HHS Proposes Rule to Align Part 2 Substance Use Disorder Laws With HIPAA

On November 28, 2022, the U.S. Department of Health and Human Services (HHS), through the Office of Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA), issued a Notice of Proposed Rulemaking to revise the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations under 42 CFR Part 2. The “Part 2” regulations protect the confidentiality of SUD treatment records and criminalize inappropriate handling.

Part 2 protects patient privacy and records concerning treatment related to substance use challenges from unauthorized disclosures. The regulations were implemented to encourage patients to seek substance use treatment without fear of prosecution by limiting a treatment program’s ability to use or disclose SUD records. The proposed rule specifically increases coordination among providers in treatment for substance use challenges while more closely aligning Part 2 with the ever-popular Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy and security rules (discussed below). It also increases protections for patients concerning records disclosure to avoid discrimination and stigma in treatment and to quell fears of prosecution. These two elements have historically deterred people from entering SUD treatment. The proposed rule would continue to prohibit the disclosure of SUD information to law enforcement absent an appropriate court order.

This Notice of Proposed Rulemaking (NPRM) would implement provisions of Section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) that, among other things, require HHS to bring Part 2 into greater alignment with certain aspects of the HIPAA Privacy, Breach Notification, and Enforcement Rules as well as the Health Information Technology for Economic and Clinical Health (HITECH) Act. Presently, Part 2 imposes different requirements for SUD treatment records protected by Part 2, then the HIPAA Privacy Rule, which has created roadblocks to information sharing by patients and among health care providers. These divergent requirements have naturally created dual obligations, increased administrative burdens, and compliance challenges for regulated entities. The proposed rule includes significant changes to more closely align Part 2 with the HIPAA Privacy Rule; additionally, the proposed changes can help safeguard the health and outcomes of individuals with SUD and create more flexibility for information sharing.

Some key takeaways from the NPRM to make effective treatments and recovery support for SUD more accessible to all Americans include:

  1. Single Patient Consent: Permitted use and disclosure of Part 2 records based on a single prior consent signed by the patient given once for all future uses and disclosures of treatment, payment, and health care operations. This is a significant change from the previous iteration of Part 2, which required the patient to sign short expiring consents identifying the specific party receiving SUD information.
  2. Redisclosure Permissions: Permitted redisclosure of Part 2 records as permitted by the HIPAA Privacy Rule by recipients that are Part 2 programs, HIPAA-covered entities, and business associates, with certain exceptions. The previous iteration of Part 2 prohibited redisclosure absent specific consent.
  3. Patient Rights: New patient rights under Part 2 align with individual rights under the HIPAA Privacy Rule to obtain an accounting of disclosures and request restrictions on disclosures for treatment, payment, and health care operations.
  4. Prohibitions: Expanded prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings (absent a court order or consent of the patient).
  5. Agency Enforcement: New HHS enforcement authority, including the imposition of civil money penalties for violations of Part 2.
  6. Breach Notification: Updated breach notification requirements to HHS and affected parties.
  7. Notice of Privacy Practices: Updated HIPAA Privacy Rule Notice of Privacy Practices requirements for covered entities who receive or maintain Part 2 records to include a provision limiting redisclosure of Part 2 records for legal proceedings according to Part 2 standards.

Other proposed changes include:

  • Establishment of a complaints process;
  • Protections for patients who file complaints of Part 2 violations;
  • Required disclosures to the secretary for enforcement;
  • Alignment with HIPAA confidentiality notice requirements; and
  • Permission for investigative agencies to apply for a court order to use or disclose Part 2 records after they unknowingly receive Part 2 records in the course of investigating or prosecuting a Part 2 program when certain preconditions are met

During the Department’s undertaking of the rulemaking, the current Part 2 regulations remain in effect. Additionally, more restrictive state laws still apply. The general public can submit feedback regarding the proposed rule until January 31, 2023. The HHS will most likely issue a Final Rule in 2023.

To view the Notice of Proposed Rulemaking, click here.

Related Services:

Behavioral Health Care