Aaron O’Neill
Associate Editor
Loyola University Chicago School of Law, JD 2024
On February 8, the Department of Health and Human Services (HHS) posted its new final rule to align 42 CFR Part 2 with HIPAA regulations, which will improve coordination of care for substance use disorder (SUD) patients and improve privacy protections. The new rule modifies sections of Part 2 regarding patient consent, uses and disclosures of information, penalties for improper use, breach notification, and patient notice as well as other areas. The rule, however, does not alter the limits on use of patient records to investigate or prosecute SUD patients or the limits on the use of records obtained through an audit or evaluation of a Part 2 program. Part 2 programs and providers should be aware of these changes and the new limitations and uses they provide.
What is 42 CFR Part 2?
A Part 2 program, as defined in section 2.11 of the rule, is “an individual, entity (other than a general medical facility), or an identified unit in a general medical facility, that holds itself out as providing and provides diagnosis, treatment, or referral for treatment for a SUD.” Individual medical providers or staff whose primary purpose is diagnosing or treating SUD are also considered programs. These specific entities and individuals are subject to the privacy, consent and disclosure requirements asserted under Part 2.
Part 2 specifies requirements for SUD programs regarding consent forms, permitted disclosures for patient identifying information, the amount of information being disclosed, as well as the purpose of disclosure. Part 2 also provides an outlet for exchange of information through a query-based exchange platform. This allows certain SUD part 2 programs to look up information through an intermediary known as a health information exchange (HIE). Information provided through an HIE is available to part 2 programs who have entered into an agreement acknowledging it is fully bound by 42 CFR Part 2 when dealing with patient records and will resist judicial proceedings to obtain SUD-related patient records. These are considered qualified service organizations.
What notable changes does the rule implement?
In an effort to increase the ease of care coordination for patients, the new rule allows a single consent that applies to all future uses and disclosures related to treatment, payment or health operations. It also provides the same disclosure use to HIPAA covered entities. This aims to remove restrictions on transferability of data between providers in an effect to align with HIPAA privacy restrictions. The rule further allows the disclosure of SUD records, without patient re-consent, to public health officials as long as those records are de-identified. This is done to improve the assessment of SUD care and outcomes by removing a consent requirement to obtain data, and there is minimal harm to the patient when records are de-identified.
The rule further aligns Part 2 with HIPAA by implementing HIPAA civil and criminal penalties in place of the current Part 2 criminal penalties, HIPAA’s breach notification requirements, as well as the patient notification requirements. These modifications will likely make it easier for SUD programs, operating within HIPAA covered entities, to maintain compliance with both part 2 and HIPAA by aligning the guidelines.
Other changes revolve around applicability of the guidelines, re-disclosure, and further consent requirements. The rule does not cover records, created during visits with non-part 2 providers that there directly related to the care they provide. There is however, an exception for cases where previous records from part 2 programs are included. This is another change intended to facilitate coordination of care. With regard to consent requirements, the new rule removes the requirement for SUD patients to identify specific providers when consenting for disclosure to another entity. This has been changed in order to assist patients in having their records transferred to entities for the purpose of obtaining benefits, as many of those entities do not ask that the records be directed to specific personnel.
Impact on SUD providers
Overall, these changes will be beneficial for providers and patients. The new rule removes some limitations on providers’ ability to transfer records while also keeping in place sufficient protections for patients undergoing this sensitive treatment. Part 2 programs should pay the most attention to the changes in alignment with HIPAA, especially for SUD providers who operate within a HIPAA covered entity. While HHS has done a good job of making the part 2 requirements similar, these providers should not be lulled into thinking that only compliance with HIPPA regulations will be sufficient. Specifically, when consent has already been obtained, they must consult the new rule to determine whether further disclosure requires additional consent or de-identification.
SUD treatment contains extremely sensitive information that HHS has shown a willingness to protect through enforcement. Providers should not mistake the additional support for coordination of care with a step-back in valuing the protection of SUD patients’ treatment information. That being said, the final rule becomes effective on April 16, 2024, but Part 2 programs have two years to make any adjustments to their privacy materials and disclosure process in order to comply with the new rule (February 16, 2026).