What is 42 CFR Part 2, and who does it apply to?
42 CFR Part 2 (Part 2), titled "Confidentiality of Substance Use Disorder Patient Records" is part of the regulations published by the U.S. Department of the Health and Human Services (HHS) that serves to protect patient health records created or received by "Part 2 programs."
"Part 2 programs" are facilities that are federally assisted and hold itself out as providing or provide substance use disorder (SUD) diagnosis, treatment, or referral for treatment.
Federally assisted programs are organizations that receive Medicare and/or Medicaid reimbursement or receive federal funds in some manner.
The following IDHS/SUPR licensed organizations licensed to provide SUD treatment are considered Part 2 programs, if they receive federal assistance including Medicare, Medicaid, or funds awarded through the Substance Use Prevention, Treatment, and Recovery Services block grant.
Organizations defined as a Part 2 program must maintain continued compliance with 42 CFR Part 2.
Why were there changes made to 42 CFR Part 8?
HHS made amendments to increase regulatory alignment between title 42 CFR Part 2 and key aspects of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
When was the regulation released?
HHS published the ?nal revisions to the regulation on February 8, 2024.
Do organizations need to start complying with 42 CFR Part 2 immediately?
No. The regulation becomes effective on April 16, 2024, and organizations must come into compliance no later than February 16, 2026.
Below you can ?nd some of the major changes in the new Part 2 Regulation and Documents and Procedures that may be affected. IDHS/SUPR is reviewing the regulation and expects to provide guidance for documents and procedures that are also regulated by Illinois Administrative Rule Part 2060.
| Area Affected |
Overview of Changes |
Documents or Procedures That May Be Affected |
| Patient Consent |
- Allows for a single consent for all future uses and disclosures for treatment, payment, and health care operations
- Allows HIPAA covered entities and business associates to redisclose records in accordance with HIPAA regulations
|
- Release of Information form and procedures
- Re-disclosure form and procedures
|
| Patient Notice |
- Aligns Part 2 Patient Notice requirements with HIPAA Notice of Privacy Practice
|
- Notice of Privacy Practice forms and procedures
|
| Patient Rights |
- Provides patients with additional rights that closely align with the rights provided in HIPAA Privacy Rule
|
- Patient rights documents, procedures, posters
|
|
|
- Applies HIPAA Breach Noti?cation Rule to breaches of unsecured records by Part 2 programs
|
- Policy and procedures related to securing patient records
|
| Counseling Notes |
- Creates a new definition for SUD clinician's notes
- Requires SUD counseling notes are maintained separately from the rest of the medical record
|
- Policy and procedures related to creating and maintaining SUD counseling notes
|
What can organizations do to prepare and comply with 42 CFR Part 2?
Organizations should review the ?nal regulation.
IDHS/SUPR is reviewing the new regulation and expects to provide guidance. Keep your licensure contact information up to date to ensure you receive noti?cations about 42 CFR Part 2.
HHS will develop guidance on how to comply with the new requirements.
Organizations should review their program policies and procedures and related forms (e.g., patient consent, patient notice) to determine where changes will need to be made.
