The 42 CFR Part 2 regulations (Part 2) serve to protect patient records created by federally assisted programs for the treatment of substance use disorders (SUD). Part 2 has been revised to further facilitate better coordination of care in response to the opioid epidemic while maintaining its confidentiality protections against unauthorized disclosure and use.
What Has Not Changed Under the New Part 2 Rule: The revised rule does not alter the basic framework for confidentiality protection of substance use disorder (SUD) patient records created by federally assisted SUD treatment programs. Part 2 continues to prohibit law enforcement’s use of SUD patient records in criminal prosecutions against patients, absent a court order. Part 2 also continues to restrict the disclosure of SUD treatment records without patient consent, other than as statutorily authorized in the context of a bona fide medical emergency; or for the purpose of scientific research, audit, or program evaluation; or based on an appropriate court order.
What Has Changed Under the New Part 2 Rule: The revised rule modifies several major sections of Part 2, as follows:
|Provision||What Changed?||Why Was This Changed?|
|Applicability and Re-Disclosure||Treatment records created by non-Part 2 providers based on their own patient encounter(s) are explicitly not covered by Part 2, unless any SUD records previously received from a Part 2 program are incorporated into such records. Segmentation or holding a part of any Part 2 patient record previously received can be used to ensure that new records created by non-Part 2 providers will not become subject to Part 2.||To facilitate coordination of care activities by non-part-2 providers.|
|Disposition of Records||When an SUD patient sends an incidental message to the personal device of an employee of a Part 2 program, the employee will be able to fulfill the Part 2 requirement for “sanitizing” the device by deleting that message.||To ensure that the personal devices of employees will not need to be confiscated or destroyed, in order to sanitize in compliance with Part 2.|
|Consent Requirements||An SUD patient may consent to disclosure of the patient’s Part 2 treatment records to an entity (e.g., the Social Security Administration), without naming a specific person as the recipient for the disclosure.||To allow patients to apply for benefits and resources more easily, for example, when using online applications that do not identify a specific person as the recipient for a disclosure of Part 2 records.|
|Disclosures Permitted w/ Written Consent||Disclosures for the purpose of “payment and health care operations” are permitted with written consent, in connection with an illustrative list of 18 activities that constitute payment and health care operations now specified under the regulatory provision.||In order to resolve lingering confusion under Part 2 about what activities count as “payment and health care operations,” the list of examples has been moved into the regulation text from the preamble, and expanded to include care coordination and case management activities.|
|Disclosures to Central Registries and PDMPs||Non-OTP (opioid treatment program) and non-central registry treating providers are now eligible to query a central registry, in order to determine whether their patients are already receiving opioid treatment through a member program.
OTPs are permitted to enroll in a state prescription drug monitoring program (PDMP), and permitted to report data into the PDMP when prescribing or dispensing medications on Schedules II to V, consistent with applicable state law.
|To prevent duplicative enrollments in SUD care, duplicative prescriptions for SUD treatment, and adverse drug events related to SUD treatment.|
|Medical Emergencies||Declared emergencies resulting from natural disasters (e.g., hurricanes) that disrupt treatment facilities and services are considered a “bona fide medical emergency,” for the purpose of disclosing SUD records without patient consent under Part 2.||To ensure clinically appropriate communications and access to SUD care, in the context of declared emergencies resulting from natural disasters.|
|Research||Disclosures for research under Part 2 are permitted by a HIPAA-covered entity or business associate to individuals and organizations who are neither HIPAA covered entities, nor subject to the Common Rule (re: Research on Human Subjects).||To facilitate appropriate disclosures for research, by streamlining overlapping requirements under Part 2, the HIPAA Privacy Rule and the Common Rule.|
|Audit and Evaluation||Clarifies specific situations that fall within the scope of permissible disclosures for audits and/or program evaluation purposes.||To resolve current ambiguity under Part 2 about what activities are covered by the audit and evaluation provision.|
|Undercover Agents and Informants||Court-ordered placement of an undercover agent or informant within a Part 2 program is extended to a period of 12 months, and courts are authorized to further extend the period of placement through a new court order.||To address law enforcement concerns that the current policy is overly restrictive to some ongoing investigations of Part 2 programs.|