42 CFR Part 2-Substance Use Disorder Record Confidentiality Requirements Updated

42 CFR Part 2-Substance Use Disorder Record Confidentiality Requirements Updated

Since the mid-70s, the confidentiality of patient records created by federally-assisted programs to diagnose or treat substance use disorders have been fiercely protected by federal law (42 U.S.C. § 290dd-2) and regulations (42 C.F.R. Part 2). The Substance Abuse and Mental Health Services Administration (SAMHSA) recently announced adoption of a new Part 2 rule that relaxes some provider burdens and addresses health care delivery changes while maintaining important patient privacy and confidentiality protections. The revised rule becomes effective August 14, 2020.

Why the Modifications?
Part 2 requirements predate and are more stringent than the Health Insurance Portability and Accountability Act of 1996 (HIPAA) requirements. The lack of alignment between these privacy regulations was an ongoing source of frustration for providers. According to SAMHSA, the modernization was necessary to address integrated and coordinated care models that rely on shared information for substance use disorder (SUD) treatment, especially among non-Part 2 providers. It was also needed to facilitate the electronic exchange of SUD information for treatment and other legitimate health care purposes, such as claims management, patient safety and program quality improvement efforts.

What Stays the Same?
First, the revised regulations do not alter Part 2’s current protection of SUD patient records. Patients can continue to directly obtain a copy of their records, and redisclose them at will. SUD treatment record disclosure remains restricted without patient consent, except when authorized by limited exceptions. In addition, Part 2 treatment programs and certain other third-party record recipients are still prohibited from disclosing SUD patient identities or records to law enforcement absent an appropriate court order.

The Updates
Patients may now consent to treatment record disclosure without naming a specific recipient for the disclosure in certain circumstances. For example, a patient could release records to “all clinicians at Shady Grove Treatment Center.” This will allow patients to more easily complete online applications for benefits and resources. In addition, the nearly 20 activities that constitute disclosures for “payment and health care operations” and are permitted with written consent, are now clearly specified.

To support nationwide efforts to reduce opioid misuse, non-opioid treatment programs and non-central registry treating providers now have access to a central registry of withdrawal management or management treatment programs to determine if patients are already receiving SUD treatment through a member program. This will help reduce duplicative care enrollments and SUD-treatment prescriptions, and better protect patients from adverse medication effects. Treatment programs are also permitted to enroll in state prescription drug monitoring programs and report data into the program when prescribing or dispensing Schedule II-V medications, consistent with state law.

Overall, sections were reworked to modernize terminology across regulations and replace language to address provisions for both paper and electronic records. Other notable updates refine the definition of a bona fide medical emergency for the purpose of SUD record disclosure without patient consent; align Part 2, HIPAA and the Common Rule requirements for sharing SUD records for research purposes; clarify language that permits record disclosure for audit and evaluation purposes; ensure employees’ personal devices will not need to be confiscated or destroyed in order to sanitize for records for Part 2 compliance; and extend the time period courts are authorized to place undercover agents or informants in Part 2 program investigations.

More Information
A summary list of changes can be accessed here and the final rule can be found here.

Attorneys and practice areas related to this topic include:

Click here for a printable file.


This has been provided as an informational service and does not constitute legal counsel or advice, which can only be rendered in the context of specific factual situations. If a legal issue should arise, please contact an attorney listed or retain the assistance of other competent legal counsel. Case results depend on a variety of factors unique to each case and results do not guarantee or predict a similar result in any future case undertaken.

Contact Information

909 East Main Street
Suite 1200
Richmond, Virginia 23219-3095
Phone: 804.697.4100
Fax: 804.697.6112

View Map