

The final rule is effective on April 16, 2024. But providers subject to this regulation have until February 16, 2026 to comply with the applicable requirements. The Department of Health and Human Services has promised to “conduct outreach and develop guidance” to help facilitate compliance. However, they have yet to disclose a publication date. In the interim, we encourage those who may be impacted to consult the authors or another Nelson Hardiman attorney with concerns on the timing and specifics for implementation.