In a significant move towards safeguarding patient privacy and promoting integrated care, the U.S. Department of Health and Human Services (HHS) recently unveiled the final rule amending the regulations concerning the Confidentiality of Substance Use Disorder (SUD) Patient Records. 

On February 8, 2024, HHS announced the final rule modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR part 2.

Notable modifications to Part 2 that were proposed in the NPRM:

• Penalties: Aligns Part 2 penalties with HIPAA by replacing criminal penalties currently in Part 2 with civil and criminal enforcement authorities that also apply to HIPAA violations².
• Breach Notification: This applies the same requirements of the HIPAA Breach Notification Rule³ to breaches of records under Part 2.
• Patient Notice: Aligns Part 2 Patient Notice requirements with the requirements of the HIPAA Notice of Privacy Practices.
• Safe Harbor: Creates a limit on civil or criminal liability for investigative agencies that act with reasonable diligence to determine whether a provider is subject to Part 2 before making a demand for records during an investigation. The safe harbor requires investigative agencies to take certain steps in the event they discover they received Part 2 records without having first obtained the requisite court order.

The Final Rule also includes further modifications informed by public comments, notably the following:

• Safe Harbor: Clarifies and strengthens the reasonable diligence steps that investigative agencies must follow to be eligible for the safe harbor: before requesting records, an investigative agency must look for a provider in SAMHSA’s online treatment facility locator and check a provider’s Patient Notice or HIPAA Notice of Privacy Practices to determine whether the provider is subject to Part 2.
• Segregation of Part 2 Data: Adds an express statement that segregating or segmenting Part 2 records is not required.
• Complaints: Adds a right to file a complaint directly with the Secretary for an alleged violation of Part 2. Patients may also concurrently file a complaint with the Part 2 program.
• Fundraising: Create a new right for patients to opt out of receiving fundraising communications.

As has always been the case under Part 2, patients’ SUD treatment records cannot be used to investigate or prosecute the patient without written patient consent or a court order. Records obtained in an audit or evaluation of a Part 2 program cannot be used to investigate or prosecute patients, absent written consent of the patients, or a court order that meets Part 2 requirements.

For more information and a link to the final rule for download, please visit Fact Sheet 42 CFR Part 2 Final Rule  | HHS.gov