Changes to Substance Abuse Disorder Records Rules
September 1, 2024 6 minutes read
By Greg Freeman
Executive Summary
Health and Human Services has changed patient confidentiality rules related to substance use disorder records. Healthcare organizations will need to update their policies and procedures.
- Part 2 violations will now be subject to both criminal and civil penalties.
- The move was intended to align Part 2 more closely with HIPAA.
- Violation complaints will be more common.
Health and Human Services (HHS) recently made changes to the confidentiality of substance use disorder (SUD) records, providing that Part 2 violations now will be subject to both criminal and civil penalties. Healthcare organizations will need to review their policies and procedures to ensure compliance by Feb. 16, 2026.
The statute underlying the Part 2 rules, 42 USC 290dd-2, was amended by Congress as part of the 2020 CARES Act (the Coronavirus Aid, Relief, and Economic Security Act), explains says Claire O’Brien, JD, an attorney with the Brooks Pierce law firm in Greensboro, NC. The amendments aimed to increase the regulatory alignment between the Part 2 rules and HIPAA as part of an effort to move toward a more unified scheme of privacy protections.
These changes should increase access to quality treatment by improving healthcare providers’ ability to “treat the whole patient,” she says. HHS wants behavioral health to be “fully integrated” into healthcare while still ensuring that patients who seek treatment for SUDs are assured their records will be kept private in most circumstances, O’Brien says.
Many terms in the Part 2 rules are now defined by reference to HIPAA, including breach, business associate, covered entity, healthcare operations, treatment, and others. O’Brien says this should make interpretation of the Part 2 rules more straightforward.
The revised rules provide greater patient protections in several respects, she says. Among other things, the revised rules add extensive new language that Part 2 programs must provide to patients regarding such programs’ legal duties and privacy practices.
The rules also give patients new rights to request an accounting of disclosures of their Part 2 records and to request restrictions on disclosures, she says. These steps likely will benefit patients by giving them increased knowledge and opportunities to assert their privacy rights and address concerns about who may see their Part 2 records. The revisions also expand the regulatory prohibition on the use and disclosure of Part 2 records against a patient to expressly include administrative and legislative proceedings — offering additional protections for patients who may fear negative legal consequences arising from their SUD treatment, O’Brien says. The revisions also create a new category of information called “SUD counseling notes,” which require separate patient consent. These are comparable to HIPAA psychotherapy notes, she says.
“Long-term, the revised rules should reduce the compliance burden on providers, although this will require an upfront time commitment as they revise their policies to ensure alignment with the new Part 2 framework. This should be a carefully considered process,” O’Brien says. “For example, the revised rules state that segregating or segmenting Part 2 records is no longer required but, practically speaking, providers may wish to continue segregating such records to avoid inadvertent improper disclosure.
“Providers also should continue to keep in mind that state laws might impose additional confidentiality protections beyond those described in the Part 2 rules.”
Historically, enforcement of the Part 2 rules has been rare to nonexistent, O’Brien says. This likely will change because the revised rules contemplate not only criminal penalties but also civil penalties, aligning with HIPAA and enabling the government to leverage existing HIPAA-related enforcement mechanisms, she says.
“Parties should keep in mind that the government may require corrective actions or other informal resolutions, even absent a formal finding of a violation — as is the case with HIPAA enforcement,” O’Brien says.
The revisions also increase the likelihood of a complaint related to Part 2 violations, both by requiring Part 2 programs to establish a process to receive complaints and by permitting individuals to file Part 2-related complaints with the Secretary of HHS, just as they might under HIPAA, she says.
The revised rules permit the use of a single, one-time consent that authorizes all future uses and disclosures for treatment, payment, and healthcare operations, O’Brien says. HIPAA-covered entities and business associates can rely on this consent to redisclose records consistent with HIPAA; the ability to rely on existing HIPAA policies and procedures should facilitate coordination between such providers as they treat patients with SUDs, O’Brien says.
The changes to Part 2 were made so that it can be more closely aligned with HIPAA, says E. Bahati Mutisya, JD, an attorney with the Baker Donelson law firm in Raleigh, NC. Previously, there could be conflict on what a provider is supposed to do with a particular record.
