The U.S. Department of Health & Human Services (HHS) through the Substance Abuse and Mental Health Services Administration (SAMHSA) and the Office for Civil Rights recently issued a Final Rule amending the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations, 42 CFR Part 2 (Part 2). The Final Rule, which was issued on February 8, 2024, modifies existing Part 2 regulations to better align Part 2 with the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act in areas where Part 2 previously differed, and in some instances conflicted, with HIPAA and HITECH on the requirements for protecting confidential patient medical records. Although Part 2 continues to contain more restrictive regulations, key substantive changes will benefit SUD providers that are subject to Part 2, HIPAA, and HITECH. This alert addresses those key changes and important steps SUD providers should take to come into compliance.
Federally assisted providers who provide treatment to or refer patients for SUD treatment are subject to federal statute 42 U.S.C. 290dd–2 of the Public Health Service Act (Public Health Service Act) and its implementing federal regulations, Part 2. SUD treatment includes the "care of a patient suffering from a substance use disorder, a condition which is identified as having been caused by the substance use disorder, or both, in order to reduce or eliminate the adverse effects upon the patient." 42 C.F.R. § 2.11. Many SUD treatment programs are "federally assisted" in that the provider seeks reimbursement from Medicare, Medicaid or other programs underwritten by federal funds in some manner. See 42 C.F.R. § 2.12. The Coronavirus Aid, Relief, and Economic Security (CARES) Act amended the Public Health Service Act in 2020, to be more aligned with HIPAA and HITECH, but the amendment did not modify the Part 2 rule. On December 2, 2022, HHS published a Notice of Proposed Rulemaking proposing to amend the Part 2 rule to also come into alignment (Proposed Rule). As explained in HHS's Part 2 Final Rule Fact Sheet, the February 8, 2024, Final Rule reflects most of the proposed changes in the Proposed Rule.
While the Final Rule is expected to become effective on April 16, 2024, SUD providers have until February 16, 2026, to come into compliance. While SUD providers determine what changes to make to their organization policies, procedures, and forms, here are some key points to consider:
Permitted Redisclosures with Patient Consent
Part 2 previously prohibited any SUD records received from a Part 2 program from being redisclosed, except in very limited and narrow circumstances. The Final Rule aligns Part 2 with the HIPAA patient consent requirements to allow a single written patient consent form to apply to all uses and disclosures – and redisclosures – for treatment, payment, and health care operations (TPO) purposes. SUD providers may now revise their patient consent to remove the prohibition on redisclosure, which will allow easier collaboration among providers and business associates.
As SUD providers are revising patient consent forms, note that the Final Rule requires that each disclosure made with patient consent include a copy of the consent or a clear explanation of the scope of the consent. Additionally, separate patient consent is still required for the use and disclosures of "SUD counseling notes," which are discussed below.
Definition for SUD Counseling Notes
The Final Rule adds a definition for SUD counseling notes, which are defined as "notes recorded (in any medium) by a Part 2 program provider who is a SUD or mental health professional documenting or analyzing the contents of conversation during a [counseling session] and that are separated from the rest of the patient's SUD and medical record." HHS added this definition to ease compliance burdens for SUD providers by closely mirroring the definition with the definition of "psychotherapy notes" in HIPAA. See 45 C.F.R. § 164.501. Both definitions exclude information such as medication prescription and monitoring, session dates and times, and test results.
This addition is especially important because many providers often forget the special treatment psychotherapy notes and SUD counseling notes require. Both SUD counseling notes and psychotherapy notes must be segregated from a patient's medical record and have additional restrictions on use and disclosure because the clinician uses them to make decisions about the patient. For this same reason, HIPAA does not provide a right of access to psychotherapy notes. Part 2 also does not confer a right of access to SUD counseling notes, or any Part 2 records. However, HIPAA and Part 2 allow clinicians to voluntarily provide these notes to patients when deemed appropriate.
As SUD providers revise their policies and procedures to align with the Final Rule, we encourage providers to take the time to conduct refresher training on the often-overlooked restrictions surrounding the use of SUD counseling notes and psychotherapy notes.
Desegregation of Part 2 Data
Under the old Part 2 regulation, any SUD records received from a Part 2 program or other lawful holder were required to be segregated or segmented from a patient's medical record. To alleviate any administrative burdens surrounding data segregation, the Final Rule expressly amends Part 2 regulations to state that segregating Part 2 records is no longer a requirement for SUD records received based on a single consent for all future TPO, with the exception of SUD counseling notes discussed above. SUD Providers can now amend their program policies to implement a more cohesive recordkeeping system. However, the Final Rule also encourages SUD Providers to make reasonable efforts to implement access controls that accommodate any patient requests to limit access to their SUD records.
Responding to Subpoenas
The Final Rule still prohibits SUD records from being used in legal proceedings against a patient without a separate patient consent, or a court order. SUD providers often receive subpoenas for patient records for use in legal proceedings. To properly respond to those subpoenas, SUD providers have had to carefully determine whether the request includes SUD records, which require specific patient consent or a special Part 2 court order. Although the Final Rule relaxes the patient consent requirements for disclosures for TPO purposes, Part 2 remains stricter than HIPAA when it comes to the use of SUD records in legal proceedings.
This special restriction is another important and often forgotten topic SUD providers should highlight as they revise their policies and procedures and establish new training.
Penalty Structure
Previously, Part 2 stated that any person in violation of the Part 2 regulations would be subject to criminal penalties, which were not heavily enforced by the U.S. Department of Justice. The Final Rule has adopted HIPAA's criminal and civil penalty structure found in 42 U.S.C. 1320d–5 and 1320d-6, which now means there will be a consistent enforcement process for HIPAA and Part 2. The Final Rule states that HHS will identify the enforcing agency prior to February 16, 2026.
Other Key Changes
In addition to the above changes, the Final Rule also:
- Creates a right for patients to file a complaint for an alleged violation of Part 2 directly with the Secretary of HHS;
- Aligns Part 2 Patient Notice requirements with the HIPAA Notice of Privacy Practices requirements; and
- Creates a safe harbor limit to the criminal and civil penalties that can be imposed on investigative agencies for violating Part 2 if the agencies act with reasonable diligence.
Next Steps
Providers have two years to come into compliance with the Final Rule but may voluntarily comply with the new provisions any time after its effective date. For those SUD providers seeking to take advantage of the beneficial changes in the Final Rule sooner, be mindful of the importance of implementing new practices consistently and cohesively. A wise first step would be to examine your current policies and procedures, revise them according to the Final Rule, and prepare training for staff prior to the rollout of your new policies. As always, establishing a strong compliance program with clearly written policies, robust training, and frequent auditing and monitoring mechanisms will be beneficial to your SUD program.
SUD providers should be on the lookout for guidance from HHS on how to comply with the Final Rule and contact their legal counsel for advice on specific issues.
If you have questions about the Part 2 Final Rule or compliance, please contact E. Bahati Mutisya or any member of Baker Donelson's Health Law team.