The Winding Road of Changes to 42 CFR Part 2

Over the years, 42 CFR Part 2 has traveled a winding road of amendments and updates—beginning with the 2016 Proposed Rule and continuing through a series of updates, each one modernizing how substance use disorder (SUD) information is shared while preserving essential privacy safeguards. If you’re anything like me, you’ve probably spent more time than you’d care to admit hunting down one version or another of these Proposed or Final Rules. Well, hunt no more! I’ve gathered them all here, giving you a complete history of Part 2’s amendments—complete with direct links and quick summaries. Bookmark this page now, and you’ll always have a one-click resource whenever you need to revisit an earlier iteration. Below, you’ll find a chronological list of these rulemakings, each with its own executive summary. Enjoy!

February 9, 2016: Proposed Rule

• 81 Fed Reg 6988 (February 9, 2016)
• Executive Summary: The Proposed Rule addresses changes to the Confidentiality of Substance Use Disorder (SUD) [f.k.a.: Alcohol and Drug Abuse] Patient Records regulations. The Proposed Rule was prompted by the need to update and modernize the regulations. The last substantive update to these regulations was in 1987. Over the last 25 years, significant changes have occurred within the U.S. health care system that were not envisioned by the current regulations, including new models of integrated care that are built on a foundation of information sharing to support coordination of patient care, the development of an electronic infrastructure for managing and exchanging patient information, and a new focus on performance measurement within the health care system. SAMHSA (Substance Abuse and Mental Health Services Administration within Health and Human Services) wants to ensure that patients with substance use disorders have the ability to participate in, and benefit from new integrated health care models without fear of putting themselves at risk of adverse consequences. These new integrated models are foundational to HHS’s triple aim of improving health care quality, improving population health, and reducing unnecessary health care costs. SAMHSA strives to facilitate information exchange within new health care models while addressing the legitimate privacy concerns of patients seeking treatment for a substance use disorder. The Proposed Rule is intended to modernize the 42 CFR Part 2 by facilitating the electronic exchange of substance use disorder information for treatment and other legitimate health care purposes while ensuring appropriate confidentiality protections for records that might identify an individual, directly or indirectly, as having or having had a substance use disorder.

January 18, 2017: Final Rule

• 82 Fed Reg 6052 (January 18, 2017)
• Executive Summary: The Final Rule finalized many of the proposals from the 2016 Proposed Rule, establishing updated confidentiality protections for SUD patient records. The last substantive update to these regulations was in 1987. Over the last 29 years, significant changes have occurred within the U.S. health care system that were not envisioned by the 1987 regulations, including new models of integrated care that are built on a foundation of information sharing to support coordination of patient care, the development of an electronic infrastructure for managing and exchanging patient information, and a new focus on performance measurement within the health care system. SAMHSA wants to ensure that patients with substance use disorders have the ability to participate in, and benefit from health system delivery improvements, including from new integrated health care models while providing appropriate privacy safeguards.
• Compliance Deadline: February 17, 2017. SAMHSA established a single effective date of 30 days after the publication of the final rule, or February 17, 2017. On this date, the revised 42 CFR Part 2 will replace the 1987 version of Part 2 in the CFR and all part 2 programs and other lawful holders of patient identifying information must comply with all aspects of the regulations.

January 18, 2017: Supplemental Notice of Proposed Rule

• 82 Fed Reg 5485 (January 18, 2017)
• Executive Summary: On Feb. 9, 2016, SAMHSA published a Notice of Proposed Rulemaking (NPRM) that proposed policy changes to update and modernize 42 CFR Part 2. SAMHSA explained in the NPRM that these changes were intended to better align the regulations with advances in the U.S. health care delivery system while retaining important privacy protections for individuals seeking treatment for substance use disorders. The last substantive update to these regulations was in 1987. Contemporaneous with publishing a Final Rule on this same date, January 18, 2017, finalizing certain changes to Part 2, SAMHSA also issuing this Supplemental Notice of Proposed Rulemaking to propose additional clarifications to Part 2 as amended by the concurrently issued Final Rule. As noted in the Final Rule, 42 CFR Part 2, questions raised by commenters highlighted varying interpretations of the 1987 rule’s restrictions on lawful holders and their contractors and subcontractors’ use and disclosure of Part 2-covered data for purposes of carrying out payment, health care operations, and other health care related activities. In consideration of this feedback and given the critical role that third-party payers, other lawful holders, and their contractors, subcontractors, and legal representatives play in the provision of health care services, SAMHSA is issuing this Supplemental Notice of Proposed Rule to seek further comments on its proposals to address and help clarify these matters before establishing any appropriate restrictions on disclosures to contractors, subcontractors and legal representatives.

