Proposed Changes to 42 CFR Part 2: Five Things Health Centers Should Know

By | Published On: January 10, 2023

In December, the Office for Civil Rights (OCR), in coordination with the Substance Abuse and Mental Health Services Administration (SAMSA), issued a Notice of Proposed Rule Making (NPRM) that would modify the federal regulations that protect the confidentiality of certain substance use disorder (SUD) records (42 CFR Part 2 or “Part 2”). The NPRM implements Section 3221 of the CARES Act which required the Department of Health & Human Services to align certain aspects of Part 2 with the HIPAA Rules and HITECH Act.

In responding to the opioid epidemic, many health centers have developed and/or enhanced their SUD services. Whether the Part 2 regulations apply to SUD records depends upon how the health center provides SUD services and the types of records it receives. The Part 2 regulations require patient consent to disclose Part 2-protected records, except in very limited circumstances. For example, unlike under the HIPAA Privacy Rule which permits disclosure of protected health information for treatment purposes without patient consent, a patient must consent in writing to the disclosure of their Part 2 -protected records for treatment purposes.

Proposed Changes to Part 2

In the NPRM, OCR proposes multiple changes to Part 2. Health centers should note the following:

  1. The NPRM does not propose changes to the definition of a “program” under Part 2 or to how Part 2 would apply to SUD services in a health center. The Part 2 regulations will continue to apply to health centers if: (1) the health center has an identified unit that holds itself out as providing and provides SUD diagnosis, treatment or referral for treatment; (2) a member of the health center’s staff has as their primary function the provision of SUD diagnosis, treatment or referral for treatment and is identified as providing such services; or (3) the health center receives Part 2-protected records.
  2. The NPRM would still require a patient to sign a consent form before the initial disclosure of their Part 2-protected records for treatment, payment and health care operations purposes. If the consent form permits disclosure to all of the patient’s current and future treating providers, health plans, third-party payers and those helping to operate the program, then the Part 2 Program would be permitted to use and disclose the patient’s Part 2-protected records for such purposes without the patient signing an additional consent form.
  3. The NRPM would permit recipients of Part 2-protected records (Part 2 Programs, HIPAA covered entities and business associates) to redisclose Part 2-protected records as permitted by the HIPAA Privacy Rule, with some exceptions.
  4. The NPRM would apply the civil and criminal penalties under HIPAA and the HITECH Act to violations of Part 2, including penalties for wrongful disclosure of Part 2-protected information.
  5. The NRPM does not contain proposals to implement the CARES Act antidiscrimination provisions which OCR expects to develop through separate rulemaking.

Comments on the NPRM are due by January 31, 2022. Until a Final Rule is released, the current regulations remain in effect.

If you have any questions about the proposed changes included in the NPRM, please contact Dianne Pledgie (

Ms. Pledgie is a member of the New York and Massachusetts Bars and is not licensed in Washington, DC. Her practice is limited to federal health care matters.