By: Christopher Parrella, ESQ., CPC, CHC, CPCO 
Parrella Health Law, Boston, Ma. 
A Health Care Defense and Compliance Firm

On February 8, 2024, a significant regulatory shift occurred that promises to redefine the landscape of substance use disorder (SUD) patient record confidentiality in the United States. The Department of Health and Human Services (HHS), through concerted efforts by the Substance Abuse and Mental Health Services Administration (SAMHSA) and the Office for Civil Rights (OCR), unveiled the Final Rule modifying the Confidentiality of Substance Use Disorder Patient Records regulations, encapsulated within 42 C.F.R. Part 2 (Part 2). This pivotal move was instigated by necessary amendments to 42 U.S.C. § 290dd-2, stemming from the CARES Act of 2020, which mandated a more harmonized alignment of Part 2 with the Health Insurance Portability and Accountability Act (HIPAA) Rules and the Health Information Technology for Economic and Clinical Health (HITECH) Act.

The newly adopted Final Rule introduces a streamlined consent process, allowing patients to execute a single consent form for the use and disclosure of Part 2 protected information. This consent encompasses disclosures to Part 2 programs, HIPAA covered entities, and HIPAA business associates for treatment, payment, and healthcare operations (TPO). Importantly, while the CARES Act has facilitated partial alignment with HIPAA, it notably preserves the patient consent requirement, albeit simplifying it into a one-time consent process that stands until revoked by the patient.

A distinctive feature of the Final Rule is its classification of entities eligible to redisclose Part 2 information, introducing “lawful holders” alongside HIPAA covered entities and business associates. Lawful holders, encompassing a broad spectrum of persons other than the aforementioned entities, are permitted to redisclose Part 2 information solely to their contractors, subcontractors, and legal representatives for payment and health care operations purposes, with explicit prohibitions against redisclosure to third parties or for treatment purposes.

The Final Rule meticulously differentiates among various recipients and utilizers of Part 2 information, underscoring the continued necessity for patient consent, particularly for disclosures related to civil, criminal, administrative, or legislative proceedings. This consent specificity extends to the prohibition against combining consents for different purposes and the introduction of “SUD counseling notes” as a distinct category necessitating separate consent for disclosure.

One of the hallmark advancements under the Final Rule is the alignment of enforcement mechanisms with those established under HIPAA, replacing the Title 18 U.S.C. criminal enforcement framework with civil and criminal penalties as delineated in the Social Security Act.

For additional information on how to comply with the Final Rule mandates or its affects on your organizational processes, please call us at 857-328-0382 or email us at info@parrellahealthlaw.com

Christopher Parrella, ESQ, CPC, CHC, CPCO, is the founding partner of Parrella Health Law in Boston, Mass. The firm focuses exclusively on healthcare defense and compliance matters. Chris also travels the country on behalf of a wide range of healthcare organizations, lecturing on a variety of health care enforcement and compliance topics. Chris is one of a handful of health care attorney’s that are also Certified Professional Coders (CPC) and is a member of the AAPC’s National Legal Advisory Board and Ethics Committee. He is also a Certified Professional Compliance Officer (CPCO) and Certified in Health Care Compliance (CHC.)