Close this search box.

+1 (888) 895-8366

On November 28, 2022, the Substance Abuse and Mental Health Services Administration (SAMHSA) released a Notice of Proposed Rulemaking in collaboration with HHS through OCR. This proposal is designed to update the confidentiality of patient records regarding substance use disorders (SUD).

The SAMHSA “42 CFR Part 2” addresses the opioid crisis by helping people feel more comfortable seeking treatment for SUD. Unfortunately, conditions related to substance abuse, mental health, etc., carry stigmas that can damage relationships, reputations, and more. Part 2 aims to protect SUD records to ease patient concerns about discrimination and prosecution.

The CARES Act requires the Secretary to align certain aspects of Part 2 with (HIPAA) Rules and the HITECH Act. Additionally, the Secretary must update the HIPAA Privacy Rule Notice of Privacy Practices requirements with Part 2 protections and rights. The updates posted in this Notice of Proposed Rulemaking fulfill these obligations.


The SAMHSA Notice of Proposed Rulemaking enhances protections and rights for SUD patients. While all of these updates seek to standardize SUD record protections per
HIPAA Rules, we’ve split the key takeaways into 3 sections.


Part 2 programs are “federally assisted organizations that provide alcohol or drug abuse diagnosis, treatment or referral for treatment.” The SAMHSA Notice of Proposed Rulemaking adjusts how these programs must handle SUD records and authorizations. 

If this passes into law unchanged, the following changes will take effect:

Part 2 programs may use a single patient-signed prior consent form for future use and disclosure for treatment, payment, etc. This will reduce the administrative legwork of releasing SUD records for healthcare staff and speed up the patient care process. 

Improved Process Supports Patients Filing Part 2 Complaints.

Part 2 programs may not require patients to waive the right to file a complaint before providing treatment, enrollment, payment, or eligibility for services. These programs must establish a complaint receival process, and they may not take adverse action against patients who file complaints.

Enhanced Individual Patient Rights Align With the Privacy Rule.

Patients will receive the right to request an accounting of disclosures for SUD records. 

Need help keeping up with your accounting of disclosures? Click here to learn how our Automated Audit Log can help at

Patients will also gain the ability to request disclosure restrictions for treatment, payment, and healthcare operations. This grants patients more control over their SUD records if they have reason to limit disclosures.


The breach Notification Rule Will Apply to Part 2 Records.

The Breach Notification Rule requires notification to the Secretary, the affected individual(s), and sometimes the media. If passed, Part 2 records will apply.

The HITECH Act Penalties Will Apply to Part 2 Records.

The HITECH Act cemented a tier-based penalty structure for HIPAA violations. If passed, this update will impose this penalty structure following violations of Part 2 regulations. 

Patient Notice Will be Updated Per HIPAA

The existing Part 2 confidentiality notice requirements will be updated to align with the HIPAA Notice of Privacy Practices. This requires accessible language and a clear description of patient rights, protections, etc.

Permit Court Order Applications for Part 2 Use and Disclosure 

Investigative agencies that unknowingly receive Part 2 records while investigating or prosecuting a Part 2 program can apply for a court order to use or disclose these records if certain preconditions are met. 

The Notice of Privacy Practices for Part 2 records will begin to limit the redisclosure of these records for legal proceedings.

Expand Use and Disclosure Prohibitions

Federal, state, and local authorities will face additional prohibitions for the use and disclosure of part 2 records without a court order or patient consent. This applies to civil, criminal, administrative, and legislative proceedings. 


Until the government passes the Notice of Proposed Rulemaking, current Part 2 regulations will remain in effect. If you would like to dig deeper into the NPRM, click here to review the notice as a whole. 

If you would like to leave comments about the Notice, visit for HHS review.

6 Types of Healthcare Audits For Insurance Companies
Healthcare audits are an essential part of maintaining fairness and accountability as a payor in the healthcare industry.
How Can ERP Insurance Optimize Risk Management?
ERP insurance coverage offers protection from financial losses for a limited period after an existing coverage plan expires.
Leverage Medical Records For Mass Tort Payouts
Mass tort payouts can be massive, but they often require quick and accurate access to your clients' medical records.
Hackensack Meridian Health Penalized $100K For Medical Records Right of Access Penalty
Hackensack Meridian Health, also known as Essex Residential Care, recently faced a $100,000 penalty for Right of Access failure.
What Is the Epic Vs. Particle Health Dispute Regarding Carequality?
The dispute between Epic vs. Particle Health has healthcare professionals split, and this article provides an unbiased breakdown.
Mass Tort Litigation Guide for Personal Injury Attorneys
Mass tort litigation can be a practical way to pursue compensation for numerous personal injury and medical malpractice claimants.

Want to Stay Updated?

Subscribe to our newsletter to learn:

  • Tips to Ensure Compliance
  • Strategies for ROI Success
  • Relevant Healthcare News

We respect your inbox, so we’ll only reach out to share high-quality content.

Sign Up for Automated Care Coordination Updates!

Our automated care coordination and referral management solution is coming soon!
If you’d like to be the first to learn new information and find out when it’s ready, please fill out this form:
This field is for validation purposes and should be left unchanged.