On February 8, 2024, the U.S. Department of Health and Human Services (HHS), in collaboration with the Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA), announced changes to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 C.F.R. Part 2.
This final rule includes the following key changes:
1. Patients may provide a single patient consent for all future uses and disclosures of patient records for treatment, payment, and healthcare operations.
2. HIPAA covered entities and business associates may re-disclose patient records, except that patient records cannot be used in legal proceedings against the patient without specific consent or court order.
3. Patients have the right to an accounting of disclosures, as well as to restrict certain disclosures, consistent with HIPAA.
4. If there is a breach under 42 C.F.R. Part 2, notice must be given that satisfies the same breach notification requirements under HIPAA.
5. HHS’s enforcement authority now includes the imposition of civil money penalties for violations of 42 C.F.R. Part 2.
The final rule aims to enhance coordination among providers treating patients for SUDs, strengthen confidentiality protections, and improve the integration of behavioral health information with other medical records.