Healthcare organizations will need to take a look at their policies and procedures, make some revisions to them, and share them with patients, Mutisya says. She also encourages organizations to train employees on the new requirements, using it as an opportunity to refresh them on all the relevant policies and procedures.
“I would first look at the notice of privacy practices. Part 2 has now been revised to align with HIPAA, so, hopefully, the provider had a notice of privacy practices in place that were HIPAA-compliant,” she says. “Now they just need to make sure that those notices are also mentioning the Part 2 records. In the new Part 2 regulation, there is specific language that has to be included on the notice of privacy practices just telling the patient what this document is and what you’re about to read.”
One of the changes involves redisclosure. Previously, if Part 2 program gave a SUD record to another entity, that entity was not allowed to redisclose that document to anyone else unless they had permission from the patient, Mutisya explains. Now, Part 2 allows disclosures for the purpose of treatment, payment, or healthcare operations.
“You don’t have to get the patient’s consent again to redisclose a substance use disorder record, if it’s for the purpose of treatment, payment and healthcare operations, which will hopefully allow for better collaboration among providers for particular patients,” she says. “If there are disclosures, there’s a specific language that needs to accompany the disclosure notice. You want to make sure that you’re paying attention to how you’re sending it and making sure that you have that notice attached to the documents as you’re sending them.”
The Part 2 rule change will potentially make it easier for HIPAA-regulated entities to use and disclose SUD records subject to Part 2, says Melissa Soliz, JD, an attorney with the Coppersmith Brockelman law firm in Pheonix.
“However, the change we think will have the most impact on the regulated community and patients is the new Part 2 enforcement and penalty structure. Historically, Part 2 has not been actively enforced by the Department of Justice, and Part 2 did not require Part 2 programs to report unauthorized uses and disclosures of SUD records to individuals or regulatory bodies,” she explains. “ However, starting on Feb. 16, 2026 — the compliance deadline for the Part 2 rule changes — Part 2 programs will have to report unauthorized uses and disclosures of SUD records in violation of Part 2 to individuals and HHS, and in some instances state attorneys general and the media.”
HHS will enforce compliance with the full range of HIPAA penalties, Soliz says. That means individuals and entities who violate Part 2 may face penalties ranging from technical assistance and corrective action plans to civil and criminal penalties, she says.
“Thus, organizations that operate Part 2 programs or maintain SUD records protected by Part 2 should use this time wisely to get ready for compliance with, and enforcement of, the Part 2 rule changes,” Soliz says.
The mandatory deadline for compliance with the Part 2 rule changes is Feb. 26, 2026, but voluntary compliance before that date is permitted, says Katherine Hyde, JD, an attorney with the Coppersmith Brockelman law firm in Phoenix.
Before the compliance deadline, healthcare organizations should identify their SUD records protected by Part 2 as part of their routine data mapping and identify the technical and administrative processes that could be used to tag and segment their SUD records, she says.
Even though the Part 2 regulations expressly state that they do require data segmentation, Hyde says the only way to apply the Part 2 data sharing rules is to identify and segment those data because those data continue to be subject to different use and disclosure rules as compared to data that are only protected by HIPAA.
Organizations also must identity and implement the technical and administrative processes necessary to comply Part 2’s procedural requirements for consent-based disclosures, such as transmission of the prohibition on redisclosure notice and a copy of the consent or explanation of the scope of consent required for each and every disclosure of protected SUD records, she notes.
“Organizations should also revise their Part 2 release of information forms, prohibition on redisclosure notices, their HIPAA Notice of Privacy Practices, and health information privacy policies and procedures to incorporate the new regulatory requirements,” she adds.
Sources
- Katherine Hyde, JD, Coppersmith Brockelman, Phoenix. Telephone: (602) 381-5471. Email: [email protected].
- E. Bahati Mutisya, JD, Baker Donelson, Raleigh, NC. Telephone: (984) 844-7916. Email: [email protected].
- Claire O’Brien, JD, Brooks Pierce, Greensboro, NC. Telephone: (336) 271-3141. Email: [email protected].
- Melissa Soliz, JD, Coppersmith Brockelman, Phoenix. Telephone: (602) 381-5484. Email: [email protected].
Health and Human Services recently made changes to the confidentiality of substance use disorder records, providing that Part 2 violations now will be subject to both criminal and civil penalties.
You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content