Today the U.S. Department of Health & Human Services (HHS) finalized rules published in December of 2022 changing the requirements for handling SUD patient information governed by 45 CFR part 2 (Part 2).
Health care facilities subject to Part 2 often struggled to comply with requirements related to SUD patients and their information that were inconsistent with HIPAA. The new Part 2 rules clean up many of those inconsistencies, while continuing to provide additional protection for Part 2 patient and their records where necessary, such as in legal proceedings brought against an SUD patient.
A few key changes to Part 2:
- Part 2 records may be disclosed pursuant to the patient’s written consent, which may be a single consent for all future uses and disclosures for treatment, payment, and health care operations (as such terms are defined under HIPAA)
- Part 2 records may be disclosed to a public health authority without patient consent if the records are de-identified (as defined and set forth under HIPAA)
- Part 2 records are subject to HIPAA’s breach notification requirements
- Part 2 SUD providers must provide HIPAA Notice of Privacy Practices-type notices to patients
- Patients have the right to complain to HHS regarding alleged violations of Part 2