Amid the ongoing proliferation of headlines about the mental health crisis in the United States, of which substance use disorder is a large part, the recent issuance by the U.S. Department of Health and Human Services (HHS) of proposed changes to the Confidentiality of Substance Use Disorder Patient Records under 42 CFR part 2 (Part 2) brings hope for improved care delivery to those struggling with addiction. Part 2 has long prohibited many of the uses and disclosures of a patient’s substance use disorder treatment records that are permitted to be made of protected health information under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This dual scheme has created data sharing headaches for HIPAA covered entities and business associates who also handle Part 2 information.

The differences between Part 2 and HIPAA traditionally have been deemed necessary to protect patients seeking treatment for substance use disorders from uses and disclosures of their information that could result in illegal discrimination in housing or employment, or in criminal prosecution, based upon their disease. The mental health crisis, along with the ever-evolving landscape of value-based reimbursement models that have, at their core, effective coordination of care and whole-patient treatment, prompted Congress to include in the Coronavirus Aid, Relief, and Economic Security Act provisions to lessen the regulatory burdens of Part 2 so that providers may offer more effective treatment and patients may receive more support in their recovery journeys. These proposed changes promise welcome solutions to break down barriers to effective care delivery, lessen the stigma associated with substance use disorders, and relieve regulated providers and entities of dual obligations and compliance challenges while holding those who disregard such patients’ privacy accountable.

Valued based care models recognize the importance of caring for the whole patient across the care continuum. In order to do so, it is critical for providers to be able to access and share data regarding mental health services and other factors that have traditionally been kept siloed, such as social determinants of health. Providers increasingly understand the importance of incorporating behavioral health into primary care and screening for and providing solutions to social factors that impact health, and an individual’s substance use disorder is a key factor in addressing overall health.

HHS’s proposed rule would make several changes to improve care and support of patients, while reducing stigma and holding violators accountable, by:

• Permitting use and disclosure of Part 2 records based on a single patient consent given once for all future uses and disclosures for purposes of treatment, payment, and health care operations.

• Permitting (with some exceptions) redisclosure of Part 2 records in any manner permitted by the HIPAA Privacy Rule.

• Affording new patient rights under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures of their Part 2 records, such as for self-pay services.

• Expanding the prohibitions on the use and disclosure of Part 2 records in civil and criminal proceedings.

• Providing new HHS enforcement authority for violations of Part 2, as well as new civil monetary penalties for violations.

• Updating breach notification requirements to HHS and affected patients.

• Updating HIPAA Privacy Rule Notice of Privacy Practices requirements to address uses and disclosures of Part 2 records and individual rights with respect to those records.

Comments to the proposed rule are due Jan. 31, 2023. Although the changes, if finalized, would not require compliance for a couple of years, these proposals bring a welcome sign of hope to both providers and patients that barriers and stigmas will continue to fade.

Christine Burke Worthen also contributed to this article.