On February 16, 2024, the U.S. Department of Health and Human Services (“HHS”) published a final rule to amend the Confidentiality of Substance Use Disorder (“SUD”) Patient Records regulations (“Part 2”) to more closely align Part 2 with the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations (collectively, “HIPAA”) as required by Section 3221 of the 2020 Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”).  We previously covered the proposed rule (hereinafter, “the NPRM”), which was issued on December 2, 2022.

The final rule, issued through the Office for Civil Rights (“OCR”) and the Substance Abuse and Mental Health Services Administration (“SAMHSA”), increases alignment between certain Part 2 requirements and HIPAA and it clarifies certain existing Part 2 permissions and restrictions to improve the ability of entities to use and disclose Part 2 records. According to HHS, this final rule will decrease burdens on patients and providers, improve coordination of care and access to care and treatment, and protect the confidentiality of treatment records.

Key provisions of the final rule include:

  • Patient Consent: The final rule allows a single Part 2-compliant consent to suffice for all future uses and disclosures for treatment, payment, and health care operations (as defined under HIPAA) (“TPO”). It also permits HIPAA covered entities and business associates that receive records under this consent to redisclose the records in accordance with HIPAA except in legal proceedings against the patient.

The final rule implements other requirements for a patient consent. Among other things, it prohibits combining a patient’s consent for the use and disclosure of Part 2 records for civil, criminal, administrative, or legislative proceedings with consent for any other use or disclosure. The final rule also requires that each disclosure made with patient consent include a copy of the consent or a clear explanation of the scope of the consent.

  • SUD Counseling Notes: The final rule creates a new definition for SUD counseling notes and requires specific consent from an individual to use or disclose these notes. This definition and heightened protection are meant to mirror HIPAA protections for psychotherapy notes.
  • No Requirement to Segregate of Part 2 Data: The final rule adds an express statement that Part 2 programs, covered entities, and business associates that receive patient records based on a single patient consent for TPO are not required to segregate or segment those records.
  • Public Health Disclosures: The final rule permits disclosure to public health authorities without patient consent, provided that the records are first de-identified in accordance with HIPAA.
  • Breach Notification: The final rule aligns the notification requirements for breaches of records by Part 2 programs with the HIPAA Breach Notification Rule.
  • Patient Rights: The final rule provides patients with additional rights similar to those under HIPAA. Specifically, a patient has the rights to (i) file a complaint directly with the Secretary for an alleged violation of Part 2, (ii) obtain an accounting of disclosures, (iii) request certain restrictions of disclosures, and (iv) opt out of receiving fundraising communications.
  • Patient Notice: The final rule modifies Part 2 patient notice requirements to more closely align with those for HIPAA Notice of Privacy Practices.
  • Enforcement: The final rule also replaces the criminal penalties for a violation of Part 2 with the civil and criminal enforcement authorities that apply to HIPAA violations, including civil monetary penalties.

The final rule does not include the CARES Act antidiscrimination provisions that prohibit the use of patients’ Part 2 records against them; HHS will implement these provisions in a separate rulemaking. An upcoming final rule from OCR will finalize certain changes to the HIPAA Privacy Rule to address uses and disclosures of protected health information that is also protected by Part 2. The rule will become effective on April 16, 2024. Compliance with the rule is required by February 16, 2026.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Anna D. Kraus Anna D. Kraus

Anna Durand Kraus advises on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (“HHS”) gives her broad experience with, and valuable insight into…

Anna Durand Kraus advises on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (“HHS”) gives her broad experience with, and valuable insight into, the programs and issues within the purview of HHS, including Medicare, Medicaid, fraud and abuse, and HIPAA privacy and security. Anna is co-chair of the firm’s Health Care Industry practice group.

Anna regularly advises clients on Medicare reimbursement matters, particularly those arising under Part B and the Part D prescription drug benefit. She also has extensive experience with the Medicaid Drug Rebate program. She assists numerous pharmaceutical and device manufacturers, health care providers, pharmacy benefit managers, and other health care industry stakeholders to navigate the challenges and opportunities presented by the Affordable Care Act.

Anna is a trusted adviser on health information privacy, security and breach notification issues, including those arising under the Health Insurance Portability and Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health (“HITECH”) Act. Her background in this area dates back to the issuance of the original HIPAA privacy regulations.

Anna’s clients depend on her to guide them through compliance with the Anti-Kickback statute, the Stark regulations, and other laws preventing fraud and abuse in the health care industry. Her deep knowledge of these laws has made her an important component of the firm’s representation of pharmaceutical companies and health care organizations under federal investigation or facing allegations under the False Claims Act. In addition, clients contemplating acquisitions in the health care sector rely on her to guide due diligence efforts.

Photo of Elizabeth Brim Elizabeth Brim

Elizabeth Brim is an associate in the firm’s Washington, DC office, where she is a member of the Data Privacy and Cybersecurity and Health Care Practice Groups and advises clients on a broad range of regulatory and compliance issues related to privacy and…

Elizabeth Brim is an associate in the firm’s Washington, DC office, where she is a member of the Data Privacy and Cybersecurity and Health Care Practice Groups and advises clients on a broad range of regulatory and compliance issues related to privacy and health care.

Elizabeth’s practice includes counseling clients on compliance with the complex web of health information privacy laws and regulations, such as HIPAA, the FTC’s Health Breach Notification Rule, and state medical and consumer health privacy laws as well as state consumer privacy and genetic privacy laws. She also advises clients on health care compliance issues, such as fraud and abuse, market access, and pricing and reimbursement activities.

Elizabeth routinely advises on regulatory compliance as part of transactions, clinical trial programs, collaborations and other activities that involve genetic data, and the development and operation of digital health products. As part of her practice, Elizabeth routinely counsels clients on drafting and negotiating privacy and health care terms with vendors and third parties and developing privacy notices and consent forms. In addition, Elizabeth maintains an active pro bono practice.

Elizabeth is an author of the American Health Law Association treatise, Pricing, Market Access, and Reimbursement Principles: Drugs, Biologicals and Medical Devices and the U.S. chapter of the Global Legal Insights treatise, Pricing & Reimbursement Laws and Regulations.