Summary

In the interim of the Part 2 proposed rule release and the final rule being promulgated, Congress incorporated legislation to align 42 CFR Part 2 with HIPAA for the purpose of treatment, payment and operations in section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act).

The CARES Act became law on March 27, 2020. SAMHSA will need to release new regulations to implement the law, which was anticipated no earlier than March 27, 2021. However, the last statement issued from SAMHSA regarding addressing the changes required by the CURES Act was issued on April 9, 2021 indicating the intent to seek comments from the public before any further changes would be adopted.  The comment period has yet to be opened and SAMSHA indicated that the current 42 CFR Part 2 regulations remain in effect.

• Consent still required for disclosure of SUD treatment records by a Part 2 Program.
• With a general consent, disclosures and redisclosures may be made consistent with HIPAA for treatment, payment and health care operations.  The redisclosure notice described above would no longer be necessary.
• A patient’s one-time Part 2 written consent will be sufficient “for all such future uses or disclosures for purposes of treatment, payment, and health care operations.”
• A new exception for disclosures to a public health authority, as long as such disclosure meets HIPAA’s de-identification standards at 45 C.F.R. section 164.514(b)
• Adopts HIPAA fines and penalties in the place of Part 2 enforcement mechanism.
• Prohibits use of SUD records in civil, criminal, legislative or administrative proceedings without a court order.
• Applies breach notification rules.
• Changes enforcement authority.