HHS Finalizes Rule on Confidentiality of Substance Use Disorder Patient Records

On February 8, 2024, HHS released a final rule modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations under 42 CFR Part 2 (referred to as “Part 2”). The final rule implements confidentiality rules required under the CARES Act to align certain aspects of Part 2 with HIPAA rules.

The final rule implements many of the proposed modifications originally published in the December 2, 2022, Notice of Proposed Rulemaking (NPRM), which we discussed in a prior Compliance Corner article. Among other items, these changes include the following:

• With respect to patient consent, include allowing a single consent for all future uses and disclosures, while also allowing HIPAA-covered entities and business associates to redisclose records in accordance with HIPAA regulations.
• Permit disclosure of de-identified records without patient consent to public health authorities in accordance with the HIPAA Privacy Rule.
• Restrict use of records and testimony in proceedings against patients absent consent or a court order.
• Align Part 2 penalties with HIPAA civil and criminal enforcement.
• Update breach notification requirements to HSS and affected patients that follow the HIPAA Breach Notification Rule.
• Create safe harbor limits on civil and criminal liability for investigative agencies in certain circumstances.

In addition to the changes from the NPRM, the final rule further modifies Part 2 in the following ways:

• Expressly states that segregating Part 2 records is not required.
• Informs of the right to file a complaint directly with the secretary.
• Expands patient consent requirements, including the need for a clear explanation of the scope of consent, the need for separate consent for the use and disclosure of SUD counseling notes, and the prohibition on combining consent for disclosure except for civil, criminal, administrative, or legislative proceedings.
• Expands the safe harbor limits from the NPRM to include reasonable steps the agencies must follow to be eligible for the safe harbor.
• Allows patients to opt out of receiving fundraising communications.

Persons subject to the rule must comply within two years of publication of the final rule. HHS will develop guidance on how to comply with the new requirements. Group health plan sponsors should be aware of the final rule and consult with their insurers or service providers regarding implementing the changes to Part 2 record protections.

Fact Sheet 42 CFR Part 2 Final Rule »