42 CFR Part 2 Final Rule

42 CFR Part 2 seeks to strike a balance between protecting sensitive patient information and improving coordinated care and compliance. In April 2024, the U.S. Department of Health and Human Services (HHS), through the Office for Civil Rights (OCR) and in coordination with SAMHSA, issued a landmark Final Rule updating the regulations governing the confidentiality of substance use disorder (SUD) treatment records. Here’s what you need to know:

Why the 42 CFR Part 2 Update Matters

• Driving Alignment with HIPAA: The rule fulfills requirements of section 3221 of the CARES Act (2020), mandating alignment of certain Part 2 provisions with HIPAA and the HITECH Act.
• Implementation Timeline: The rule took effect on April 16, 2024, and those subject to it must comply by February 16, 2026.

Key Changes in the 42 CFR Part 2 Final Rule

1. Single Consent for TPO (Treatment, Payment, Healthcare Operations):
   • Providers may now obtain one consent for all future disclosures related to TPO.
   • Covered entities and their business associates may redisclose records in line with HIPAA—except in proceedings against a patient without consent or court order.
2. Disclosure to Public Health Authorities:
   • Records may be shared without patient consent if de-identified per HIPAA Privacy Rule standards.
3. Restrictions on Proceedings:
   • SUD records remain protected from use in civil, criminal, administrative, or legislative proceedings against patients unless consent or court order is obtained.
4. Enforcement Alignment with HIPAA:
   • Criminal penalties in Part 2 are replaced with civil and criminal enforcement authorities consistent with HIPAA violations.
   • Breach notification requirements now mirror HIPAA’s standards.
5. Patient Notifications:
   • Updates to Part 2’s patient notice now align with HIPAA’s Notice of Privacy Practices.
6. Safe Harbor for Investigations:
   • Agencies that diligently check—by searching SAMHSA’s online treatment facility locator and reviewing a provider’s notices—to confirm whether records are subject to Part 2 are offered liability protection if they inadvertently obtain such records without a court order.

Additional Enhancements Based on Public Feedback

• Stronger Safe Harbor Requirements: The reasonable diligence criteria for investigative agencies are now more clearly defined.
• No Mandatory Segmentation: Explicitly states that segregating or segmenting Part 2 data is not required.
• Improved Complaint Process: Patients can now file complaints directly with the HHS Secretary, in addition to existing Part 2 program mechanisms.

Practical Next Steps for Providers

To ensure compliance before the February 16, 2026 deadline:

1. Update Consent Forms & Notices
   • Revise consent forms to reflect new elements—like revocation rights and broader recipient specifications.
   • Ensure disclosure notices use updated language (e.g., referencing the new succinct phrase: “42 CFR Part 2 prohibits unauthorized use or disclosure of these records”).
2. Revise Organizational Policies
   • Align internal policies with the new provisions—especially concerning redisclosure, breach response, and investigative safe harbor.
3. Staff Training
   • Educate relevant staff on changes, including how to use SAMHSA’s locator and interpret notices correctly.

In Summary

The 2024 Final Rule modernizes 42 CFR Part 2 by integrating critical elements of HIPAA. The Final Rule enhances patient privacy protections, and facilitating better care coordination. While it introduces safer pathways for record sharing and investigative clarity, it also reinforces the confidentiality of SUD treatment information. With compliance required by February 16, 2026, now is the time for programs to update their forms, policies, and training efforts.

Have Questions?

At MedSafe, we help healthcare organizations navigate HIPAA compliance through customized training, audits, and policy development. Don’t wait for an audit or breach to reveal a gap—take action now to protect your practice and your patients.

Contact us today to schedule a HIPAA compliance review or training session.

Additional Resources:

HHS – OIG