Recently, modifications announced by the Department of Health and Human Services (“HHS”) to 42 C.F.R. Part 2 (“Part 2”) rules governing Confidentiality of Substance Use Disorder (“SUD”) Patient Records went into effect. This is a major rule change for Part 2 providers and the enhanced penalties and enforcement measures make compliance with the new rules essential for any Part 2 provider. Historically, privacy protections required under the Health Insurance Portability and Accountability Act (“HIPAA”) and Part 2 have oftentimes been at odds, and the Coronavirus Aid, Relief, and Economic Security (“CARES”) Act[1] mandated synchronization of these protections. A statement by HHS Secretary Xavier Becerra cited the new rules as an improvement to the coordination of care for patients suffering from substance use disorders and the way forward in combating the barriers to care posed by the disconnect between HIPAA and Part 2 protections.

To achieve these aims, the new rules realign Part 2 with HIPAA protections and disclosures in several important ways:

• Permit a single patient consent to be used for all future uses and disclosures for treatment, payment and health care operations.[2] Previously, separate consents were required for such uses and disclosures.
• Create a new definition for “SUD Counseling Notes,” which are notes recorded by a SUD or mental health professionals documenting or analyzing the contents of conversations between such professionals and patients, but excluding such things as medication prescription and monitoring, modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.[3] Under the new rule, SUD Counseling Notes will require a separate consent for use and disclosure, and professionals will need to keep SUD Counseling Notes separate from the patient’s medical record. HHS specifically intended to mimic HIPAA’s “psychotherapy notes” definition and protection and, like “psychotherapy notes,” a consent for SUD Counseling Notes may not be combined with other general consents.[4]
• Permit HIPAA-covered entities and their business associates to re-disclose Part 2 records in accordance with HIPAA rules, subject to certain exceptions (see below).[5]
• Expand prohibitions on the use of Part 2 records against patients in civil, criminal (including in initiating and substantiating criminal charges or to conduct a criminal investigation), administrative, or legislative proceedings without a separate patient consent or a court order.[6]
• Remove requirement for covered entities and their business associates to segregate Part 2 records from the patient’s non-Part 2 records so long as the patient has consented to all future treatment, payment, and health care operations disclosures.[7] However, HHS highlighted the importance of maintaining special awareness of Part 2 records within the wider medical record in order to ensure compliance with “the continuing prohibition on use and disclosure of the records in investigations or proceedings against the patient, absent written consent or a court order.”[8]
• Adopt HIPAA standards at 45 C.F.R. 164.514(b) for de-identification of records for release to public health authorities.[9]
• Align civil and criminal penalties for violations, breach notification rules, and patient notice to those under HIPAA.[10]
• Extend the period that an audit of disclosures of Part 2 records by intermediaries must be maintained from two years to three years.[11]

A summary of the new rules was published by HHS and is available here.

All entities subject to Part 2 must be in compliance by February 16, 2026.

Dinsmore health care attorneys are highly skilled in this regulatory environment and are available to help you start transitioning your practice to the new Part 2 requirements.