Mid-Atlantic Health Law TOPICS

Providers will have until April 2026 to comply with recently announced changes to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations, better known as Part II regulations, that better align Part II regulations with privacy protections found in other laws. 

Part II sets privacy standards for records generated by the treatment of SUDs, in recognition that stigma related to these types of conditions may deter patients from seeking care if treatments are not kept confidential.  

For years, providers have tried to harmonize the Part II requirements with the requirements of the Health Insurance Portability and Accountability Act (HIPAA). Although both laws prioritize patient privacy, their provisions differ. 

In response, the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) required the U.S. Department of Human and Services (HHS) to bring Part II and HIPAA requirements into closer alignment, with the dual goals of increasing confidentiality and facilitating care coordination between behavioral health providers and other health care entities that may care for the same patient. 

What’s New?

Now, patients will be able to sign a single consent for all future uses and disclosures of treatment, payment and health care operations for health care data related to HIPAA and Part II. 

However, providers should be aware that they cannot disclose identifiable Part II data in any type of legal proceeding brought against a patient, without the patient’s explicit consent or a court order. Providers must also provide a copy of the consent or a clear explanation of the scope of the consent when making a Part II disclosure. 

Patients may also opt out of communications related to fundraising. 

The updated rules also contain a new safe harbor that limits civil or criminal liability for investigative agencies that act with reasonable diligence to determine whether a provider is subject to Part II before demanding records as part of an investigation, and contain new protocols for agencies that inadvertently receive Part II records without proper authority. 

Finally, patients may submit complaints regarding Part II violations directly to the Secretary of HHS at the same time as the patient files a complaint with the Part II program.

The Future 

To facilitate compliance with the new rule, HHS plans to develop guidance, and conduct outreach. Though there is not a firm timeline, additional changes to the HIPAA rules, including changes to the Notice of Privacy Practice incorporating Part II will also be released sometime in the future. 

As part of annual compliance protocols, providers that handle Part II data should review their policies and forms to incorporate these updates.
 

Alexandria K. Montanio
410-576-4278 • amontanio@gfrlaw.com