January 3, 2018: Final Rule

• 83 Fed Reg 239 (January 3, 2018)
• Executive Summary: On February 9, 2016, SAMHSA published a Notice of Proposed Rulemaking (NPRM) in the Federal Register (81 FR 6988), proposing updates to 42 CFR Part 2. On January 18, 2017, SAMHSA published a final rule (82 FR 6052). In response to public comments, the final rule provided for greater flexibility in disclosing patient identifying information within the health care system while continuing to address the need to protect the confidentiality of substance use disorder patient records. SAMHSA concurrently issued a supplemental notice of proposed rulemaking (SNPRM) (82 FR 5485) to solicit public comment on additional proposals including: The payment and health care operations-related disclosures that can be made to contractors, subcontractors, and legal representatives by lawful holders under the 42 CFR Part 2 Rule consent provisions; and the provisions governing disclosures for purposes of carrying out a Medicaid, Medicare or Children’s Health Insurance Program (CHIP) audit or evaluation. SAMHSA also solicited comments on whether an abbreviated notice of the prohibition on re-disclosure should be used and, if so, under what circumstances. This Final Rule addresses the prohibition on re-disclosure notice by including an option for an abbreviated notice. This Final Rule also addresses the circumstances under which lawful holders and their legal representatives, contractors, and subcontractors may use and disclose patient identifying information for purposes of payment, health care operations, and audits and evaluations. Finally, this final rule is making minor technical corrections to ensure accuracy and clarity in SAMHSA’s regulations.
• Compliance Deadlines: Compliance date for all provisions of the Final Rule, except for § 2.33(c), is February 2, 2018. Contracts between lawful holders and contractors, subcontractors, and legal representatives must comply with § 2.33(c) within two (2) years of the effective date of the Final Rule, or February 2, 2020.

August 26, 2019: Proposed Rule

• 84 Fed Reg 44568 (August 26, 2019)
• Executive Summary: This Proposed Rule proposes additional changes 42 CFR Part 2. These additional proposals were prompted by the need to continue aligning the regulations with advances in the U.S. health care delivery system, while retaining important privacy protections for individuals seeking treatment for substance use disorders (SUDs). Within the constraints of the enabling statute, these additional proposed changes are an effort by SAMSHA to continuing striving to facilitate information exchange for safe and effective substance use disorder care, while addressing the legitimate privacy concerns of patients seeking treatment for a substance use disorder.

March 27, 2020: CARES Act

• Coronavirus Aid, Relief and Economic Security Act, L. 116– 136, 134 Stat. 281 (March 27, 2020) (‘‘CARES Act’’).
• The CARES Act is signed into law on March 27, 2020. The CARES Act was enacted to provide emergency assistance to individuals, families and businesses affected by the COVID–19 pandemic; to support the U.S. health care system; and to make emergency appropriations to the Executive Branch. Section 3221 of the CARES Act, Confidentiality and Disclosure of Records Relating to Substance Use Disorder, substantially amended several sections of the Part 2 authorizing statute; specifically, sections 42 U.S.C. 290dd–2(b), (c) and (f), which specify requirements for patient consent, restrict the use of records in legal proceedings, and set penalties for violations of the statute, respectively. The CARES Act provides far greater flexibility for patients and health care providers to share SUD records than presently allowed under 42 U.S.C. 290dd–2. Most notably, some sections in the new statute seek to align the Part 2 confidentiality standards more closely with the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The CARES Act requires HHS to update its regulations to implement these new statutory changes.

July 15, 2020: Final Rule

• 85 Fed Reg 42986 (July 15, 2020)
• Executive Summary: On February 9, 2016, SAMHSA published a notice of proposed rulemaking (NPRM), inviting comment on proposals to update the regulations, to reflect the development of integrated health care models and the growing use of electronic platforms to exchange patient information, as well as the new laws and regulations implemented since 1975, that more broadly protect patient data. In response to public comments, on January 18, 2017, SAMHSA published a final rule, providing for greater flexibility in disclosing patient identifying information within the health care system, while continuing to protect the confidentiality of SUD patient records. SAMHSA concurrently issued a supplemental notice of proposed rulemaking to solicit public comment on additional proposals. In response to public comments, SAMHSA subsequently published a final rule on January 3, 2018 that provided greater clarity regarding payment, health care operations, and audit or evaluation-related disclosures, and provided language for an abbreviated prohibition on re-disclosure notice. On August 26, 2019, SAMHSA published a Notice of Proposed Rulemaking that proposed changes to the Part 2 regulations that SAMHSA believed would better align with the needs of individuals with SUD and of those who treat these patients in need, and help facilitate the provision of well-coordinated care, while ensuring appropriate confidentiality protection for persons in treatment through part 2 programs.

