Quick Overview: HHS Updates Rule Governing the Confidentiality of Substance Use Disorder Patient Records (US)

In February 2024, the U.S. Department of Health and Human Services (HHS) issued the much anticipated final rule to update the Confidentiality of Substance Abuse Disorder Patient Records regulations at 42 CFR Part 2 (Part 2). 

The final rule implements the directive in section 3221 of the 2020 Coronavirus Aid, Relief, and Economic Security (CARES) Act that HHS amend Part 2 to better align certain requirements with the Health Insurance Portability and Accountability Act and its implementing regulations (HIPAA). 

The Part 2 final rule was effective April 16, 2024 (i.e., 60 days following publication in the Federal Register), and compliance is required 24 months following the publication (February 16, 2026). 

This article discusses the amendments to Part 2 and its most impactful revisions, including the amendments to: 

• Loosen patient consent requirements, in particular for disclosures for treatment, payment, and health care operations purposes;
• Regulate SUD counseling notes, similar to how HIPAA regulates psychotherapy notes;
• Create new patient rights and breach notification requirements that are closely aligned with HIPAA; and
• Update the penalty structure for violations. 

Part 2 Applicability

First, a reminder on Part 2’s applicability, which did not substantively change with the amendments but is often misunderstood. Under § 2.12(a), Part 2 applies to patient records that (1) identify a patient as having or having had a substance use disorder (SUD); and (2) contain SUD information obtained by a Part 2 program. 

A Part 2 program is any federally assisted program, with “federal assisted” and “program” each being defined terms. As defined in § 2.11, a program is any of the following:

1.  A person (other than a general medical facility) that holds itself out as providing, and provides, SUD diagnosis, treatment, or referral for treatment; or
2. An identified unit within a general medical facility that holds itself out as providing, and provides, SUD diagnosis, treatment, or referral for treatment; or
3. Medical personnel or other staff in a general medical facility whose primary function is the provision of SUD diagnosis, treatment, or referral for treatment and who are identified as such providers. 

Note that a provider practicing at a general medical facility where the provider’s primary function is not providing diagnosis, treatment, or referral for treatment of a SUD is generally not a Part 2 program.

Under § 2.12(b), a program is federally assisted if: 

1. It is directly or indirectly conducted by a department or agency of the United States; 
2. It is being carried out under a license, certification, registration, or other authorization granted by and department or agency of the United States including but not limited to:
        (a) Participation in Medicare; 
        (b) Authorization to conduct maintenance treatment or withdrawal management; or
        (c) Registration to dispense a substance under the Controlled Substances Act in a SUD program. 
3. It accepts funding from any department or agency of the United States; or
4. The Internal Revenue Service permits tax deductions for contributions to the program. 

HHS has issued a guidance document that provides assistance to providers in determining if Part 2 applies. A classic example of a Part 2 program would be an Opioid Treatment Program providing Medication Assisted Treatment for persons diagnosed with an opioid use disorder.

In addition to Part 2’s importance to Part 2 programs, persons that receive SUD records from a Part 2 program pursuant to patient consent may be restricted in further using or disclosing the records in some cases. 

With that background, we now address the most important amendments to Part 2. 

Single Consent for Treatment, Payment, and Health Care Operations

The Part 2 amendments at § 2.31 softened the consent requirements in general. The amendments added specific requirements for single consents for future uses and disclosures for treatment, payment, or health care operations (TPO) as defined under HIPAA. 

Part 2 now permits Part 2 programs to obtain one patient consent for all future uses and disclosures of Part 2 patient records for TPO and the consent may be drafted as follows: 

• The recipient’s information may be listed as “my treating providers, health plans, third-party payers, and people helping to operate this program” or another statement to that effect.
• The purpose may be listed as “treatment, payment, and health care operations.”
• The Part 2 program must describe the potential for the records to be redisclosed by the recipient and no longer protected by Part 2, and the consequences if the patient refuses to grant consent. 
• Where the recipient is a covered entity or business associate, patient consent for a disclosure to that recipient must include a special notice that their records may be redisclosed in accordance with HIPAA, except for uses and disclosures for civil, criminal, administrative, and legislative proceedings against the patient.
• The consent for TPO purposes does not have to expire. 

