HHS Finalizes Significant Modifications Aligning Part 2 Regulations with HIPAA

On February 16, 2024, the U.S. Department of Health and Human Services (“HHS”) published a final rule (“Final Rule”) in the Federal Register modifying regulations at 42 C.F.R. part 2 (“Part 2”) governing the confidentiality of substance use disorder (“SUD”) records. The changes, which largely finalize those proposed in a notice of proposed rulemaking (“NPRM”), are intended to implement section 3221 of the Coronavirus Aid, Relief, and Economic Security (“CARES”) Act and more closely align Part 2 with privacy rules under the Health Insurance Portability and Accountability Act (“HIPAA”). Ultimately, the much-anticipated Final Rule relaxes some of Part 2’s very stringent requirements, which have historically limited the ability to include SUD data in electronic health information exchange and care coordination efforts. However, there may be more enforcement of Part 2 now that there can be civil enforcement that aligns with HIPAA. Compliance with the Final Rule is required by February 16, 2026.

1. Key Provisions of the Final Rule

   The Final Rule’s most significant changes are related to consent to use, disclose, and redisclose Part 2 records. Under the Final Rule, these rules have been relaxed and aligned more closely with HIPAA, particularly with respect to uses and disclosures for treatment, payment, and health care operations (“TPO”). These and other impactful changes in the Final Rule are summarized below.

   1. 1. Consent for Use, Disclosure, and Redisclosure

         Under the Final Rule, a patient may now provide a single consent for all future uses and disclosures for TPO, pursuant to which a Part 2 program, covered entity, or business associate may use and disclose the patient’s Part 2 records for TPO as permitted under HIPAA. The Final Rule also allows a Part 2 program to condition a patient’s treatment on the patient signing such a general consent for TPO (though treatment may not be conditioned on consent for a use or disclosure of SUD counseling notes, which are subject to more stringent requirements).
         
         The Final Rule also relaxes Part 2’s redisclosure requirements, which had previously prohibited redisclosing Part 2 records unless the patient specifically consents to redisclosure or an exception applies. Under the Final Rule, the following redisclosure rules apply to those who receive Part 2 records pursuant to patient consent:
         
         • When Part 2 records are disclosed for TPO to a covered entity or business associate, the recipient may further disclose those records in accordance with HIPAA, except for uses and disclosures for civil, criminal, administrative, and legislative proceedings against the patient.
         • When Part 2 records are disclosed with consent given once for all future TPO to a Part 2 program that is not a covered entity or business associate, the recipient may further disclose those records consistent with the consent.
         • When Part 2 records are disclosed for payment or health care operations activities to a lawful holder that is not a covered entity or business associate, the recipient may further disclose those records as may be necessary for its contractors, subcontractors, or legal representatives to carry out the payment or health care operations specified in the consent on behalf of such lawful holder.
           
           
         These relaxed redisclosure rules only apply to the recipient of Part 2 records. As such, a Part 2 program that obtains patient consent for TPO is limited to using or disclosing Part 2 records for TPO in accordance with the consent.
         
         In addition, the Final Rule creates a subset of Part 2 records called “SUD counseling notes,” which are defined as notes recorded by a Part 2 program who is a SUD or mental health professional documenting or analyzing the contents of conversation during a SUD counseling session and that are separated from the rest of the patient’s SUD and medical record. SUD counseling notes are subject to more stringent requirements under the Final Rule and, with limited exceptions, any use or disclosure of SUD counseling notes generally requires separate written consent.
         
         

      2. Enforcement and Penalties

         Previously, Part 2 violators were subject only to potential criminal penalties and enforcement by the Department of Justice (“DOJ”). The Final Rule aligns Part 2’s enforcement framework with that of HIPAA so that violators of Part 2 will now be subject to the same potential civil and criminal penalties as covered entities and business associates for HIPAA violations. The same mitigating factors and consideration of level of culpability will apply to Part 2 enforcement as well. The Secretary of HHS has enforcement authority for civil penalties and will identify the enforcing agency before the compliance date of the Final Rule. DOJ will continue to have enforcement authority for criminal penalties and state attorneys general may bring civil suits on behalf of state residents.
         
