Previously published in Healthcare News and Healthcare Michigan.
On February 8, 2024, the Department of Health and Human Services (HHS) finalized revisions to 42 CFR Part 2. Read on to learn more about Part 2, the changes, and helpful practice pointers.
Quick Refresher: What Is Part 2?
42 CFR Part 2 is a set of Federal laws that house the Confidentiality of Alcohol and Drug Abuse Patient Records regulations. Part 2 stringently limits the use and disclosure of patients' substance use and alcohol use disorder records.
Who Needs to Pay Attention to Part 2?
Part 2 applies not only to "Part 2 Programs" but also to any lawful holder of Part 2 data, which can include, as examples, third-party payors and contractors, anyone who receives Part 2 data with the patient's written consent and the required prohibition on redisclosure notice, administrative entities, auditors and evaluators. As a rule of thumb, if you have Part 2 data—whether you created that data or are in receipt of that data— you should assume you are obligated to protect that Part 2 data.
What Is New? A Few Highlights:
- Re-disclosure Allowed as per HIPAA. Part 2 records may now be re-disclosed as permitted by the HIPAA privacy rule, with important caveats for proceedings against a patient that require a court order or specific written consent to re-disclose the materials.
- One Consent for All Future Uses and Disclosures Possibility. A patient may now provide a single consent to use and disclose Part 2 records for treatment, payment, and healthcare operations. This means instead of needing to sign a new consent form for each release of Part 2 records, patients may now choose to sign a single consent form for all future uses and disclosures. A patient may always revoke this consent in full or in part (for future uses or disclosures only).
- Segregation of Part 2 Records Not Required. If a Part 2 program, HIPAA-covered entity, or business associate receives Part 2 records based on a single consent, the recipient entity is "not required to segregate or segment such records." But a word of caution regarding this change: although segmentation is no longer required explicitly, as a practical consideration, any holder of Part 2 records must be able to follow any restrictions a patient has put or may later put in place regarding the records. This means practically that a holder of Part 2 records will still need to be able to segment or identify where each Part 2 record is.
- Valid Consent as per HIPAA. A valid consent to disclose Part 2 data must have all the required elements of a valid HIPAA authorization (see 45 CFR § 164.508).
- Disclosure to Designated Class Allowed. Consent to release Part 2 protected information now allows disclosure to a designated class of recipients, rather than needing to list out each specific recipient one by one.
- New Rights. Patients have new rights under Part 2 to (1) obtain an accounting of disclosures, and (2) request restrictions on some disclosures.
- Expanding Prohibitions. The rules expand the prohibitions on the use or disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings.
- SUD Counseling Notes. "Substance Use Disorder counseling notes" have a new definition that parallels the HIPAA psychotherapy note provisions, which are subject to heightened confidentiality restrictions.
- HIPAA Breach Notification Rules Apply. The HIPAA breach notification requirements now apply to breaches (unauthorized disclosures) of Part 2 data.
- Breach Penalties Will Be Enforced. HHS has new enforcement authority over Part 2 breaches and can now impose civil money penalties in addition to the criminal penalties that were already allowed. This is a very significant change and signals that enforcement may be ramping up in the coming years.
Reminder of What Has Not Changed:
- Re-disclosure Prohibition Notice Requirements Remain. Remember that each and every disclosure made pursuant to a Part 2 consent is still required to include a prohibition on redisclosure notice. The easiest way to fulfill this requirement is including this language: "42 CFR Part 2 prohibits unauthorized use or disclosure of these records." Additionally, each disclosure is required to include either (1) a copy of the patient's written consent or (2) a clear explanation of the scope of the consent provided. See 42 CFR § 2.32. You can instead choose to include a longer paragraph on the prohibition of unauthorized disclosure that is spelled out in 42 CFR § 2.32 (which also contains helpful reminders of what Part 2 specifically prohibits regarding re-disclosure). The longer prohibition on disclosure notice must also be accompanied by either a copy of the patient's written consent or a clear explanation of the scope of the consent provided.
When Did the New Rules Take Effect?
The final rule took effect this April 2024, and compliance is required by mid-February 2026.
Why the Change?
HHS has finalized revisions to Part 2 as mandated under the CARES Act. The revisions aim to bring Part 2 into alignment with HIPAA, and to facilitate SAMHSA's initiative to (1) facilitate care coordination, with the goal of reducing the burdens on Part 2 protected information so patients can get help faster; and (2) to reduce dual compliance obligations for regulated entities.
Helpful Definitions:
- HHS is the Department of Health and Human Services.
- HIPAA is the Health Insurance Portability and Accountability Act of 1996.
- SAMHSA is the Substance Abuse and Mental Health Services Administration.
You can find the commentary and final rule language here.
Related Services:
Behavioral Health Care | Health Care
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.