Disclosures made with the patient’s written consent still must be accompanied by a statement such as “42 CFR part 2 prohibits unauthorized use or disclosure of these records.” 

A new requirement is that disclosures must contain a copy of the patient’s written consent or an explanation of the scope of that consent (see § 2.32). 

This new requirement may be difficult to implement in practice. For example, how will programs include a copy of the consent or an explanation of the scope when disclosing Part 2 records to other providers or payors?

Note that a covered entity or business associate that receives Part 2 patient records subject to this consent may redisclose those records pursuant to HIPAA without any additional consent from the patient, except that the records cannot be redisclosed for use in legal proceedings against the patient without specific consent or a court order. 

The final rule expressly disclaims any requirement for a recipient of patient SUD records pursuant to a single consent for TPO to segregate Part 2 patient records (see § 2.12(d)(2)(i)(C)).

Part 2 patient records (still) may not be used or disclosed for any legal proceeding against the patient without the patient’s written consent or a court order, which is more stringent than HIPAA.

Consent to the disclosure of Part 2 patient records for a legal proceeding must follow the consent rules for other disclosures in § 2.31, with the nuance that consent to the disclosure of patient records for a legal proceeding may not be combined with consent to any other use or disclosure. See 42 CFR Part 2, subpart E for more information about Part 2 court orders for disclosure in legal proceedings without patient consent.

SUD Counseling Notes

The amended Part 2 rules introduced the concept of SUD counseling notes. SUD counseling notes are notes recorded by a Part 2 SUD professional regarding “the contents of a conversation during a [SUD counseling session] and that are separated from the rest of the patient's … medical record.” 

They do not include “medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.”

Part 2 programs must obtain separate written consent to use or disclose SUD counseling notes except in limited circumstances relating to the Part 2 program’s own TPO. Part 2 programs may not include SUD counseling notes in a single consent disclosure for TPO.
 
Part 2’s treatment of SUD counseling notes is very similar to how HIPAA addresses psychotherapy notes.

New Patient Rights

Patients now have similar rights to HIPAA under Part 2, including the right to: 

• Request restrictions of disclosures made with prior consent for TPO or to a patient’s health plan for services the patient has paid in full and pursuant to the restriction requirements under HIPAA (see § 2.26); 
• An accounting of disclosures made pursuant to a consent in the past three years under § 2.25 (disclosures for TPO only need to be included in the accounting when made through an electronic health record); 
• A list of disclosures by an intermediary for the past three years under § 2.24; and
• A “clear and conspicuous opportunity to elect not to receive fundraising communications” which the HHS describes as an “opt-out” right.

Unlike HIPAA, Part 2 does not independently provide patients the right to access their own records. See § 2.23, noting Part 2 does not prohibiting giving the patient access to the patient’s own records. 

In addition, Part 2 requires notice to patients that federal law protects their confidentiality. The previous notice requirements have been replaced with new requirements that closely align with HIPAA’s Notice of Privacy Practices. These requirements are enumerated in § 2.22(b) and include:

• A header labelled “Notice of Privacy Practices of [Name of Part 2 Program]”; 
• A description of the uses and disclosures of patient records;
• A separate description if the Part 2 program intends to use the single consent for TPO;
• A description of the patient’s rights with respect to their records; 
• A description of the Part 2 program’s duties under federal law; and
• Notice of the patient’s right to complain to HHS. 

Breach Notification

The final rule incorporates HIPAA’s breach notification rule into Part 2’s notification requirements for a breach of patient confidentiality (see § 2.16). 

If a Part 2 program experiences an acquisition, access, use, or disclosure of unsecured patient records, it may be required to notify affected patients, HHS, and the media. See the HIPAA breach notification rule for more information).

Penalties

Violations of Part 2 now carry the same civil and criminal penalties for violations of HIPAA: 42 U.S.C. § 1320d–5 and § 1320d–6. For additional information, please refer to the HHS’s Fact Sheet on the Part 2 Revisions. 

Author: Jennifer Hennessy, Foley & Lardner LLP