HHS Finalizes Changes to Substance Use Confidentiality Regulations

HHS, via the Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA), announced its finalized changes to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations under 42 CFR part 2.

Since 1975, Part 2 regulations have protected the confidentiality of individuals suffering from substance use disorder and have undergone several revisions in the decades since. Most recently, in 2020, section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act required the HHS Secretary to align certain aspects of Part 2 with HIPAA and the HITECH Act.

HHS incorporated stakeholder feedback from its 2022 Notice of Proposed Rulemaking (NPRM) to further align Part 2 rules with HIPAA. Many of the modifications that were solidified in the final rule were proposed in the NPRM, including permitting the use and disclosure of Part 2 records based on patient consent given once for all future uses and disclosures for treatment, payment, and operations purposes.

As mentioned in the NPRM, the final rule also permits redisclosure of Part 2 records by HIPAA-covered entities and business associates as defined by the HIPAA Privacy Rule. Under the new rule, covered entities will also be allowed to disclose records without patient consent to public health authorities, so long as they de-identify the records in accordance with HIPAA.

Notably, the rule also made modifications to penalty and breach notification standards under Part 2. Specifically, Part 2 penalties will now be aligned with HIPAA violations, meaning that civil and criminal enforcement authorities will replace the criminal penalties currently in place under Part 2. This action will ideally streamline the enforcement process for HHS and SAMHSA by providing HHS with enforcement authority.

The substance use disorder confidentiality regulations will also now be subject to the same requirements of the HIPAA Breach Notification Rule.

“The Final Rule strengthens confidentiality protections while improving care coordination for patients and providers,” OCR Director Melanie Fontes Rainer said in a press release.  

“Patients can seek needed treatment and care for substance use disorder knowing that greater protections are in place to keep their records private, and providers can now better share information to improve patient care.”

Along with finalizing the modifications proposed in the NPRM, the final rule includes several other provisions that were added based on comments received during the public comment period.

For example, the final rule clarifies the steps that investigative agencies must follow to be eligible for safe harbor. Prior to requesting records, the agency must look for a provider in SAMHSA’s online treatment facility locator and check a provider’s HIPAA Notice of Privacy Practices to determine whether the provider is subject to Part 2.

The final rule also confirmed that segregation of Part 2 records is not required, and gave patients the right to file a complaint directly with the Secretary for Part 2 violations. What’s more, substance use disorder clinician notes will now require separate patient consent and will be handled under HIPAA in the same way that psychotherapy notes are designated.

While these changes are significant, the core elements of Part 2 have not changed at all, HHS stressed.

“As has always been the case under Part 2, patients’ SUD treatment records cannot be used to investigate or prosecute the patient without written patient consent or a court order,” HHS stated in a fact sheet about the final rule.

“Records obtained in an audit or evaluation of a Part 2 program cannot be used to investigate or prosecute patients, absent written consent of the patients or a court order that meets Part 2 requirements.”

The final rule will be published in the Federal Register in mid-February, and compliance requirements will take effect two years after its publication date. HHS stated that it would support implementation and enforcement and issue further guidance to help entities comply with the new requirements.

“Patient confidentiality is one of the bedrock principles in health care. People who are struggling with substance use disorders must have the same ability to keep their information private as anyone else. This new rule helps to ensure that happens, by strengthening confidentiality protections and improving the integration of behavioral health with other medical records,” said HHS Secretary Xavier Becerra.

“The Biden-Harris Administration has made it a priority to end the stigmatization of those living with substance use disorders and give health care providers the tools they need so they can treat the whole patient while continuing to protect patient privacy. We will not rest until behavioral health is fully integrated into health care and those struggling with behavioral health challenges get the best treatment available.”