Since the passage of the Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”) in 2020, the recently published Final Rule, “Confidentiality of Substance Use Disorder (SUD) Patient Records,” has been long awaited. The changes to 42 CFR Part 2 regulations (“Part 2”) create alignment with HIPAA and make substantial connections to consumer coordination of care, the national goals of data interoperability, and a culture of information sharing. At Qualifacts, we are energized to welcome the Part 2 rule changes and appreciate the time afforded by the U.S. Department of Health and Human Services (“DHHS”) to allow those agencies subjected to 42 CFR Part 2 time to absorb these changes and the culture shift this rule may produce. Agencies are considered ‘Part 2’ providers if they are federally assisted program that ‘holds itself out’ as providing substance use disorder diagnosis, treatment, or referral for treatment for a substance use disorder.

“It is an exciting time in Healthcare Compliance as we watch policy from multiple government agencies become more closely aligned. From The Office of the National Coordinator, Centers for Medicare and Medicaid Services, to the Department of Human Services’ Office of Civil Rights, the spirit of consumer voice and choice and nationwide interoperability are driving alignment and ultimately improving access and receipt of quality care for healthcare and behavioral healthcare consumers,” says Hope Winkowski, VP of Product Compliance at Qualifacts.

Effective Date and Compliance Date

The Final Rule was published in the Federal Register on February 16, 2024.

• The effective date of this Final Rule is April 16, 2024.
• The documented compliance date for the revised Part 2, requiring those subject to the regulation to comply with the requirements, is February 16, 2026.

The authors of the Final Rule, DHHS, provide additional insight into the gap between effective and compliance dates to ”strike the right balance between incentivizing entities to come into compliance in a timely fashion and granting them sufficient time to adjust policies, procedures, and, in some cases, technology to support new or revised regulations.”

2024 Final Rule Overview: Revisions to Part 2

• Consent to Disclose Information
  • The changes in the Final Rule are two-fold. First, they align a single consent for all disclosures and future uses of the data for “treatment, payment, and health care operations.” Second, redisclosure of records follows HIPAA regulations for any covered entity that receives data under the single consent. Please note that Part 2 information may not be disclosed in legal proceedings with separate patient consent, or a court order accompanied by a subpoena. See § 2.61; Preamble Guidance. Each disclosure of a patient’s record must be accompanied by a copy of the consent or an explanation of the scope of the consent. See § 2.32; Preamble Guidance. While challenging to operationalize, it is important for agencies and consumers to understand.
  • DHHS further notes in its Fact Sheet that it ”permits disclosure of records without patient consent to public health authorities, provided that the records disclosed are de-identified according to the standards established in the HIPAA Privacy Rule.”

• Accounting of Disclosures
  • Aligning again with HIPAA redisclosures, the consumer has the right to an ”accounting of disclosures of part 2 records made with written consent for up to three years prior to the date the accounting is requested.” (Final Rule)
  • A separate redisclosure provision applies to disclosures made through an EHR for ”TPO purposes” (treatment, payment, and health care operations). This provision’s (§ 2.25) compliance date will occur when 45 CFR 164.528 (HIPAA Accounting of Disclosures) is revised to reflect TPO disclosures through an EHR.

• Noncompliance, Penalties, and Breach Notifications 
  • A Patient’s right to file Complaints of Noncompliance are a new addition to Part 2 and fulfill three separate goals.

1. 1. 1. establish a process to receive complaints in the same manner as under 45 CFR 160.306,
      2. prohibit Part 2 programs from taking any adverse action against consumers who file complaints, and
      3. prohibit Part 2 programs from requiring consumers to waive their right to file a complaint as a condition of ”providing treatment, enrollment, payment, or eligibility for services.”

• • Part 2 will align with the penalty provisions of HIPAA, replacing the current Part 2 criminal penalties with the civil and criminal enforcement authorities to HIPAA violations as defined in 42 USC 1320d–5 and d-6.
  • The exact Breach Notification Rule requirements in HIPAA will also apply to Part 2 records. (42 USC 17932)

• SUD Counseling Notes
  • New in the Final Rule is the creation of “SUD Counseling Notes.”
  • DHHS provides this insight: ”We believe the final definition of “SUD counseling notes” will ease compliance burdens for part 2 programs because the definition almost exactly matches the definition of “psychotherapy notes” under the HIPAA Privacy Rule except for the references to SUD professionals and SUD notes.” (Final Rule)

• Segregation of Part 2 Data 
  • DHHS makes a special notation in its Fact Sheet on removing the segregation of Part 2 data. The Final Rule ”adds an express statement that segregating or segmenting Part 2 records is not required.”

• Modification to “Qualified Service Organization” Definition to include a person who meets the definition of a business associate under HIPAA of a Part 2 program that is also a covered entity.

This overview only includes some of the revisions to Part 2. Qualifacts encourages you to review the Fact Sheet provided by DHHS and the Final Rule directly for further understanding and review against your current policies and practices.

All of us at Qualifacts look forward to the evolving regulatory landscape with these Part 2 changes and OCR’s plan to align the HIPAA Notice of Privacy Practices. This period between 2024 effective and 2026 compliance dates provides an opportunity to explore and implement changes thoughtfully in your workflows and policies. These regulatory steps toward consumers’ coordination of care, national goals of data interoperability, and a culture of information sharing are welcome revisions across the behavioral healthcare and substance use landscape.