On February 8, 2024, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA) announced long-awaited changes to 42 CFR Part 2 (“Part 2”), the federal regulations governing the confidentiality of certain Substance Use Disorder (SUD) patient records. The Final Rule implements modifications required by the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) (enacted in March 2020), which directed HHS to align Part 2 with the HIPAA Privacy, Breach Notification, and Enforcement Rules. According to HHS, the Final Rule “increases coordination among providers treating patients for SUDs, strengthens confidentiality protections through civil enforcement, and enhances integration of behavioral health information with other medical records to improve patient health outcomes.”

After decades of trying to navigate two sets of rules based on the type of information in the patient’s record, some aspects of the Final Rule will be welcome for health centers; however, the Final Rule expands enforcement opportunities for violations of Part 2 that did not exist before the changes. The Final Rule introduces several key changes that are relevant to health centers, including:

• Permitting use and disclosure of Part 2-protected records based on a single patient consent given once for all future uses and disclosures for treatment, payment, and health care operations.
• Permitting re-disclosure of Part 2-protected records by HIPAA-covered entities and business associates in accordance with the HIPAA Privacy Rule, with certain exceptions.
• Providing new rights for patients under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule.
• Aligning Part 2 Patient Notice requirements with the requirements of the HIPAA Notice of Privacy Practices.
• Expanding prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings.
• Providing HHS enforcement authority, including the potential imposition of civil money penalties for violations of Part 2.
• Outlining new breach notification requirements applying to Part 2 records.

HHS released a Fact Sheet on the Final Rule and will host a Patient Privacy Stakeholder Webinar on February 9, 2024. HHS expects to conduct outreach and develop additional guidance on compliance with the Final Rule.

On February 27, 2024 at 1:00 PM ET, Feldesman Leifer LLP will host an Industry Update on the Final Rule.