February 1, 2023

Volume XIII, Number 32


January 31, 2023

Subscribe to Latest Legal News and Analysis

January 30, 2023

Subscribe to Latest Legal News and Analysis

Confidentiality of Substance Use Disorder Records: Long-Awaited NPRM Proposes Aligning Part 2 With HIPAA


As we noted in prior health care alerts in 2020 (available here and here), the Coronavirus Aid, Relief, and Economic Security Act (CARES Act) significantly overhauled the federal law that governs the confidentiality of substance use disorder (SUD) records at 42 U.S.C. § 290dd-2 (Part 2).

Part 2 currently imposes requirements for the use and disclosure of SUD treatment records (Part 2 records) that differ from the requirements that apply to covered entities and their business associates under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). These differing obligations under HIPAA and Part 2 create compliance challenges for covered entities (and their business associates) when they maintain both protected health information (as defined by HIPAA) and Part 2 records.

On 2 December 2022, the Office for Civil Rights and the Substance Abuse and Mental Health Services Administration (SAMHSA), each within the U.S. Department of Health and Human Services (HHS) issued a Notice of Proposed Rule Making (NPRM) setting out the long-awaited proposed modifications to the existing Part 2 regulations to implement statutory amendments under the CARES Act to align certain Part 2 requirements more closely to HIPAA.

High-Level Overview Of The NPRM:

In addition to other changes, discussed in detail in the chart linked to this health care alert, the NPRM includes:

  • Revisions to a number of headings and provisions to clarify that uses as well as disclosures (and redisclosures) are encompassed by the Part 2 rules.

  • New requirements for patient consent to the redisclosure of Part 2 records.

  • New patient rights to obtain an accounting of disclosures made with consent and to request restrictions on disclosures.

  • Greater restrictions against the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings against patients.

  • New civil money penalties (each, a CMP) for violations of certain of Part 2 regulations.

  • New requirements to prohibit discrimination against Part 2 program participants.

  • New breach notification requirements.

  • A limitation on liability for agencies that investigate and prosecute Part 2 programs, and persons acting on their behalf (collectively proposed to be defined as “investigative agencies”), to address concerns about potential unintended consequences of proposed changes in enforcement authority and penalties under the Part 2 regulations with respect to noncompliance by investigative agencies who unknowingly receive records subject to Part 2.

The NPRM proposes additional changes in defined terms in the existing Part 2 regulations to harmonize with the terms used in the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (HIPAA Rules). As a reminder, the CARES Act adopted the following definitions from the HIPAA Rules and applied them to Part 2: (i) business associate, (ii) covered entity, (iii) health care operations, (iv) payment, (v) public health authority, (vi) treatment, and (vi) unsecured protected health information.  HHS is proposing to adopt further harmonizing language. For example, HHS proposes to adopt the phrase “use and disclosure” throughout the revised Part 2 regulations, “when both actions could apply.” In addition, HHS proposes changing the Part 2 terms “individual” and “entities” to the term “persons,” which HHS is proposing to define the same as in HIPAA. HHS is also proposing edits to correct grammatical issues, to improve readability and modernize the regulation, to renumber sections and make structural changes to the numbering of paragraphs, and to substitute the phrase “non-electronic records” for the term “paper records.”

While most of the proposed rule changes relate to Part 2, HHS is also proposing modifications to the content of the HIPAA Notice of Privacy Practices (NPP) to address both the uses and disclosures of Part 2 records and an individual’s rights with respect to those records.

HHS also indicates that it intends to develop separate rules to implement the CARES Act antidiscrimination prohibitions and that it is also considering whether to create a new definition, similar to the HIPAA definition of “psychotherapy notes,” that is specific to the notes of SUD counseling sessions by a Part 2 program professional. That definition would be used to allow for additional protection of those notes in a manner similar to the protection of psychotherapy notes under HIPAA. HHS contemplates that SUD counseling notes would be defined as those notes maintained primarily for use by the originator of the notes documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the patient’s record. The disclosure of the SUD counseling notes would be limited, generally consistent with the protection afforded to psychotherapy notes under HIPAA.

