7 Fast Facts on the New SUD Privacy Regulations

Meet the organizations that helped bring substance use disorder privacy and consent into the 21^st century.

Until February 2024, the Code of Federal Regulations Section 42 Part 2 required patients receiving SUD care to provide written consent for the use and disclosure of their treatment, payment, and health care operations information (TPO) for every service, every time — an added burden for those already in pain.

That has now changed thanks to the 2020 CARES Act and the work of organizations such as the Association for Behavioral Health and Wellness (ABHW) and The Partnership to Amend 42 CFR Part 2 (The Partnership).

HealthLeaders interviewed Maeghan Gilmore, Vice President of Government Affairs-ABHW and Chairperson for The Partnership. In the two months since the Part 2 rules were finalized, ABHW and The Partnership have assessed the impact on healthcare stakeholders and the road ahead.

1. What is new about Part 2?

The final Part 2 rule allows patients to provide a single consent for TPO related to their SUD while also protecting their privacy.

“ABHW had this as a policy priority for a number of years,” says Gilmore. “About six or eight years ago, there was a small group of stakeholders that represented health systems, providers, EHR vendors, and others that came together and formed this partnership.”

2. Why now?

The CARES (Coronavirus Aid, Relief, and Economic Security) Act required the HHS Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA) to align components of Part 2, HIPAA, and the Health Information Technology for Economic and Clinical Health Act (HITECH).

“The question was, How could we align Part 2 with HIPAA so that the appropriate use and sharing of SUD treatment and prevention records can be a part of the comprehensive treatment plan,” notes Gilmore.

The original regulations, designed to protect patients from stigma and discrimination, have inadvertently increased both, making it harder for patients to access treatment and providers and health plans to deliver it.

CARES recognized that Part 2 had not kept pace with other privacy updates and that multi-consent requirements were a challenge for not only patients but also providers, health plans, and other stakeholders. HHS and SAMSHA issued proposed Part 2 rule updates in December 2022 and finalized them in February 2024.

“This is a step toward modernizing privacy regulations for persons with substance use disorders and ensuring patients receive improved, coordinated whole-person care,” said Gilmore in The Partnership press release.

Speaking with HealthLeaders, she added: “SUD got left behind. Part 2 protected maybe too much for effective information sharing and the best treatment and collaboration.”

3. The Part 2 regulations add data breach protections.

The final regulations also strengthen privacy protections in the form of notification, enforcement, and penalties for data breach and inappropriate use. HHS has published a summary of rule updates in a new Fact Sheet.

4. They leave other things on the table.

CARES also required regulatory updates on SUD anti-discrimination. HHS and SAMHSA will issue these separately, with more patient protection rules also coming.

Separately, there is state law.

“We're working with partners and others as they try to really digest, understand, and implement with state law in mind,” says Gilmore, adding: “They are going to perhaps be more stringent. And what will that mean for providers and plans that work in different states?”

5. The update affects all healthcare stakeholders, with challenges and opportunities.

Gilmore notes that the Part 2 update will allow for an “easier flow of information on the use, disclosure, and redisclosure” of TPO when stakeholders receive SUD consent.

“There will need to be work on how you operationalize that. How do you conduct training and promote understanding? Are there updated policies and procedures that need to ensure you’re now aligning with Part 2? There is also the option for patients to revoke their consent and what that would mean going forward.”

“These are some of the opportunities and challenges for plans, providers, and others,” the executive adds.

Gilmore adds: “There may still be some challenges around data segmentation. While the final rule explicitly states that data segmentation in the medical record is not required, there may be a time when you need to have that, especially when someone later limits or revokes consent.”

6. What roles did the ABHW and The Partnership play in updating 42 CFR Part II?

The ABHW represents health payers who provide — and work to advance — high-quality mental health and SUD access, benefits, and care.

ABHW is the chair of The Partnership to Amend 42 CFR Part 2. The Partnership is a coalition of 50 provider, payer, pharmacy, and other healthcare organizations. Payer-specific organizations include the Alliance of Community Health Plans, AHIP, ABHW, Association for Community Affiliated Plans, Blue Cross Blue Shield Association, and Medicaid Health Plans of America.

7. What’s next?

ABHW and Partnership members plan to continue collaborating during stakeholder implementation on Part 2 education and training opportunities, state-specific legislation, and other issues.

And that’s just the beginning.

“There is a lot of other activity in the privacy area of healthcare,” says Gilmore. “We’ll be watching how information blocking [in the medical record] and other regulations that apply to privacy interconnect with Part 2 and what will happen moving forward.”