Regulatory Updates
Regulatory Updates provide quick access to employee benefit regulations, rulings and other guidance released by governmental agencies in the U.S. and Canada.
New updates to this page may be included in Today’s Headlines which is emailed to International Foundation members each business day. Inquiries regarding these updates should be directed to the Benefits Knowledge Center at the International Foundation at (888) 334-3327, option 5 or [email protected].
Search Regulatory Updates
HHS Issues Final Rule on Confidentiality of Substance Use Disorder Patient Records
Feb 15, 2024, 06:00
by
Amanda Wilke
The Department of Health and Human Services (HHS), through the Office for Civil Rights (OCR) in coordination with the Substance Abuse and Mental Health Services Administration (SAMHSA), issued a final rule to revise the Confidentiality of Substance Use Disorder Patient Records regulations. The regulations at 42 CFR part 2 (“Part 2”) protect the confidentiality of substance use disorder (SUD) treatment records.
The final rule also makes certain other modifications to increase alignment with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to improve workability and decrease burden on programs, covered entities, and business associates. Certain group health plans are HIPAA covered entities to which the final rule may apply.
Section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act requires HHS to align certain aspects of Part 2 with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Rules and the Health Information Technology for Economic and Clinical Health (HITECH) Act, and requires HHS to update the HIPAA Privacy Rule Notice of Privacy Practices requirements to address Part 2 protections and individual rights.
The final rule includes the following modifications to Part 2:
- Permits use and disclosure of Part 2 records based on a single patient consent given once for all future uses and disclosures for treatment, payment, and health care operations;
- Permits redisclosure of Part 2 records by HIPAA covered entities and business associates in accordance with the HIPAA Privacy Rule, with certain exceptions;
- Provides new rights for patients under Part 2 to obtain an accounting of disclosures and to request restrictions on certain disclosures, as also granted by the HIPAA Privacy Rule;
- Expands prohibitions on the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings;
- Provides HHS enforcement authority, including the potential imposition of civil money penalties for violations of Part 2; and
- Outlines new breach notification requirements applying to Part 2 records.
The final rule is effective April 16, 2024. Persons subject to the regulation must comply with the applicable requirements of the final rule by February 16, 2026.
Additional Information
Fact Sheet
News Release