Health Care Alert: HHS Finalizes Changes to Part 2 to Align with HIPAA

On February 8, 2024, the U.S. Department of Health & Human Services, through the Substance Abuse and Mental Health Services Administration (together, HHS), issued a Final Rule, amending the Confidentiality of Substance Use Disorder Patient Records regulations under 42 CFR part 2 (Part 2).

Part 2 applies to federally assisted programs providing substance abuse disorder (SUD) treatment (Part 2 Programs) and protects patient information, including identity, diagnosis, prognosis, and treatment. These confidentiality protections were implemented to encourage patients to seek SUD treatment without fear of facing discrimination or prosecution.

The Final Rule aligns Part 2 with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act and implements requirements of section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act.

Implications for Part 2 Programs and HIPAA-Regulated Entities

Part 2 Programs and HIPAA-regulated entities will find that the Final Rule will accelerate the exchange of patient information. However, the new enforcement mechanisms may pose greater risks to organizations that create or exchange patient SUD records.

Part 2 Key Changes

TPO Consent

Previously under Part 2, general patient consent for disclosure was prohibited. Patient consent was required for each disclosure of SUD records, accompanied by a detailed description of the purpose of the disclosure. Under the Final Rule, general consent is permissible. Patients can execute a single consent form that covers all future disclosure of SUD records for treatment, payment, and healthcare operations (TPO). The general consent for TPO is effective unless or until the patient revokes it.

Redisclosure

The Final Rule allows covered entities or business associates that receive SUD records under TPO consent to redisclose the records in accordance with HIPAA. Part 2 Programs that are not covered entities are permitted to redisclose SUD records in accordance with the scope of consent.

Prohibitions on Use and Disclosure

The Final Rule expands certain prohibitions on the use and disclosure of SUD records in civil, criminal, and administrative proceedings against a patient.

Notice Requirements

Notice requirements under Part 2 are now aligned with those under HIPAA. The Final Rule includes additional notice requirements, including notification of the patient’s right to request an accounting of disclosures. Additionally, the provisions of the Final Rule regarding notification of a breach of unsecured SUD records is analogous to the breach notification rule under HIPAA.

Segregation of Data

It is important to note that each disclosure made with patient consent must include a copy of the consent form or a precise explanation of the scope of consent. Although segregating data in Part 2 records is not required, HHS asserts that organizations will have to use some method of ensuring that records are disclosed according to patients’ scope of consent.

Penalties and Enforcement

Of particular importance to Part 2 Programs and HIPAA-regulated entities are the new enforcement mechanisms under the Final Rule, which establishes both civil and criminal enforcement authority. HHS has yet to designate the specific enforcement agency; however, it is likely the Office for Civil rights (OCR) will enforce civil penalties under Part 2.

Moving Forward

The Final Rule takes effect on April 16, 2024. While a number of modifications to Part 2 under the Final Rule are welcome changes, organizations will need to proceed with caution and review their policies and procedures to ensure compliance with Part 2 by
February 16, 2026.

Brouse McDowell’s Health Care Practice Group continues to monitor anticipated changes to HIPAA. Contact Brouse McDowell’s Health Care attorneys for more guidance on Part 2 compliance.