42 CFR Part 2 Final Rule Harmonizes Substance Use Disorder Confidentiality Protections with HIPAA

On February 8, 2024, the federal Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR Part 2 (Part 2) were revised in part to increase patient protection and streamline patient consent practices. Most significantly, the new rule takes major steps to harmonize Part 2 with the Health Insurance Portability and Accountability Act of 1996 (HIPAA). In addition to efficiency improvements, the new rule reflects an important development in the SUD treatment model: the notion that SUD treatment and overall health are inextricably linked.

On a more granular level, one of the practical improvements from the new rule is the ability to use a single patient consent for future uses and disclosures. The new rule also aligns the patient notice, breach notification, and penalties provisions of Part 2 with HIPAA. Further, SUD providers and contractors will be considered HIPAA Business Associates, such that separate contracting or additional contracting language is no longer required.

Despite increased alignment with HIPAA, the overall framework for SUD record confidentiality remains subject to its own separate regulatory scheme. As a result, some Part 2 rules will not change. For example, the use of patient records by law enforcement in criminal prosecutions is still prohibited absent a court order, and disclosure of records without patient consent remains limited.

The revised rule, which implements confidentiality provisions of the Coronavirus Aid, Relief, and Economic Security (CARES) Act, has been in development for several years. The U.S. Department of Health & Human Services (HHS), through the Substance Abuse and Mental Health Services Administration (SAMHSA) and the Office for Civil Rights (OCR), announced the final rule, just more than a year after its December 2022 Notice of Proposed Rulemaking and the associated public comment period.

Formal publication in the Federal Register is expected on February 16, 2024, with compliance required two years later (February 16, 2026). Part 2 fact sheets have been released by both HHS and SAMHSA, and more guidance is forthcoming.