Change to 42 CFR Part 2 Permits Sharing Deidentified SUD Records with Public Health Authorities
This post was co-authored by School of Government faculty member Kirsten Leloudis and three of the School’s 2024 Summer Law Fellows: Rose Chang, Nevaeh Haddock, and Sheridan King.
On February 16, 2024, the U.S. Department of Health and Human Services (HHS) published a Final Rule that modifies the regulations found at 42 CFR Part 2, which govern the confidentiality of certain substance use disorder (SUD) treatment records. The Final Rule made numerous significant changes to how SUD records that are protected by 42 CFR Part 2 may be used and disclosed. This blog post focuses on just one of those changes: a new provision that allows SUD records to be shared with public health authorities (PHAs) if the information has been deidentified in accordance with HIPAA.
Background
Origins of 42 CFR Part 2
The regulations codified at 42 CFR Part 2 were promulgated in 1975 and are officially known as the “Confidentiality of Substance Use Disorder Patient Records” regulations; however, the regulations are more often colloquially referred to as the “Part 2” laws. At the time of their inception, the regulations were intended to ensure that patients seeking SUD treatment from federally supported programs would not have their treatment records used against them, which could deter existing and potential future SUD treatment patients from obtaining care.
Nearly 50 years later, the regulations at 42 CFR Part 2 remain relevant. According to the most recent data from the HHS National Survey on Drug Use and Health (NSDUH), in 2021, 46.3 million people age 12 or older (or approximately 16.5% of the national population) met the diagnostic criteria for a SUD in the past year. In 2021, 94% of people over age 12 who had a SUD did not receive treatment. Although SUDs are common and can affect people from all walks of life, SUDs continue to be stigmatized and SUD-related behaviors (e.g., purchase of illicit substances, possession of injection supplies) are often criminalized. For people living with a SUD, stigma and concern about legal consequences can be barriers to accessing SUD treatment. Today, the regulations at 42 CFR Part 2 continue to provide stringent protections around how an individual’s SUD records can be used and disclosed with and without the patient’s consent.
Timeline of the Final Rule
In December 2022, HHS issued a notice of proposed rulemaking (NPRM) and sought public comments on the agency’s vision for modifying the regulations at 42 CFR Part 2. As HHS explained in the NPRM, the agency’s proposed changes to 42 CFR Part 2 were prompted by requirements in section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act, which instructed HHS to align parts of 42 CFR Part 2 more closely with HIPAA. The alignment of these two sets of federal regulations is meant to support interoperability and facilitate lawful information sharing in the health and mental health care fields, all while still protecting patient privacy.
