Our Health Care team is actively reviewing and staying updated on the latest developments and information regarding the Final Rule concerning Part 2. Below is a brief overview of the key points.
The Department of Health and Human Services (HHS) and the Substance Abuse and Mental Health Services Administration (SAMHSA) just released a major Final Rule for SUD facilities that are subject to 42 CFR Part 2 (link). The Final Rule includes the following highlights:
- Patient Consent: Permits a one-time consent for future uses/disclosures for treatment, payment, and healthcare operations. HIPAA covered entities and their business associates that receive records under this consent can redisclose records in accordance with HIPAA regulations.
- Public Health: Allows disclosure to public health authorities without patient consent for de-identified record.
- Legal Proceedings: Restricts the use of Part 2 records in legal proceedings without patient consent or a court order.
- Penalties: Replaces criminal penalties under Part 2 with HIPAA's civil and criminal enforcement mechanisms.
- Breach Notification: Extends HIPAA Breach Notification Rule requirements to Part 2 record breaches.
- Patient Notice: Aligns Part 2 patient notification requirements with HIPAA's Notice of Privacy Practices.
- Safe Harbor: Introduces protections against liability for investigative agencies that use reasonable diligence to determine if a provider is covered by Part 2 before demanding records.
- Segregation of Part 2 Data: Clarifies that segregation of Part 2 records is not mandated.
- Complaints: Establishes the right to file complaints about Part 2 violations directly with the Secretary of HHS.
- SUD Counseling Notes: Defines and sets consent requirements for SUD counseling notes, with protections similar to those for psychotherapy notes under HIPAA.
- Patient Consent Enhancements: Prohibits combining consents for legal proceedings with other consents, requires separate consent for SUD counseling notes, and requires that each disclosure made with patient consent include a copy of the consent or a clear explanation of the scope of the consent.
- Fundraising: Allows patients to opt out of fundraising communications.
The compliance date for the Final Rule is February 16, 2026. OMW will provide further updates with additional details about the Final Rule.
