Earlier this year, the U.S. Department of Health and Human Services (HHS) issued a final rule that aims to enhance care coordination for people with substance use disorder (SUD). The final rule modifies the Confidentiality of SUD Patient Records regulations under Title 42 of the Code of Federal Regulations (42 CFR part 2, commonly known as “Part 2”) by granting greater information-sharing flexibilities among applicable providers and simplifying SUD record-keeping. It also strengthens compliance standards and preserves the previous requirement that SUD records not be used in criminal or civil proceedings without consent or a court order. The compliance date for the new rule is February 16, 2026. The final rule implements Section 3221 of the bipartisan Coronavirus Aid, Relief, and Economic Security (CARES) Act, which requires HHS to bring Part 2 into closer alignment with Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act.
The final rule is designed to enhance care coordination for people with SUD. Most significantly, it newly allows all federally assisted SUD providers (e.g., outpatient SUD providers, opioid treatment programs), including non-profits, (known as “Part 2 programs”) to obtain a single, general record-sharing consent from a patient for all current and future disclosures. Redisclosure based on the single consent also newly applies to the recipients of Part 2 data, which tend to be medical or behavioral health entities such as hospitals, primary care providers, and health plans.
EVIDENCE ROUNDUP
This blog post is part of a Playbook series connecting evidence and implementation resources with emerging state and federal policies to help enhance services for people with complex needs.
Why is this important?
Only one in four people with SUD received treatment in the U.S. last year, despite an unrelenting drug overdose epidemic, largely driven by opioids and increasingly involving polysubstance use, that saw nearly 108,000 overdose deaths in 2022. A growing number of evidence-based models of care, such as medications for opioid use disorder (MOUD) and peer support services, are becoming available to address this crisis and these models may involve multiple provider types, including specialty SUD treatment providers, mainstream medical providers, and peer support specialists. These team-based approaches to care are focused on meeting people with SUD where they are, such as within emergency departments, primary care and inpatient settings, and through street medicine.
Care coordination is key to these models, which often involve multiple settings and more players on a person’s care team. However, federal regulations under 42 CFR part 2 have historically hampered critical information-sharing efforts among providers, including primary care providers and health plan care managers. For example, the regulations historically required Part 2 programs to obtain patient written consent for each disclosure of SUD treatment-related records, including specific details for each provider to whom disclosure was allowed. Also, the provider receiving the patient information was subject to these requirements for any redisclosure and was required to segregate Part 2 data from their other medical records.
Established in 1975 to reduce the stigma of addiction treatment, 42 CFR part 2 sought to protect patients’ SUD records to alleviate fears of legal or employment consequences (e.g., getting arrested or losing a job). Yet providers have had difficulty applying the regulations during patient interactions and have concerns about SUD-related record-keeping in integrated care settings becoming a barrier to SUD screening.
This final rule presents an opportunity to reeducate patients and providers on what can happen (and what cannot happen) to the current and future uses of these records so that people with SUD feel safe seeking the treatment they need. On a related note, as SUD records become more ubiquitous in more provider settings, it is important to educate providers about implicit bias. Recent studies have shown that stigmatizing attitudes of providers often show up in patient medical records, which may influence how clinicians respond to and treat people with SUD.
Resources on New Regulations
The compliance date for the new rule is February 16, 2026, allowing time for applicable providers to obtain training and establish new protocols, including with resources to be developed by HHS through the Center of Excellence for Protected Health Information. Education about the new rule is imperative, particularly given new patient notice requirements, the alignment of new enforcement authorities with HIPAA, and the need to protect records from being used for criminal or civil proceedings without patient consent or a court order. Health care providers, policymakers, and health plans can use the following resources to better understand the new rule modifying the confidentiality of SUD patient records and its implications.
- Center of Excellence for Protected Health Information (COE PHI) – This technical assistance center supports a wide range of state and local government agencies, providers, and patients with training and resources related to federal privacy laws and regulations, including how to apply them.
- Fact Sheet 42 CFR Part 2 Final Rule – This fact sheet, prepared by the HHS Office for Civil Rights, outlines the major changes to Part 2 in the final rule, as well as changes since the 2022 notice of proposed rulemaking. See also a related webinar summarizing this background and recent changes to Part 2.
- Changes to the Substance Use Disorder Confidentiality Regulation: Implications for Stakeholders – This blog post details this final rule for Part 2 programs, Part 2 recipients, electronic health record (EHR) vendors and health information exchanges, and patients, including highlighting comparisons and contrasts with HIPAA.
- Using 42 CFR Part 2 Revisions to Integrate Substance Use Disorder Treatment Information into Electronic Health Records at a Safety Net Health System – This peer-reviewed study assesses the experience of a safety-net hospital system that leveraged SUD disclosure flexibilities that were added to Part 2 in 2020 (and were also in the 2024 final rule) to integrate SUD treatment data into an EHR. The study found that the changes facilitated better patient care coordination and improved quality management of the program.
In addition to the above resources, the Playbook’s Addiction Care Collection offers resources and toolkits on evidence-based models of care for SUD.
Share Your Resources and Tools for SUD Information-Sharing for Improved Care Coordination
Do you have a resource or emerging best practice related to information-sharing for improved care coordination of people with SUD? Share your experience with the Playbook. We are interested in growing our library of evidence and implementation best practices to help those in the field strengthen and build successful programs in communities across the nation.