The rules will take effect on April 16.

For years, health systems and health care providers have struggled to make sense of the rules that govern the use and disclosure of substance use disorder (SUD) treatment records. In particular, providers questioned how to restrict access to SUD treatment records to comply adequately with the rules, which are codified in 42 CFR Part 2, while allowing enough access to ensure that patients received proper and comprehensive treatment. On February 8, 2024, the U.S. Department of Health and Human Services, through its Office for Civil Rights and the Substance Abuse and Mental Health Services Administration, issued new rules that aim to minimize this dilemma. The rules will take effect on April 16.

To whom do the Part 2 Rules apply?

The Part 2 Rules do not apply to all health care providers, but only to federally assisted programs that provide SUD diagnosis, treatment, or referral for treatment. These can range from individual SUD treatment specialists (yes, an individual may fit within the definition of “program”), to stand-alone clinics and dedicated behavioral health or SUD treatment wings of general hospitals. To determine whether a given SUD treatment specialist or unit is subject to the Part 2 Rules, providers are encouraged to review official guidance and err on the side of caution. Does the individual or unit advertise that it delivers SUD treatment services? Does the individual or unit accept, receive, or benefit from a federal tax exemption or reimbursement from a program like Medicare or Medicaid? If the answer to these two questions is yes, then chances are the Part 2 Rules apply.

What information does the Part 2 Rules apply to?

The Part 2 Rules apply broadly to SUD treatment records. These would include medical records, billing forms, e-mails, voicemails, texts, and other information “created by, received, or acquired by” a Part 2 program with reference to a SUD patient. To date, a non-Part 2 program that received SUD treatment records from a Part 2 program was expected to segregate out and provide special protection to those records. However, the new rules make it clear that such segregation is no longer required. The new rules also clarify that a non-Part 2 program does not incur the restrictions of the Part 2 Rules if it simply acknowledges in a medical record that a patient received SUD treatment.

What are substantial changes to the Part 2 Rules?

One of the biggest improvements in the new rules is the simplification of patient authorization. The new rules make it possible for a patient to grant access with a single consent document to all of her or his current and future providers and payers for purposes of treatment, payment, and health-care operations. Moreover, the new rules make the content of the consent for Part 2 records the same as that for all other HIPAA-protected records.

The new rules align Part 2 with HIPAA in other respects as well. Going forward, inappropriate uses or disclosures of Part 2 records will be reported to patients in accordance with the HIPAA Breach Notification Rule. Part 2 patient notice requirements will take the same form as a HIPAA Notice of Privacy Practices. Patients will be entitled to the same rights they possess under HIPAA: to restrict disclosure to their health plans about SUD treatments they have paid for in full, to receive accountings of disclosures, and to opt out of fundraising communications. Even rule enforcement methods and penalties will be harmonized between Part 2 and HIPAA.

What do you need to do now to comply with the new Part 2 Rules?

Although the new rules become effective in April, DHHS will not commence enforcement efforts until February 16, 2026. This nearly two-year grace period is a blessing and a curse. It grants programs that long to get their ducks in a row, but also eliminates any excuses for remaining noncompliant when the deadline hits. Part 2 programs are therefore encouraged to dust off their notice-of-privacy practices, policies, procedures, and training manuals while the new rules are on their minds. Even providers who are—or believe they are—not covered by Part 2 would benefit from a quick review of the fact sheets and other materials published by DHHS about the new rules. The lessons will not only help them meet the emerging standard of care with respect to the use and disclosure of SUD treatment records; the lessons will also increase the likelihood that they will provide the best and most respectful care possible for their SUD treatment patients.