The U.S. Department of Health and Human Services (HHS) recently released a final rule further amending 42 CFR Part 2 regulations (Part 2) to allow greater sharing of patient records related to substance use disorder (SUD) treatment. For the past few years, we have seen a push to better align the incredibly strict requirements of Part 2 with HIPAA in order to increase care coordination and promote patient outcomes, particularly in light of the opioid epidemic, which has unfortunately escalated during the COVID-19 pandemic.   HHS has been inching toward the harmonization of Part 2 with HIPAA and has now adopted a final rule to address some of the confusion caused by differences between the two regulatory schemes. In conjunction with the release of the final rule, HHS also issued a helpful fact sheet explaining the major changes.

The new rule does not change some of the fundamental aspects of Part 2. The regulations still prohibit law enforcement from using SUD records in criminal prosecutions without a court order.  In addition, patient consent is still required before a Part 2 provider may disclose SUD records, with limited exceptions.

The final rule does, however, make the following key changes:

• Disclosure for Payment and Health Care Operations: The final rule adds a list of 18 activities that qualify as “payment and health care operations,” for which providers may disclose Part 2 records after obtaining patient consent. The list specifically includes care coordination and care management in order to encourage such activities.

• Patient Consent: The final rule allows the patient to provide consent for disclosure of their Part 2 records to an entity, versus a specific person. Previously, the patient’s consent had to include a specific person to whom the disclosure would be made, which could be very difficult in certain situations and prevent the patient from receiving other resources or benefits.

• Disclosure by Non-Part 2 Providers: For providers that are not covered by Part 2, the final rule explicitly states that treatment records created by these providers are not subject to Part 2 and therefore are not subject to Part 2’s restrictions on disclosure, provided that Part 2 covered records are not incorporated into those other treatment records. This change is intended to encourage care coordination by non-Part 2 providers.  

• Disclosures for Research: The final rule permits HIPAA covered entities or business associates to disclose Part 2 protected information in connection with human subject research.  This change is intended to streamline overlapping requirements under Part 2, HIPAA, and federal human subject protection regulations (the Common Rule).

Part 2 remains a difficult area for providers, but the final rule inches closer to harmonization between Part 2 and HIPAA and does make progress in balancing both patient privacy and the need for better care coordination.