OCR and SAMHSA Announce Proposed Changes to Federal Confidentiality Regulations for SUD Records


On December 2, 2022, the Department of Health & Human Services (DHHS), Office for Civil Rights (OCR) and Substance Abuse and Mental Health Services Administration (SAMHSA) published a Notice of Proposed Rulemaking in the Federal Register. DHHS proposes to revise certain provisions of 42 C.F.R. Part 2 (the Part 2 Rules), federal regulations that govern the confidentiality of substance use disorder (SUD) patient identifying information and records. The Part 2 Rules currently impose different, and often more stringent, requirements for SUD patient records than HIPAA. This has created dual, and sometimes inconsistent, compliance obligations on affected SUD treatment programs (Part 2 Programs) and other providers who may be subject to both sets of regulations.

Comments to the rule proposal are due no later than January 31, 2023 and may be submitted here by searching for the Docket ID number HHS-OCR-0945-AA16.

Highlights of Proposed Rule

Highlights of the proposed rule include:

  • The effective date of the final rule is proposed to be 60 days after publication, with compliance mandated 22 months later in order to give affected entities time to establish and implement policies and procedures.
  • Part 2 Programs may use and disclose Part 2 records using a single authorization form signed by the patient, for all future uses and disclosures for treatment, payment, and health care operations (TPO) purposes. Although HIPAA does not require an authorization form for TPO uses and disclosures, the Part 2 Rules are more stringent. Permitting Part 2 Programs to use a single authorization form for such purposes will reduce administrative burdens on such providers.
  • With certain exceptions, Part 2 records may be redisclosed by recipients that are Part 2 Providers, HIPAA covered entities, and business associates, as permitted by the HIPAA Privacy Rule.
  • Part 2 Programs must establish a process to receive complaints of violations of the Part 2 Rules, and may not take adverse action against patients who file complaints.
  • On a related note, Part 2 Programs must not require patients to waive the right to file a complaint as a condition of providing treatment, enrollment, payment, or eligibility for services.
  • Two additional patient rights will be created—the right to an accounting of disclosures and the right to request restrictions on disclosures for TPO—to better align the Part 2 Rules with HIPAA.
  • Part 2 Programs must modify the confidentiality notice currently required by the Part 2 Rules to align the notice with the HIPAA Notice of Privacy Practices.

    • Similarly, covered entities subject to HIPAA who receive Part 2 records must modify their HIPAA Notice of Privacy Practices to include a provision limiting re-disclosure of Part 2 records for legal proceedings in accordance with the standards set forth in the Part 2 Rules. Policies and procedures, likewise, will need to be amended accordingly.
  • The standards of the HITECH Act and the HIPAA Breach Notification Rule will be applied to breaches of Part 2 records by Part 2 Programs. Currently, the Part 2 Rules do not address procedures relating to breaches of patient information.
  • Civil and criminal penalties under HIPAA and the HITECH Act would be applied to violations of the Part 2 Rules. Currently, the Part 2 Rules provide for criminal, but not civil, money penalties. 
A Long-Needed Alignment, But…

Although the underlying rationale for the Part 2 Rules— to encourage individuals to enter into treatment and to protect those seeking or receiving SUD treatment against discrimination and fear of prosecution—is laudable, affected health care providers have been challenged and administratively taxed to maintain processes to comply with both sets of regulations. This is particularly the case for Part 2 Programs. Providers have been further challenged and burdened by various state confidentiality laws that impose different or additional restrictions and obligations beyond the Part 2 Rules and HIPAA.
The better alignment of the Part 2 Rules with HIPAA will be a welcomed change to affected providers. However, reduction in administrative burdens is a light at the end of a very long tunnel. We are awaiting final regulations revising HIPAA. DHHS published a Notice of Proposed Rulemaking in the January 21, 2021 Federal Register containing proposals to revise HIPAA in a number of ways; comments were due by March 22, 2021. On March 9, 2021, the OCR announced a 45-day extension of the public comment period to May 6, 2021, which was published in the Federal Register on March 10, 2021. The final rule is still pending.

In the meantime, covered entities and business associates must endeavor to enhance their privacy and security programs to maintain strong compliance and attempt to keep ahead of the seemingly endless barrage of threats from cyber-criminals. This includes consideration of implementing “recognized security practices” in order to take advantage of the potential reduction of fines and penalties associated with a data breach. See our November 2022 Health Law Update for our discussion of this topic.
For more information or assistance with your HIPAA privacy and security program, contact:
Lani M. Dornfeld, CHPC (Certified in Healthcare Privacy Compliance), Member, Healthcare Law, at 973-403-3136 or ldornfeld@bracheichler.com

About Brach Eichler LLC

Brach Eichler LLC is a full-service law firm based in Roseland, NJ. With over 80 attorneys, the firm is focused in the following practice areas: Healthcare Law; Real Estate; Litigation; Trusts and Estates; Corporate Transactions & Financial Services; Personal Injury; Criminal Defense and Government Investigations; Labor and Employment; Environmental and Land Use; Family Law; Patent, Intellectual Property & Information Technology; Real Estate Tax Appeals; Tax; and Cannabis Law. Brach Eichler attorneys have been recognized by clients and peers alike in The Best Lawyers in America©, Chambers USA, and New Jersey Super Lawyers. For more information, visit www.bracheichler.com.

This alert is intended for informational and discussion purposes only. The information contained in this alert is not intended to provide, and does not constitute legal advice or establish the attorney/client relationship by way of any information contained herein. Brach Eichler LLC does not guarantee the accuracy, completeness, usefulness or adequacy of any information contained herein. Readers are advised to consult with a qualified attorney concerning the specifics of a particular situation.

*This is intended to provide general information, not legal advice. Please contact the authors if you need specific advice.

Related Practices:   Healthcare Law

Related Attorney:   Lani M. Dornfeld