New HHS Rule Strengthens Confidentiality Protections for Patients with SUD

Substance use disorder (SUD) providers will soon be subject to new, strengthened confidentiality protections. 

The U.S. Department of Health and Human Services (HHS) announced a final rule that modifies patient record regulations to bolster confidentiality requirements and ease the integration of behavioral health information with other medical records. 

The new rule overhauls the confidentiality protections for people who receive treatment for SUD or take part in SUD education, training, rehab or research, which are laid out in the Confidentiality of Substance Use Disorder (SUD) Patient Records at 42 CFR part 2. The protections are better known as “Part 2.”

Part 2 regulations prior to the new modifications were called “out-of-date, arbitrary and confusing” by the American Hospital Association (AHA). 

The bipartisan Coronavirus Aid, Relief, and Economic Security Act (CARES Act) mandated that HHS update Part 2 to better align with standards determined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

“Patient confidentiality is one of the bedrock principals in health care,” Xavier Becerra, HHS secretary, said in a statement. “People who are struggling with substance use disorders must have the same ability to keep their information private as anyone else. This new rule helps to ensure that happens, by strengthening confidentiality protections and improving the integration of behavioral health with other medical records.”

Public comments from entities, including behavioral health providers and SUD advocacy groups, partly informed the modifications in the final rule.

“So long as privacy rules governing the medical records of patients with substance use disorder (SUD) retain significant differences with respect to their handling within the healthcare system, the access, availability, and quality of SUD services will be negatively impacted,” read the comments submitted by the American Society of Addiction Medicine (ASAM) on Jan. 31, 2023. 

Some Part 2 protections will remain in place but the changes made through the final rule were called “major” and “substantive” by HHS.

The following modifications were made with the final rule:

• Separate patient consent is required for the use and disclosure of SUD counseling notes.
• Each disclosure made with patient consent must include a copy of the consent or a clear explanation of the scope of the consent.
• Creates a new definition for an SUD clinician’s notes, similar to HIPAA protections for psychotherapy notes.
• Current part 2 criminal penalties are replaced with the same civil and criminal enforcement authorities that apply to HIPAA violations.
• Patients can agree to all future uses and disclosures for treatment, payment, and health care operations through a single consent.
• HIPAA-covered entities that receive records through a single consent can redisclose them, per HIPAA regulations.
• Records can be disclosed to public health authorities, as long as they are de-identified according to HIPAA standards.
• Records and testimony cannot be used in civil, criminal, administrative and legislative proceedings against patients, without patient consent or a court order.
• Patients will receive the same patient notice requirements as with HIPAA Notice of Privacy Practices.

Those affected by the new rule must comply two years after its official publication, which is scheduled for Feb. 16, 2024.

HHS also plans to implement antidiscrimination provisions laid out in the CARES Act in the future.