Finally, note that on 13 December 2022 (within days of the issuance of the joint NPRM discussed in this alert), SAMHSA also issued proposed rules to expand access to opioid-use disorder treatment and help close the gap in care by amending the regulations under 42 C.F.R. part 8.

HHS Is Seeking Feedback:

HHS recognizes the complexity of the changes it is proposing, including the complexity of moving to a use of common terminology under HIPAA and the Part 2 regulations. There are numerous instances where HHS is asking for specific comments from industry and stakeholders, including in circumstances where it is proposing changes reflecting an “assumption” about the impact of a change in Part 2 programs.  The chart linked to this health care alert discusses where HHS has specifically requested comments and provides greater detail about the proposed changes.

Deadline for Comments on the Proposed Regulations:

The deadline for the receipt of comments by HHS is 31 January 2023. The proposed changes in this long-awaited NPRM have significant implications for Part 2 programs.

View the Confidentiality of Substance Use Disorder Records (Part 2) Notice of Proposed Rule Making chart here.

Jianne D. McDonald also contributed to this article.

Copyright 2023 K & L GatesNational Law Review, Volume XIII, Number 23

About this Author

Gina Bertolini Healthcare Lawyer K&L Gates Law Firm Research Triangle Park North Carolina

Gina Bertolini is a partner in the Research Triangle Park officer and concentrates her practice exclusively on health law; primarily representing academic medical centers, hospitals, and health systems. She counsels senior health system and academic medical center leadership on a variety of governance, transactional, operational, and regulatory matters. In this context, she advises hospital, health system, and academic medical center clients on a multitude of legal matters, including state and federal regulatory affairs, such as federal Stark and anti-kickback statutes, EMTALA, HIPAA, and...

Darlene S. Davis, KL Gates, Healthcare transactional matters lawyer, HIPAA privacy attorney

Ms. Davis is a partner in the Research Triangle Park office. She focuses her practice exclusively on health law, primarily representing academic medical centers, health systems, hospitals, home health agencies, hospices, nursing homes, and ancillary service providers, such as laboratories, pharmacies, and durable medical equipment suppliers.

In that capacity, she advises clients on a wide range of regulatory and transactional matters, including the HIPAA privacy, security and breach notification rules; Medicare and Medicaid enrollment and...

Carla DewBerry Healthcare and Corporate Tax Attorney K&L Gates Law Firm Seattle

Carla DewBerry practices in the areas of health care law; mergers and acquisitions; and federal, state and local tax. Carla represents health care clients in Medicare and Medicaid reimbursement matters, including related audits and litigation. In addition, she is an experienced tax and business counselor and represents clients in corporate restructurings, joint venture operations, licensing, and federal and state taxation matters. She provides counsel for clients outside the health care industry as well.

Carla's experience includes working as a...

Jacqueline B. Hoffman Health Care Attorney K&L Gates Dallas, TX

Jacqueline Hoffman is a partner in the firm’s Dallas office. She is a member of the health care and FDA practice group. Ms. Hoffman has experience in the areas of hospital operations and transactions, physician contracting, regulatory compliance and privacy. In her current practice, she provides counseling to healthcare providers including hospital systems, DME providers, IDTFs and pharmacies related to compliance and transactional matters. She is also board certified as a health lawyer in Texas.

Professional Background

Prior to joining the firm, Ms. Hoffman served as...


Martin Folliard is an associate in the firm's Research Triangle Park office. He is a member of the Health Care and FDA practice group.

Prior to joining the firm, Martin served as the Director of Risk and Regulatory Affairs for a dental school in North Carolina. In this role, Martin developed and managed a comprehensive compliance and risk management program for the school, addressing a wide array of regulatory issues including HIPAA Privacy, health care fraud and abuse, patient non-discrimination, and professional liability. Martin also worked...