- with readers working within the Healthcare and Telecomms industries
- within Media, Telecoms, IT and Entertainment topic(s)
In 2024, the Part 2 rules related to healthcare records for substance use disorder ("SUD") services were published with a compliance deadline of February 16, 2026. These changes not only affect Part 2 programs but also affect any lawful holders of records generated by a Part 2 program. Lawful holders include anyone that has received SUD records pursuant to written consent and notice, or a consent exception. Below we have outlined important changes to patient consent requirements, as well as important changes to know if you are a Part 2 program, covered entity, or business associate.
Changes to Patient Consent Requirements
The consent form used by Part 2 programs may now be simplified. The rules previously required an explicit description of the information to be disclosed and now simply require that the information is identified in a "specific and meaningful fashion." 42 C.F.R. § 2.31(a)(3). Another important update is that a class of persons may be designated for disclosure instead of specifying the names of the individuals or entities. 42 C.F.R. § 2.31(a)(4)(i). The requirements related to the necessary description of the purpose for disclosure have also been revised and may now simply state "at the request of the patient." 42 C.F.R. § 2.31(a)(5).
An even more significant update is that a single consent form may be used to allow future use and disclosure of Part 2 records for the purposes of Treatment, Payment, and Health Care Operations ("TPO"). When disclosures occur for TPO purposes, covered entities and their business associates may generally redisclose pursuant to the HIPAA regulations. One major exception to this new general rule is that it does not include redisclosure for civil, criminal, administrative, or legislative proceedings against the individual. 42 C.F.R. § 2.31(a)(4)(iii).
Previous versions of the regulations already restricted the use of Part 2 records in civil and criminal proceedings. The revised regulations now also include "administrative and legislative proceedings." 42 C.F.R. § 2.65. Additionally, the revision now allows for testimony regarding Part 2 records, not just the disclosure of Part 2 records in limited circumstances.
Moving Forward
Part 2 Programs
- Ensure that privacy notices comply with HIPAA and incorporate the new rights for Part 2 patients. Refer to 42 C.F.R. § 2.22 for explicit provisions and requirements.
- Revise disclosure consent forms to align with new options found in Part 2 regulations.
- May create one broad consent form that allows for disclosures related to TPO.
- Must allow patients to request restrictions on TPO disclosures, but Part 2 programs are only required to agree in certain circumstances.
- Part 2 programs are now subject to the HIPAA breach notification requirements. Additionally, federal enforcement for breaches is now aligned with HIPAA standards.
Covered Entities and Business Associates
- A covered entity that creates or maintains Part 2 records must include information in the Notice of Privacy Practices related to Part 2 record permitted disclosures, patient's rights, and the covered entity's responsibilities. The Notice must also include information related to the restrictions for civil, criminal, administrative, and legislative proceedings.
- For general consents for records received from a Part 2 program for TPO purposes, covered entities and business associates may use and redisclose as allowed by HIPAA.
- Must comply with restrictions related to civil, criminal, administrative, and legislative proceedings for all Part 2 records regardless of whether the records originated with the covered entity.
- Review capabilities of EHR/EMR and if there need to be any changes for Part 2 record compliance.
Conclusion
The deadline for compliance with the 2024 promulgated rules is fast approaching. The new rules can make sharing Part 2 records easier, while also creating new burdens to comply with HIPAA regulations.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
