ChartRequest Logo

+1 (888) 895-8366

Proposed SAMHSA Updates Align 42 CFR Part 2 with HIPAA Rules

Law Firm

On November 28, 2022, the Substance Abuse and Mental Health Services Administration (SAMHSA) released a Notice of Proposed Rulemaking in collaboration with HHS through OCR. This proposal is designed to update the confidentiality of patient records regarding substance use disorders (SUD).

The SAMHSA “42 CFR Part 2” addresses the opioid crisis by helping people feel more comfortable seeking treatment for SUD. Unfortunately, conditions related to substance abuse, mental health, etc., carry stigmas that can damage relationships, reputations, and more. Part 2 aims to protect SUD records to ease patient concerns about discrimination and prosecution.

The CARES Act requires the Secretary to align certain aspects of Part 2 with (HIPAA) Rules and the HITECH Act. Additionally, the Secretary must update the HIPAA Privacy Rule Notice of Privacy Practices requirements with Part 2 protections and rights. The updates posted in this Notice of Proposed Rulemaking fulfill these obligations.


The SAMHSA Notice of Proposed Rulemaking enhances protections and rights for SUD patients. While all of these updates seek to standardize SUD record protections per
HIPAA Rules, we’ve split the key takeaways into 3 sections.


Part 2 programs are “federally assisted organizations that provide alcohol or drug abuse diagnosis, treatment or referral for treatment.” The SAMHSA Notice of Proposed Rulemaking adjusts how these programs must handle SUD records and authorizations. 

If this passes into law unchanged, the following changes will take effect:

Part 2 programs may use a single patient-signed prior consent form for future use and disclosure for treatment, payment, etc. This will reduce the administrative legwork of releasing SUD records for healthcare staff and speed up the patient care process. 

Improved Process Supports Patients Filing Part 2 Complaints.

Part 2 programs may not require patients to waive the right to file a complaint before providing treatment, enrollment, payment, or eligibility for services. These programs must establish a complaint receival process, and they may not take adverse action against patients who file complaints.

Enhanced Individual Patient Rights Align With the Privacy Rule.

Patients will receive the right to request an accounting of disclosures for SUD records. 

Need help keeping up with your accounting of disclosures? Click here to learn how our Automated Audit Log can help at

Patients will also gain the ability to request disclosure restrictions for treatment, payment, and healthcare operations. This grants patients more control over their SUD records if they have reason to limit disclosures.


The breach Notification Rule Will Apply to Part 2 Records.

The Breach Notification Rule requires notification to the Secretary, the affected individual(s), and sometimes the media. If passed, Part 2 records will apply.

The HITECH Act Penalties Will Apply to Part 2 Records.

The HITECH Act cemented a tier-based penalty structure for HIPAA violations. If passed, this update will impose this penalty structure following violations of Part 2 regulations. 

Patient Notice Will be Updated Per HIPAA

The existing Part 2 confidentiality notice requirements will be updated to align with the HIPAA Notice of Privacy Practices. This requires accessible language and a clear description of patient rights, protections, etc.

Permit Court Order Applications for Part 2 Use and Disclosure 

Investigative agencies that unknowingly receive Part 2 records while investigating or prosecuting a Part 2 program can apply for a court order to use or disclose these records if certain preconditions are met. 

The Notice of Privacy Practices for Part 2 records will begin to limit the redisclosure of these records for legal proceedings.

Expand Use and Disclosure Prohibitions

Federal, state, and local authorities will face additional prohibitions for the use and disclosure of part 2 records without a court order or patient consent. This applies to civil, criminal, administrative, and legislative proceedings. 


Until the Notice of Proposed Rulemaking is passed, current Part 2 regulations will remain in effect. If you would like to dig deeper into the NPRM, click here to review the notice as a whole. 

If you would like to leave comments about the Notice, visit for HHS review.

Learn about how our 5 tips for reducing burnout in healthcare can improve staff retention and ensure a great patient experience.
Computer Laptop
Medical records are a crucial aspect of healthcare, providing healthcare providers with comprehensive information about a patient’s medical history. If you’re still keeping records on
Retrieving Client Medical Records
Learn how care coordination software can help your hospital improve the patient experience, reduce overhead costs, and increase revenue.
Information Blocking
The Cures Act information blocking exceptions enable healthcare providers to adjust or decline certain medical records requests.
Accounting Disclosures
An accounting of disclosures is more complicated than one may think, so we've assembled a guide for healthcare providers to navigate accounting requests.
Law Firm
On November 28, 2022, the Substance Abuse and Mental Health Services Administration (SAMHSA) released a Notice of Proposed Rulemaking in collaboration with HHS through OCR.