On March 27, 2020, President Trump signed the CARES Act into law. Section 3221 of the CARES Act substantially amended several sections of the Part 2 authorizing statute; specifically, sections 42 U.S.C. 290dd–2(b), (c) and (f), which specify requirements for patient consent, restrict the use of records in legal proceedings, and set penalties for violations of the statute, respectively. The CARES Act provides far greater flexibility for patients and health care providers to share SUD records than presently allowed under 42 U.S.C. 290dd–2. Most notably, some sections in the new statute seek to align the Part 2 confidentiality standards more closely with HIPAA. The CARES Act requires HHS to update its regulations to implement these new statutory changes; therefore, HHS intends to publish a new NPRM and subsequently to issue a new final implementing rulemaking for the CARES Act in the future. Because both Congress and SAMHSA have sought to address many of the same barriers to information sharing by patients and among health care providers, we expect that the CARES Act implementing regulations will further modify several of the amendments adopted in this Final Rule.

The statutory timeline in § 3221 prevents the Part 2-related provisions of the CARES Act from taking effect before March 27, 2021. In the interim, SAMSHA believes that this 2020 Final Rule makes important changes that can help safeguard the health and outcomes of individuals with SUD and specifically takes important first steps toward the greater flexibility for information sharing envisioned by Congress in its passage of § 3221 of the CARES Act. Thus, several of the regulatory amendments in this final rule will serve as interim and transitional standards, until regulations conforming to the CARES Act legislation can be promulgated.

• Effective Date: August 14, 2020.

December 14, 2020: Final Rule

• 85 Fed Reg 80626 (December 14, 2020)
• Executive Summary: The Final Rule is issued to clarify one of the conditions under which a court may authorize disclosure of confidential communications made by a patient to a Part 2 program as defined in this regulation. This change to the regulation is intended to clarify that a court has the authority to permit disclosure of confidential communications when the disclosure is necessary in connection with investigation or prosecution of an extremely serious crime, such as one that directly threatens loss of life or serious bodily injury, where the extremely serious crime was allegedly committed by either a patient or an individual other than the patient.

• Effective Date: January 13, 2021.

December 2, 2022: Proposed Rule

• 87 Fed Reg 74216 (December 16, 2022)
• Executive Summary: SAMSHA, HHS publish this Notice of Proposed Rulemaking (NPRM) to solicit public comment on its proposal to modify its regulations to implement Section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act.

February 16, 2024: Final Rule

• 33 Fed Reg 12472 (February 16, 2024)
• Executive Summary: On March 27, 2020, Congress enacted the CARES Act, including Section 3221 of the Act 1 entitled ‘‘Confidentiality and Disclosure of Records Relating to Substance Use Disorder.’’ Section 3221 enacts statutory amendments to section 290dd–2 of title 42 United States Code (42 U.S.C. 290dd–2). These amendments require the HHS to increase the regulatory alignment between 42 CFR Part 2, which includes privacy provisions that protect SUD patient records, and key aspects of HIPAA’s Rules governing Privacy, Breach Notification, and Enforcement. On December 2, 2022, HHS published a NPRM proposing to modify Part 2 consistent with the requirements of Section 3221 of the CARES Acct. In the NPRM, HHS proposed to: (1) enhance restrictions against the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings; (2) provide for civil enforcement authority, including the imposition of civil money penalties (CMPs);  (3) modify consent for uses and disclosures of Part 2 records for treatment, payment, and health care operations (TPO) purposes; (4) impose breach notification obligations; (5) incorporate some definitions from the HIPAA regulations into Part 2; (6) provide new patient rights to request restrictions on uses and disclosures and obtain an accounting of disclosures made with consent; (7) add a permission to disclose de-identified records to public health authorities; and (8) address concerns about potential unintended consequences for government agencies that investigate Part 2 programs due to the change in enforcement authority and penalties for violations of Part 2. This final rule aligns certain Part 2 requirements more closely with requirements of the HIPAA regulations to improve the ability of entities that are subject to Part 2 to use and disclose Part 2 records and make other changes to Part 2, as described in the preamble. HHS believes this Final Rule implements the modifications required by the CARES Act amendments to 42 U.S.C. 290dd–2 and will decrease burdens on patients and providers, improve coordination of care and access to care and treatment, and protect the confidentiality of treatment records.
• Effective Date: April 16, 2024 (implementation of the new standards is permitted)
• Compliance Deadline: February 16, 2026 (compliance with new standards is required)

_________________________

Need tools, checklists, sample policies, and forms to assist with every aspect of updating your compliance program for the new 42 CFR Part 2 requirements?  See the Table of Contents for our Part 2 Helper.

Don’t wait until the last minute—February 16, 2026 will be here before you know it. Start preparing today and ensure your organization is ready to meet the new standards (and avoid the new penalties).

Need help? We’re just a click away at legalhie.com/membership