On February 16, 2024, the U.S. Department of Health and Human Services (HHS), through the Substance Abuse and Mental Health Services Administration (SAMHSA) and the Office for Civil Rights (OCR), published a Final Rule modifying 42 CFR Part 2. These regulations govern the confidentiality of Substance Use Disorder (SUD) patient records. This significant update aligns certain aspects of Part 2 with the Health Insurance Portability and Accountability Act (HIPAA), as directed by the CARES Act.
Understanding the Final Rule
While compliance with the new Part 2 requirements is not mandatory until February 16, 2026, organizations can voluntarily adopt the new standards immediately. This presents an opportunity to enhance the secure and efficient exchange of Part 2-protected information across networks.
Key changes include:
- TPO Consent: Patients can now provide a single, broad consent for the use and disclosure of their Part 2 records for treatment, payment, and healthcare operations (TPO), eliminating the need for multiple consents.
- Re-disclosure Flexibility: HIPAA-covered entities and business associates that receive Part 2 records under a TPO Consent may redisclose those records in accordance with HIPAA.
- Public Health Disclosures: Part 2 records can be disclosed without patient consent to public health authorities, provided that the records are de-identified in compliance with HIPAA standards.
- No Segmentation Requirement: The rule states that segregating or segmenting Part 2 records from other health records is not required.
- Aligned Patient Notice Requirements: The Part 2 Patient Notice requirements now align with HIPAA’s Notice of Privacy Practices (NPP).
- Breach Notification Obligations: The Final Rule introduces direct breach notification obligations when Part 2-protected information is improperly used or disclosed.
Leveraging New Opportunities
These modifications create new opportunities for more streamlined and effective information sharing, improving care coordination while maintaining patient confidentiality protections. By effectively utilizing the new opportunities presented by the 42 CFR Part 2 Final Rule, healthcare organizations can significantly improve care coordination and treatment outcomes for patients with SUD within their networks. Organizations should begin preparing now by:
- Updating Policies and Procedures: Align internal policies and procedures with the new Part 2 requirements.
- Implementing TPO Consent Workflows: Simplify information sharing by adopting TPO Consent workflows.
- Ensuring Compliance with Breach Notification Obligations: Address the new breach notification requirements to maintain compliance.
- Educating Staff: Train employees on the changes to disclosure and redisclosure under Part 2 to ensure smooth implementation.
Join Our Webinar The 42 CFR Part 2 Final Rule: Key updates and Organization Compliance
To help organizations navigate these changes, we are hosting a webinar on February 25th, featuring experts Jennifer D’Angelo and Helen. They will provide insights and answer questions about how to best prepare for and take advantage of these new opportunities.
Date: February 25th
Speakers: Jennifer D’Angelo and Helen Helen Oscislawski
Register Here Understanding the 42 CFR Part 2 Final Rule and Leveraging New Opportunities
We look forward to your participation!