On February 8, 2024, the U.S. Department of Health and Human Services (“HHS”) announced a final rule modifying current confidentiality restrictions of Substance Use Disorder Patient Records, also known as Part 2 records or Part 2 data, at 42 CFR Part 2. The change implements confidentiality provisions passed in 2020 as part of the Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”). The CARES Act mandated that HHS align Part 2 regulations with certain aspects of the HIPAA Privacy, Breach Notification, and Enforcement Rules.

42 CFR Part 2 is a set of federal regulations that provide for the confidentiality of Substance Use Disorder (SUD) treatment records. These protections are designed to reduce stigma and prevent discrimination by limiting how and when SUD records may be shared. 42 CFR Part 2 applies to “Part 2 programs” and to lawful holders of Part 2 data, such as third-party payers and contractors, or those who may receive Part 2 data with written patient consent.

The final rule makes several changes to Part 2, including the following:

• Permits a Part 2 program to obtain and use a single consent for all future uses and disclosures of Part 2 records when the disclosure is for treatment, payment, and health care operations purposes, as permitted by HIPAA;
• Part 2 records may be disclosed without patient consent to Public Health Authorities, provided that the records are de-identified in accordance with the HIPAA Privacy Rule;
• Records can only be used for civil, criminal, administrative, and legislative proceedings against patients with a specific patient consent or a court order;
• Eliminates a strict requirement to segregate Part 2 data from other health records once a patient provides a single consent for use and disclosure of Part 2 records for treatment, payment, or healthcare operations;
• Adopts protection for SUD clinician notes documenting or analyzing a conversation separately from the rest of the patient’s SUD treatment and medical record. An individual must provide specific consent for disclosure of these notes, and consent cannot be based on a broad consent to disclose records for treatment, payment, and healthcare operation purposes;
• Applies the same requirements of the HIPAA Breach Notification Rule to breaches of Part 2 records;
• Aligns Part 2 patient notice requirements with HIPAA Notice of Privacy Practices;
• Creates a Safe Harbor provision for investigative agencies who use reasonable diligence to determine if a facility is subject to Part 2 before demanding records as part of an investigation;
• Allows the government to impose Civil Monetary Penalties for violations of the Part 2 rule; and
• Patients may file complaints of violations with the Part 2 program and with the Secretary of HHS

Facilities are expected to comply with this new rule by February 16, 2026. A copy of the final rule may be found here: eCFR :: 42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records

At CyncHealth, we are reviewing and updating our workflows to capture patient consents provided by our participating Part 2 programs in Nebraska. We are also updating our workflows to allow for further use and disclosure of Part 2 records when CyncHealth possesses a patient consent authorizing such future use and disclosure. Participants should verify that a valid patient consent is in place before accessing Part 2 records through the Health Information Exchange (“HIE”), and are expected to comply with all HIPAA and Part 2 standards when accessing data in the HIE. Participating Part 2 facilities will also hear from our account management team to ensure they are aware of the new rule and its implications. Our goal is to ensure facilities can transmit and manage Part 2 data to maintain interoperability and compliance.

If you have questions about the new rule, please feel free to reach out to your Account Manager for more information or simply email accountmanagement@cynchealth.org.

NOTICE: THIS INFORMATION IS FOR GENERAL INFORMATIONAL PURPOSES ONLY. THIS INFORMATION DOES NOT CONSTITUTE LEGAL, ACCOUNTING, TAX, OR OTHER PROFESSIONAL ADVICE, AND DOES NOT CREATE ANY PROFESSIONAL RELATIONSHIP BETWEEN YOU AND CYNCHEALTH OR ANY OF ITS EMPLOYEES. PLEASE CONSULT YOUR OWN LEGAL COUNSEL, ACCOUNTANT, TAX PREPARER, OR OTHER PROFESSIONAL FOR INDIVIDUALIZED GUIDANCE.

About CyncHealth

CyncHealth is a leading health information exchange working to improve health outcomes, save time for providers, and minimize costs across the healthcare system by securely sharing health data with authorized users. The 501(c)(3) nonprofit connects clinical, Centers for Medicare and Medicaid Services (CMS), and medication data with health-related social needs (HRSN) to form a comprehensive healthcare record for Nebraskans, Iowans, and their neighbors. The organization operates with a public/private governance model, bringing together providers, payers, policymakers, and public health and human services to deliver better healthcare experiences.