HHS-OCR Finalizes Modifications to Part 2 Rules

On Feb. 8, the Department of Health and Human Services' Office for Civil Rights (HHS-OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA) finalized modifications to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR Part 2. The purpose of these modifications is to better align the protections given to substance use disorder patient records with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) regulations as required by the Coronavirus Aid, Relief, and Economic Security Act (CARES Act). 

The final rule, while not yet published in the Federal Register, is effective April 16, 2024. The compliance date for Part 2 programs is Feb. 16, 2026. 

Here are some of the highlights from the new rules. 

Patient Consent

The Part 2 rules will now: 

• allow a single consent for all future uses and disclosures for treatment, payment, and health care operations.
• allow HIPAA covered entities and business associates that receive records under this consent to re-disclose the records in accordance with the HIPAA regulations.

Disclosures

The Part 2 rules will now: 

• permit the disclosure of records without patient consent to public health authorities, provided that the records disclosed are de-identified according to the standards established in the HIPAA Privacy Rule.
• require a court order or patient consent to use Part 2 records in civil, criminal, administrative, and legislative proceedings against patients.

Enforcement

The HIPAA Enforcement Rule will now apply to Part 2 programs. Previously, the U.S. Department of Justice was tasked with enforcement under a criminal penalty.  As a result of the modifications, the HHS-OCR will be responsible for enforcement, including the imposition of civil money penalties.  

Breach Notification

The HIPAA Breach Notification Rule will now apply to Part 2 programs. 

Patient Notice

Part 2 programs will have to provide a patient notice that fulfills the requirements of a HIPAA Notice of Privacy Practices. 

Safe Harbor

There is a civil and criminal safe harbor for investigative agencies that inadvertently use and disclose Part 2 records without the required court order or patient consent, provided certain steps are taken.