New federal rule transforms confidentiality protocols for SUD patient records

At a glance:

• HHS finalizes rule allowing single consent for future uses and disclosures of substance use disorder (SUD) patient records.
• HIPAA-covered entities can now redisclose SUD records under new confidentiality regulations.

On February 8, 2024, the U.S. Department of Health & Human Services (HHS) through the Substance Abuse and Mental Health Services Administration (SAMHSA) and the Office for Civil Rights announced a final rule modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR part 2 (“Part 2”).

The final rules allow for the following:

• A single consent for all future uses and disclosures for treatment, payment, and healthcare operations.
• HIPAA‑covered entities and business associates that receive records under this consent to redisclose the records in accordance with HIPAA regulations.

Required elements for written consent

A written consent to a use or disclosure under the regulations in this part may be paper or electronic and must include:

• The name of the patient.
• The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.
• A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.

General requirement for designating recipients

The name(s) of the person(s), or class of persons, to which a disclosure is to be made (“recipient[s]”) is(are) required. For a single consent for all future uses and disclosures for treatment, payment, and healthcare operations, the recipient may be described as “my treating providers, health plans, third‑party payers, and people helping to operate this program” or a similar statement.

Special instructions when designating certain recipients

If the recipient is a covered entity or business associate to whom a record (or information contained in a record) is disclosed for purposes of treatment, payment, or healthcare operations, a written consent must include the statement that the patient's record (or information contained in the record) may be redisclosed in accordance with the permissions contained in the HIPAA regulations, except for uses and disclosures for civil, criminal, administrative, and legislative proceedings against the patient.

Healthcare operations involve activities listed in the definition at 45 CFR 164.501, including quality assessment, patient safety, population health, protocol development, case management, care coordination, and sharing treatment alternatives.

The final rule may be downloaded here.