Modernized Substance Use Disorder Confidentiality Rule Finalized

The federal law governing the confidentiality of substance use disorder records, and the accompanying regulations found at part 2 of title 42 of the Code of the Federal Register (or “Part 2” as it’s more commonly known) has long been part of the health care privacy landscape. In fact, Part 2 predates the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) by more than 20 years. However, once HIPAA was implemented, Part 2 was quickly overshadowed by the new privacy law with the bigger reach. Because of the differences between the two privacy regimes, some in the industry have long called for alignment of Part 2 to the HIPAA rules. The Part 2 regulations were closely tied to the detailed statutory language, limiting the Substance Abuse and Mental Health Services Agency’s (“SAMSHA”) ability to make meaningful progress toward alignment.

This changed in 2020 when Congress included updates to the statute in its Coronavirus Aid, Relief, and Economic Security Act (or “CARES Act”). These substantive statutory changes allowed for some further alignment with HIPAA. However, Congress did not eliminate certain special protections reserved for substance use disorder records, including the need to capture an individual’s consent before making disclosures.

On February 16, the Department of Health and Human Services published the latest Part 2 final rule implementing the CARES Act changes to the statute. Below is a brief summary of certain provisions of the final rule which are applicable to providers.

Patient Consent

• TPO Consent. The final rule implements the “TPO Consent” required by the statutory update and described in the proposed rule. This permits a single consent form to be used for all future uses and disclosures for treatment, payment, and health care operations to certain entities. Those recipients are permitted to further use and disclose the Part 2 records in the same manner the recipients can disclose under HIPAA.
• Compound Consent. Patient consent for certain purposes, including civil, criminal, administrative, or legislative proceedings, cannot be used with another use or disclosure purpose. Separate consents must be obtained for the distinct purposes.
• Fundraising. An individual has a right to opt-out of fundraising. This must be stated on applicable consent forms.

Data Segregation

• Generally. The regulation now expressly states that Part 2 records need not be segregated from other patient records when held by Part 2 programs or by covered entities pursuant to a TPO Consent.
• SUD Counseling Notes. The final rule adopted a category of patient care notes called “SUD Counseling Notes.” Like with psychotherapy notes under HIPAA, this category of records must be maintained separately from other records. This type of record cannot be disclosed without separate, express consent from the patient.

Direct Alignment with HIPAA

• Penalties. Penalties for violating Part 2 now have more teeth. While there were criminal penalties before, they were unused. The new enforcement mechanisms, both civil and criminal, are aligned with HIPAA.
• Breach Notification. Part 2 programs are now subject to the same breach notification obligations for any breach of a Part 2 record in the same way covered entities are subject to breach notifications for breaches of PHI.
• Complaints. Like with Privacy Rule complaints, individuals are able to complain to the provider as well as to the Secretary of HHS.

Deadline for Compliance

Finally, the Final Rule takes effect 60 days after the publication of the final rule. The compliance date, or the date on which those subject to the regulation must be in compliance with the changes, is 22 months after the effective date. In short, HHS gives the industry two years to comply with the Part 2 changes. Mark your calendars for February 16, 2026!