On April 16, 2024, the U.S. Department of Health and Human Services (HHS) finalized a rule modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records (the Final Rule) codified at 42 C.F.R. Part 2 (Part 2). Part 2 regulations protect the confidentiality of individuals with SUDs and applies to “[r]ecords of identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance use abuse education prevention, training, treatment, rehabilitation, or research” which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States. The rule increases coordination among providers while strengthening confidentiality and patient protections, and it seeks to become better aligned with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and the Health Information Technology for Economic and Clinical Health Act (HITECH).

The initial rule, passed in the 1970s, was well-intentioned, and it meant to protect records of patients undergoing SUD treatment from discrimination or stigma. However, many changes have occurred since then, including electronic medical records and the passage of Health Insurance Portability and Accountability Act of 1996 (HIPAA), which provided for differing standards for SUD records than those of regular health care records.

The Final Rule codifies several changes to patient rights and provider obligations regarding Part 2 records, including:

• A Single Patient Consent Form for General Use: The Final Rule allows all future uses and disclosures for treatment, payment, and health care operations of SUD records through a single patient consent form (aligning with HIPAA patient requirements).
  • Redisclosure: The rule also permits redisclosures of SUD records to HIPAA covered entities and business associates that receive records under this consent in accordance with the HIPAA regulations.
• Additional Limitations on the Release of Patient Records for Legal Proceedings: The Final Rule expands the prohibitions on the use and disclosure of Part 2 records in civil, administrative, or legislative proceedings absent patient consent (separate from the patient consent form discussed in the above bullet) or a court order to retain patient protections against use of Part 2 records in legal proceedings.
• Additional Limitations on the Release of SUD Counseling Notes: The Final Rule identifies and provides greater protections for a subset of SUD records — “SUD counseling notes” (similar to HIPAA’s definition of psychotherapy notes), including a separate patient consent to authorize the disclosure of SUD counseling notes. Counseling notes are notes by a “program provider who is an SUD or mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the patient’s record.”
• Enforcement: The Final Rule provides for civil and criminal enforcement (that also apply to HIPAA violations).
• Complaints: For an alleged violation of Part 2, the Final Rule permits patients to file a complaint with the Part 2 program and to file a complaint directly with the Secretary.
• Patient Rights: The Final Rule allows patients to obtain an accounting of Part 2 record disclosures for the previous three years and the right to request restrictions on disclosures of Part 2 records. Note, however, that the Final Rule does not grant patients an explicit right to access their own SUD records.

For additional information, see:

1. Confidentiality of Substance Use Disorder (SUD) Patient Records
2. HHS Fact Sheet: 42 CFR Part 2 Final Rule
3. FACT Sheet: SAMSHA 42 CFR Part 2 Revised Rule

Reddy’s Rule #1

It is vital for Part 2 providers to review the Final Rule and make necessary changes. At a minimum, SUD providers should: (i) should create or revise their consent forms and patient notices to comply with the Final Rule, (ii) evaluate the use, disclosure and segregation of SUD counseling notes, and (iii) implement training and processes regarding the handling of SUD records. Compliance with the Final Rule is required by February 16, 2026.

Be well.