On March 27, 2020, Congress enacted the Coronavirus Aid, Relief & Economic Security Act (CARES Act) which included provisions requiring the U.S. Department of Health & Human Services (“HHS”) to better align the federal regulations protecting the privacy of substance use disorder records, referred to as “Part 2,” with the HIPAA privacy regulations. HHS finalized these rules earlier this year. Even providers who are not Part 2 covered programs will need to adjust their policies to ensure compliance with the protections afforded to substance use disorder records protected by Part 2. The compliance deadline is February 16, 2026.
Relaxing Consent & Redisclosure Requirements
Among the most welcome changes to the Part 2 regulations are how SUD records may be used and disclosed for treatment, payment, and healthcare operations (“TPO”). Part 2 programs may now use and disclose SUD records for TPO with a single, stand-alone consent signed by the patient which authorizes future uses and disclosures for TPO. The consent requirements also mirror the requirements for a HIPAA compliant patient authorization but are not required to have an expiration date. Because the consent requirement has been relaxed, the rule creates a new subset of Part 2 records – referred to as substance use disorder (SUD) counseling notes – which when segregated from the patient’s medical record are afforded protections similar to psychotherapy notes under HIPAA. SUD counseling notes may only be disclosed with a specific patient consent (and not pursuant to a general TPO consent) or in limited circumstances without consent.
The Part 2 regulations continue to place limitations on how SUD records covered by Part 2 may be redisclosed by the recipient; however, the final rules now allow HIPAA covered entities and their business associates to use and disclose SUD records they receive pursuant to a patient’s written TPO consent as allowed by HIPAA, except for civil, criminal, administrative, and legislative proceedings which require a court order or patient authorization. Lawful holders who are not HIPAA covered entities or business associates may redisclose Part 2 records for payment and healthcare operations to their contractors, subcontractors, and legal representatives as needed to carry out the activities specified in the patient’s consent, but they must have a written contract in place that requires them to comply with Part 2 and to implement appropriate safeguards to prevent unauthorized uses and disclosures and require such recipients to report unauthorized uses, disclosures and breaches of patient identifying information to the lawful holder.
Disclosures of Part 2 records, including pursuant to a patient’s TPO consent and redisclosures by a non-Part 2 program (including covered entities and their business associates) must still be accompanied by a notice notifying the recipient of the protected nature of the record. The rule adds a new requirement to also send a copy of the patient’s written consent or a summary of its scope to the recipient of the SUD records.
Incorporating Patient Rights
Because of the relaxed consent requirements, patients may now request a Part 2 program place restrictions on how their SUD records are used and disclosed for TPO purposes. Although a Part 2 program is not required to agree to the restrictions (with one exception for restrictions to health plans if the patient pays for the service), HHS expects a Part 2 program to make reasonable efforts to accommodate the requested restriction as long as the restriction is feasible. HHS also advises Part 2 programs not to condition treatment on a patient providing written consent for TPO uses and disclosures if it cannot accommodate a patient’s requested restriction.
The new rules also incorporate other patient rights, very similar to those afforded to patients under HIPAA, including the rights to:
- receive a Notice of Privacy Practices,
- be notified of a breach of its unsecured health information,
- file a complaint and not be retaliated against and request an accounting of disclosures made by the Part 2 program pursuant to general consent in the past three years, including TPO disclosures made through an electronic health record.
Notably, the accounting of disclosure right will not go into effect until such time as HIPAA regulations are updated to address the accounting of disclosure through an electronic health record.
Other Important Changes
The final rule also:
- requires Part 2 programs to notify patients they have the right to opt out of fundraising communications;
- adopts the HIPAA de-identification standard;
- expands the types of proceedings where a court order is required to disclose SUD records; and
- adopts HIPAA enforcement framework for Part 2 violations.
On this week’s podcast, we discuss the new rules with particular emphasis on implementation issues for Part 2 programs. Next week we’ll focus on how the Part 2 changes impact healthcare providers who are not Part 2 programs but receive records covered by Part 2. Check out our implementation checklist for Part 2 programs:
You can find resources to previous podcasts here.
