How HHS SUD confidentiality regulations will impact rural providers
On Feb. 8, the U.S. Department of Health and Human Services (HHS) released the final rule modifying the substance use disorder (SUD) confidentiality regulations under 42 CFR Part 2. The rule implements Section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act, requiring HHS to align certain aspects of Part 2 with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and Health Information Technology for Economic and Clinical Health Act.
The primary aim of the CARES Act was to ease restrictions on the use and disclosure of protected SUD information. The final rule fulfills this purpose with the following changes to Part 2.
1. Consent on use and disclosure: The rule allows a patient to provide single consent for all future uses and disclosures of SUD records, except for SUD counseling notes, for treatment, payment, and health care operations. Each disclosure of SUD records with patient consent must be accompanied by a copy of the patient consent form or a clear explanation of the scope of the patient consent for use or disclosure.
The rule defines SUD counseling notes as clinician notes that analyze conversations in SUD counseling sessions, which the clinician voluntarily maintains separate from the rest of the SUD records. Use and disclosure of SUD counseling notes require specific consent from a patient and cannot be used or disclosed under a broader patient consent in alignment with the use and disclosure provisions in HIPAA for psychotherapy notes.
HIPAA-covered entities and business associates who obtain SUD records with patient consent for treatment, payment, or health care operations may redisclose the records according to standard HIPAA regulations. However, the records still may not be used in legal proceedings without the patient’s specific consent or court order. Patient consent for the use and disclosure of records for civil, criminal, administrative, or legal proceedings may not be combined with patient consent for other uses or disclosure, including those for treatment, payment, and health care operations.
Additionally, SUD records may be disclosed without patient consent to public health authorities, provided that the records are disclosed and de-identified according to HIPAA privacy rules.
2. Complaints: The rule gives patients a right to file a complaint directly with HHS for alleged violations of Part 2.
3. Penalties and safe harbor: The rule updates the penalties for wrongful use and disclosure of SUD records to align with the civil and criminal penalties of HIPAA. Civil penalties under the new rule range from a fine of $25,000 to $1,500,000 during a calendar year. Criminal penalties range from fines between $50,000 to $250,000 and/or imprisonment between one and 10 years.
The rule sets a limit on civil or criminal liability for investigative agencies acting with reasonable diligence to determine whether a provider is subject to Part 2 before demanding records during an investigation. To receive the safe harbor, investigative agencies are required to search for the facility in the Substance Abuse and Mental Health Services Administration database and check the provider’s notice of privacy practices before requesting records to determine whether the provider is subject to Part 2.
4. Notice of privacy practices and breach notification: The rule requires SUD programs to adopt notice of privacy practices that align with HIPAA. Additionally, the rule requires SUD programs to follow the notification requirements of HIPAA in the event of a breach of SUD records.
5. Segregation of SUD records: The new rule expressly provides that segregation of SUD records is no longer required.
6. Fundraising: The rule also creates a right for patients to opt out of receiving fundraising communications from Part 2 programs.
It is well known that rural communities face major barriers in preventing and treating SUDs due to the limited availability of resources. Barriers include a lack of interagency coordination and communication, lack of personnel, insufficient hospital capacity to treat SUDs, transportation barriers, and substandard housing. Additional challenges related to the confidentiality and privacy of substance use treatment are also enhanced due to the close-knit nature of rural communities. Accordingly, it is crucial that rural health providers who fall under the definition of a Part 2 program maintain strict compliance with 42 CFR Part 2.
Despite removing some burden on providers to segregate SUD records and allowing redisclosure from a single patient consent for treatment, payment, and health care operations, the new rules did not clarify what qualifies as a Part 2 program. Specifically, a Part 2 program includes, in part, an individual, entity, or identified unit within a general medical facility that “holds itself out” as providing diagnosis and treatment of SUDs or referral for treatment. Medical personnel or other staff in a general medical facility also fall under the definition of a Part 2 program if their “primary function” is to provide SUD diagnosis, treatment, or referral for treatment.
Rural health providers – in particular rural health clinics and federally qualified health centers – should be careful that they do not inadvertently fall into the definition of a Part 2 program. Activities that could fall under the category of “holding oneself out” include marketing SUD services, routinely providing and billing for SUD services, and providing educational materials in the community on SUD treatment.
Additionally, rural health providers that clearly fall under Part 2 should review and update their related policies and procedures on the use and disclosure of SUD records. Furthermore, Part 2-covered entities should update all patient consent forms and notices of privacy practices to align with the new rule. If an entity has not done so, it should adopt and implement a breach notification policy and procedure that aligns with the requirements of HIPAA. Part 2 programs must comply with the new regulations by April 16, 2026.