Long-Awaited Updates to 42 C.F.R. Part 2 Finalized
On February 8, 2024, the Department of Health and Human Services (HHS) through the Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA) announced a final rule aligning the Confidentiality of Substance Use Disorder Patient Records regulations at 42 C.F.R. Part 2 with HIPAA. The full text of the rule is available here.
Notable revisions to Part 2 include:
- Changes to patient consent requirements.
- Allows a single consent for future uses/disclosures for treatment, payment and healthcare operations.
- Allows disclosure by covered entities and business associates in accordance with HIPAA.
- Disclosure of de-identified records to public health authorities permitted without consent.
- Restrictions on the use of records in proceedings without consent.
- Alignment of Part 2 penalties with HIPAA by replacing criminal penalties currently in Part 2 with civil and criminal enforcement authorities that also apply to HIPAA violations.
- Applicability of HIPAA's breach notification requirements to Part 2 breaches.
- Creation of a safe harbor for investigations to limit liability if reasonable diligence is followed.
Importantly, Part 2's core protections preventing use of records to investigate or prosecute patients without consent remain unchanged.
The final rule is expected to be published on February 16, 2024, after which entities covered by Part 2 will have two years to comply with the new requirements. A more in-depth analysis of these changes, as well as how they will impact SUD providers, is forthcoming. In the meantime, for further information about the new rules, please contact Liam Gruzs, Nikkia Knudsen, or your Vorys attorney.
