HHS is giving Part 2 programs two years to comply with the final Confidentiality of Substance Use Disorder (SUD) Patient Records regulation, published in the Feb. 16 Federal Register, as it had proposed in the draft rule.^[1] The rule—42 C.F.R. Part 2—goes a long way toward harmonizing with HIPAA and the HITECH Act, but also has requirements beyond them.

“The changes are sweeping and complex,” said attorney Angie Burnette, with Alston & Bird LLP in Atlanta. Part 2 programs are now subject to the breach notification obligations of HIPAA and its civil and criminal penalties instead of just criminal penalties in the law. The rule also provides for a new one-time consent form that mirrors HIPAA’s, allows redisclosure of Part 2 records and builds a fortress around SUD counseling notes.

With the many changes in the rule—developed jointly by the Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration—Part 2 programs have a long runway. The effective date is April 16, 60 days from publication; the compliance date is 22 months later, for a total of two years. The rule finalizes, with some changes, a proposed regulation issued in December 2022.^[2]

“As finalized, we believe the effective and compliance dates strike the right balance between incentivizing entities to come into compliance in a timely fashion, and granting them sufficient time to adjust policies, procedures, and, in some cases, technology to support new or revised regulations,” the agencies said in the rule. In addition to the rule itself, the agencies issued a fact sheet, available at https://bit.ly/3P6bG3s.