HHS Proposes Changes to Ease Restrictions on Part 2 Substance Abuse Disorder Treatment Records

Victims of CVS Caremark Data Breach Filed a Class Action Lawsuit for Damages

A new rule has been proposed by the Substance Abuse and Mental Health Services Administration (SAMHSA) that eases the restrictions on substance abuse disorder (SUD) treatment records.

SUD records are covered by the Confidentiality of Substance Use Disorder Patient Records regulations – 42 CFR Part 2 – and are treated differently to other types of protected health information due to the particularly sensitive nature of the data.

Part 2 regulations were introduced two decades before HIPAA was signed into law to ensure that patient privacy was protected, and individuals were not discouraged from seeking treatment. For substance abuse disorder.

The introduction of HIPAA, more specifically the HIPAA Privacy and Security Rules, ensured safeguards are implemented to protect all forms of protected health information, but the restrictions on SUD records were not lifted. SUD records must therefore be kept separate from other forms of PHI and cannot be disclosed without consent from patients.

There have been calls from doctors and healthcare industry groups for Part 2 regulations to be aligned with HIPAA, in particular to help combat the opioid crisis in the United States. Currently, doctors may not have access to information about a history of substance abuse disorder and any treatment provided. Without access to that information, treatment decisions could be made that place patient safety in jeopardy.

The proposed rule does not alter the framework of Part 2 regulations and Part 2 will not be perfectly aligned with HIPAA, instead certain restrictions have been eased and some of the complexity of Part 2 regulations have been removed.


Simple Guidelines
Immediate PDF Download

Immediate Access

Privacy Policy

One of the main changes, should the new rule be signed into law, will allow doctors to record SUD treatment records within an individuals’ medical record, provided that information has been willingly provided by the patient. SUD treatment records created by a federally assisted SUD treatment program will still need to be segregated.

To help prevent accidental overdoses, healthcare providers that do not offer opioid treatment programs would be able to access a central registry detailing the patients that have enrolled in SUD treatment programs. If a patient enrolls in such a program, a condition would be that the individual’s records would be uploaded to the registry.

The new rule also allows treatment programs for opioid abuse to sign up with state prescription drug monitoring programs and report on Schedule II to IV drugs that have been prescribed or dispensed.

The updated regulations will make it easier for patients to share their SUD treatment records with non-medical entities such as the Social Security Administration. Current regulations require a patient to name an individual within an organization who is authorized to receive their records. The proposed rule allows a patient to name an entity rather than the individual.

If business associates of healthcare providers are given access to SUD treatment records for research purposes, they will also be allowed to disclose that information to non-covered entities for research purposes.

Part 2 regulations required healthcare organizations to sanitize electronic devices containing SUD treatment records, although this method of data destruction usually also destroys the device on which the information is stored. Under the proposed rule, data deletion would be sufficient.

The courts were previously prevented from disclosing SUD treatment records as part of an investigation into a serious crime which was not committed by the patient. That restriction has been removed, as has the requirement for undercover agents to only remain in Part 2 program for up to 6 months. The time limit has been extended to 12 months.

The language of Part 2 regulations has also been updated to help clear up confusion. The change makes it clear that healthcare providers are permitted to share SUD treatment records for payment and healthcare operations. The new rule also clarifies the treatment of SUD records in emergency situations.

The full proposed changes can be viewed on this link.

About Liam Johnson
Liam Johnson has produced articles about HIPAA for several years. He has extensive experience in healthcare privacy and security. With a deep understanding of the complex legal and regulatory landscape surrounding patient data protection, Liam has dedicated his career to helping organizations navigate the intricacies of HIPAA compliance. Liam focusses on the challenges faced by healthcare providers, insurance companies, and business associates in complying with HIPAA regulations. Liam has been published in leading healthcare publications, including The HIPAA Journal. Liam was appointed Editor-in-Chief of The HIPAA Guide in 2023. Contact Liam via LinkedIn: https://www.linkedin.com/in/liamhipaa/