It’s a good thing that HHS gave Part 2 programs two years to comply with the final Confidentiality of Substance Use Disorder Patient Records regulation, which was published in the Feb. 16 Federal Register, because there’s a lot to do.[1] The rule—42 C.F.R. Part 2—goes a long way toward harmonizing with HIPAA and the Health Information Technology for Economic and Clinical Health Act, but also has requirements beyond them.
“The changes are sweeping and complex,” said attorney Angie Burnette, with Alston & Bird LLP in Atlanta. Part 2 programs are now subject to the breach notification obligations of HIPAA and its civil and criminal penalties instead of the criminal penalties of the original law. The rule also provides for a new one-time consent form that mirrors HIPAA’s, allows redisclosure of Part 2 records, and builds a fortress around so-called SUD counseling notes.
And that’s just for starters.
With the many changes in the rule—which was jointly developed by the HHS Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA)—Part 2 programs have a long runway. Although the effective date is 60 days from its publication, the compliance date is 24 months later.
“There are some Part 2 programs that are already covered by HIPAA. If that’s the case, some of this won’t be as big a change for them. But there are some Part 2 programs not covered by HIPAA and it’s a huge change for them,” Burnette said.