         The new process for Part 2 investigations and enforcement actions is likely to be very similar to that for HIPAA, which is primarily based on the findings of investigations initiated in response to complaints and reported breaches. Overall, these changes are likely to lead to more enforcement activity, which until now has been non-existent.
         
         

      3. Breach Notification
         

         The Final Rule makes the HIPAA Breach Notification Rule applicable to Part 2 programs that experience breaches of unsecured Part 2 records. As such, the provisions of the HIPAA Breach Notification Rule now apply to Part 2 programs in the same manner as they apply to covered entities with respect to breaches of unsecured protected health information.
         
         

      4. Individual Rights and Notices
         

         The Final Rule expressly provides patients with various rights similar to those that individuals have under HIPAA:
         • Complaints. Part 2 now provides patients the right to file complaints directly with the Secretary of HHS for violations of Part 2 by Part 2 programs, covered entities, business associates, QSOs, and other lawful holders.
         • Notice. The Final Rule requires Part 2 programs to provide patients with a notice of their rights and the Part 2 program’s privacy practices.
         • Accounting of disclosures. Part 2 programs and intermediaries are required to provide patients with an accounting of certain disclosures made in the last three years.
         • Privacy protection. Part 2 now provides patients the right to request that a Part 2 program restrict its uses and disclosures of their Part 2 records for TPO, including when patients have provided consent for such disclosures.
         • Fundraising. The Final Rule provides patients of a Part 2 program the right to opt out of receiving fundraising communications.
           
           

      5. Health Information Exchanges and Intermediaries

         Health information exchanges (“HIEs”) and other entities that receive a patient’s Part 2 records to disclose them to member participants who have a treating provider relationship with the patient have traditionally been considered “intermediaries” under Part 2, which are subject to special requirements, including specific consent requirements. The definition of intermediary finalized in the Final Rule excludes Part 2 programs, covered entities, and business associates, including HIEs that are business associates. As such, when a covered entity discloses Part 2 records to an HIE that is a business associate, Part 2’s intermediary-specific requirements no longer apply and the HIE has increased flexibility to redisclose Part 2 records.
         
         

      6. Other Changes

         Other notable modifications in the Final Rule are highlighted below:
      • Definition of “lawful holder.” The Final Rule expressly defines the term to mean a person who is bound by Part 2 because they have received records as the result of written consent or a Part 2 exception.
      • Segregation. The Final Rule expressly provides that a Part 2 program, covered entity, or business associate that receives Part 2 records based on a single consent for all TPO is not required to segregate or segment such records.
      • De-identification. The Final Rule incorporates HIPAA’s de-identification standard such that any de-identification of Part 2 records must be in accordance with HIPAA’s Safe Harbor method or Expert Determination method, and there must be no reasonable basis to believe that the information can be used to identify a patient.
      • Safe harbor for investigative agencies. The Final Rule provides a safe harbor shielding investigative agencies and those acting on their behalf from liability for Part 2 violations when they act with reasonable diligence.
      • Required disclosure to the Secretary. Under the Final Rule, disclosure of Part 2 records is not only permitted, but is required when the Secretary of HHS requires disclosure of such records to investigate or determine a person’s compliance with Part 2.
        
        

2. Takeaways and Next Steps

   Overall, the Final Rule implements section 3221 of the CARES Act by relaxing Part 2’s historically stringent rules applicable to certain SUD-related information and aligning the Part 2 framework more closely with HIPAA. The changes in the Final Rule are likely to help reduce the burden on health care organizations and enhance care coordination and comprehensive care by facilitating access to SUD-related information that has traditionally been siloed and subject to extremely stringent limitations. The Final Rule is likely to impact health care organizations of all types as even organizations that do not provide SUD-related services often receive Part 2 records and become lawful holders subject to certain Part 2 rules.
   
   Organizations should carefully review and update various materials, including agreements, policies and procedures, training resources, consent forms, patient notices, and breach notification letters to make sure they remain consistent with the significant modifications codified through the Final Rule. Please reach out to the attorneys listed below or your regular Crowell contact if you have questions.