SAMHSA Final Rule re: Confidentiality of SUD Patient Records

April 3, 2024

In February 2024, the U.S. Department of Health and Human Services (HHS) issued its final rule regarding modifications to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR Part 2 (commonly known as “Part 2”).  In accordance with the bipartisan Coronavirus Aid, Relief, and Economic Security (CARES) Act, the final rule aims to align Part 2 regulations with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule.

This final rule is effective on April 16, 2024, and the compliance date for this final rule is February 16, 2026. This final rule applies to Part 2 programs, qualified service organizations that perform certain services on behalf of the Part 2 programs, and lawful holders who have received Part 2 protected records.

Specifically, the final rule:

  • Permits use and disclosure of Part 2 records from a single patient consent for all future uses and disclosures for treatment, payment and health care operations purposes, and it permits redisclosure of Part 2 records by HIPAA-covered entities and business associates in accordance with HIPAA. The final rule restricts use of records in legal proceedings against a patient which require separate patient consent or a court order. HHS notes that the Part 2 medical emergency provisions may apply in certain emergency situations that require urgent clinical care in which a patient’s prior written consent cannot feasibly be obtained, in order to provide care and support patient treatment. Finally, the rule permits disclosure of records to public health authorities without patient consent when the records are de-identified, according to the standards established under HIPAA (e.g., an SUD treatment facility shares de-identified data on the number of patients being treated to a statewide public health initiative aimed at tracking the opioid epidemic).
  • Creates a definition for SUD counseling notes that document or analyze a counseling session, similar to psychotherapy notes under HIPAA, which are separated from the rest of the patient’s record, and requires separate consent for the use and disclosure of SUD counseling notes.
  • Provides for a patient’s right to obtain an accounting of disclosures and to request restrictions on certain disclosures, also aligned with HIPAA, and right for patients to opt out of receiving fundraising communications.
  • Aligns Part 2 notice to patients of federal confidentiality requirements with those under HIPAA. The final rule includes requirements that a Part 2 program must include a statement of patients’ rights; ability to make complaints if they believe their privacy rights were violated; descriptions of uses and disclosures that are permitted for treatment, payment, and health care operations purposes; and descriptions of uses and disclosures that are permitted without written consent or will be made with written consent.
  • Outlines HIPAA-aligned breach notification requirements. A breach is the unpermitted acquisition, access, use or disclosure of protected health information that compromises the security or privacy of the protected health information.
  • Establishes HHS enforcement authority, including potential civil monetary penalties for Part 2 violations, aligned with HIPAA.

You can read more in the HHS press release and final rule fact sheet, as well as SAMHSA’s FAQ webpage. The SAMHSA-sponsored Center of Excellence for Protected Health Information provides technical assistance and additional resources on Part 2.  (Source:  National Council)–