Today, the U.S. Department of Health and Human Services (HHS) Substance Abuse and Mental Health Services Administration released a proposed rule amending the confidentiality of substance use disorder patient records at 42 C.F.R. Part 2. These rules have long been known as being some of the most stringent confidentiality rules with regard to patient health records and generally require patient consent in order to disclose records with another provider. Conversely, HIPAA does not require patient consent in order to disclose records for treatment, payment, or health care operations purposes. The current rules at 42 C.F.R. Part 2 are often a burden for care coordination, population health, and clinical integration efforts.
According to HHS, the proposed rule was prompted by the need to update and modernize the regulations, which have not had a substantive update since 1987. Significant changes in the U.S. health care system – including new models of integrated care supporting care coordination and a new focus on performance measurement – lend themselves to updates that allow patients with substance abuse disorders to participate in and benefit from new care models.
Proposed changes include the following:
-
New and Expanded Definitions. Creation of new definitions, including: (i) referring to “alcohol abuse” and “drug abuse” collectively as “substance abuse disorder” and expanding this definition to cover substance use disorders that can be associated with altered mental status that has the potential to lead to risky and/or socially prohibited behaviors; (ii) creating a definition of “treating provider relationship” to clarify that such relationship is established with the provider’s agreement to undertake diagnosis, evaluation, treatment, or consultation, whether or not there has been an in-person encounter; (iii) clarification that “patient” refers to both current and former patients; and (iv) clarifying the differences between a “program,” “general medical practice,” “general medical facility” regarding “hold[ing] itself out” as providing substance use services (i.e., limiting the applicability of 42 C.F.R. Part 2 to specialized programs).
-
Disclosure of Records. Allowing patients to determine to whom their records are disclosed. The proposed rule allows modification of the consent form (in certain circumstances) to allow a general designation in the “to whom” section (e.g., “my treating providers”). However, all entities who receive such information must be included on the list of disclosures for all disclosures made within the past two years, and the list must be provided to requesting patients within 30 calendar days of the request.
-
Electronic Records. Modernizing the rule to include provisions for governing both paper and electronic patient records, including: (i) clarifying that 42 C.F.R. Part 2 records expressly include electronic records; (ii) requiring standards for sanitizing media and disposing records; (iii) requiring formal policies and procedures to protect against unauthorized uses and disclosures and against reasonably anticipated threats or hazards to the security of patient identifying information; and (iv) modernizing audit and evaluation standards for both paper and electronic records.
-
Medical Emergencies and Research Exceptions. Revising the medical emergencies exception to give providers more discretion to determine when a medical emergency exists. The proposed rule also revised the research exception to allow disclosure for conducting scientific research if the researcher provides documentation of meeting certain human research requirements.
The proposed rule is scheduled for publication on February 9. Stakeholders have 60 days to submit comments on the proposed rule. Once finalized, entities required to comply with 42 C.F.R. Part 2 (i.e., federally assisted substance use disorder programs) would be required to come into compliance with revised regulations by the effective date of the final rule. However, any signed consent forms in place prior to the effective date of the final rule would be valid until they expire.
©2025 von Briesen & Roper, s.c