HHS Updates Confidentiality Rules for Substance Use Disorder Treatment

New rule seeks to improve coordination of care

February 09, 2024

The federal government has finalized regulations that aim to protect the privacy of patients with substance use disorder, while improving the coordination of their care.

On Thursday, the U.S. Department of Health and Human Services (HHS) and other federal agencies finalized changes to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations. The changes are designed to strengthen patient confidentiality and improve the integration of behavioral health information with other medical records.

The changes were prompted by the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) to bring the privacy of patients’ substance use disorder treatment records—known as Part 2—into closer alignment with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Breach Notification, and enforcement rules.

“People who are struggling with substance use disorders must have the same ability to keep their information private as anyone else,” HHS Secretary Xavier Becerra said in a statement. “This new rule helps to ensure that happens, by strengthening confidentiality protections and improving the integration of behavioral health with other medical records.”

The final rule includes the following modifications:

• Permits use and disclosure of Part 2 records based on a single patient consent given once for all future uses and disclosures for treatment, payment, and health care operations.
• Permits redisclosure of Part 2 records by HIPAA covered entities and business associates in accordance with the HIPAA Privacy Rule, with certain exceptions.
• Provides new rights for patients under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures.
• Expands prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings.
• Provides HHS enforcement authority, including the potential imposition of civil money penalties for violations of Part 2.
• Outlines new breach notification requirements applying to Part 2 records.

“The proposals in this rule would substantially improve hospitals’ and health systems’ ability to provide safer, better coordinated care to patients with substance use disorder through vital information sharing,” Ashley Thompson, American Hospital Association’s senior vice president for public policy analysis and development, said in a statement.

A fact sheet is available online. The final rule will be published February 16.

For questions, contact Jennifer Jordan, vice president, equity and behavioral health.