Part 2 Changes Take Effect to Improve Integrated Care and Protect Patient Privacy for Individuals with Substance Use Disorders

Effective April 16, 2024, the Confidentiality of Substance Use Disorder (“SUD”) Patient Records regulations at 42 CFR part 2 (“Part 2”) are amended to increase coordination among providers treating patients for SUDs, strengthen confidentiality protections through civil enforcement, and enhance integration of behavioral health information with other medical records to improve patient health outcomes.  These provisions mark a critical step in ensuring that individuals receiving treatment for SUD have access to comprehensive care while safeguarding their privacy rights and removing barriers to care coordination and the associated dual compliance obligations for regulated entities.

Part 2’s modifications include:

• Permitting use and disclosure of Part 2 records based on a single patient consent given once for all future uses and disclosures for treatment, payment, and health care operations, and removing any need to segregate or segment Part 2 records shared under such circumstances;
• Permitting redisclosure of Part 2 records by HIPAA covered entities and business associates in accordance with the HIPAA Privacy Rule, with certain exceptions;
• Providing new rights for patients under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule;
• Requiring patient consent for any use or disclosure of SUD counseling notes, with very limited exceptions;
• Expanding prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings;
• Providing the Department of Health and Human Services enforcement authority, including the potential imposition of civil money penalties for violations of Part 2; and
• Outlining new breach notification requirements applying to Part 2 records.

Health care providers and entities that are subject to Part 2 should review the changes to Part 2 and determine potential impacts on their policies, procedures and processes.  Enforcement activity for violations of Part 2, which has historically been subdued, will likely increase because the processes for enforcing HIPAA, including its structure for accepting and investigating complaints and assessing fines and penalties, will now be leveraged to enforce compliance with Part 2.

Please contact the Miller Johnson Mental Health Law practicing attorneys if you have questions or would like support with Part 2 compliance.