In 2024, the Department of Health and Human Services released a final rule updating the regulations around the use and disclosure of substance use disorder treatment records. Commonly known as “Part 2” records (as the regulations are found at 42 CFR Part 2), these records are subject to different standards than other mental or physical health treatment records. The goal of this final rule was to bring these standards closer to alignment with existing HIPAA regulations, allowing for a reduction in administrative burden and more focus on quality care.
What This Means for HIPAA-Covered Providers
One update applies to all covered entities, regardless of their status as a Part 2 program or not. All providers subject to HIPAA must update their Notice of Privacy Practices (NPP) to include additional information about how they will handle Part 2 information they may receive. The requirement to update your NPP exists whether or not you currently, or ever have, received Part 2 information. It is meant to document how you will handle such information if you ever receive it in the future. These updates must be included in your NPP no later than February 16, 2026.
For existing TherapyNotes customers who already use the built-in Notice of Privacy Practices portal form, we’ve provided sample language below that you can add to your form. Since this form must be customized before use, TherapyNotes cannot add or modify this language on your behalf as we do not alter existing customer data.
To update your form, simply add the sample language to the “Our Uses and Disclosures” section. Once updated, you can use our new “Send All” feature to send the updated NPP to all your active patients who have portal accounts in a single step.
For new TherapyNotes customers, or for practices that have never used the built-in NPP portal form, the default language has already been updated to include the required statements.
Sample Language to Include in Your Notice of Privacy Practices
Use and Disclosure of Substance Use Disorder Records Subject to 42 CFR Part
2:
If applicable, your substance use disorder (“SUD”) records are protected
by federal law under 42 C.F.R. Part 2 (“Part 2”). This law provides extra
confidentiality protections and requires a separate patient consent for the use
and disclosure of SUD counseling notes. Each disclosure made with patient
consent must include a copy of the consent or a clear explanation of the scope of
the consent. It must also be accompanied by a written notice containing the
language in 42 CFR Part 2.32(a). Disclosure of these records requires your explicit
written consent, except in limited circumstances such as: (a) Medical
Emergencies: to the extent necessary to treat you, (b) Reporting Crimes on
Program Premises, (c) Child Abuse Reporting: In connection with incidents of
suspected child abuse or neglect to appropriate state or local authorities, and
(d) Fundraising: We will provide you with an opportunity to decline to receive
any fundraising communications prior to making such communications.
You may revoke this consent at any time.
Prohibitions on Use and Disclosure of Part 2 Records:
SUD records received from programs subject to Part 2, or testimony relaying the
content of such records, shall not be used or disclosed in civil, criminal,
administrative, or legislative proceedings against you unless based
on your written consent, or a court order after notice and an opportunity to be
heard is provided to you or the holder of the record, as provided in Part 2. A court
order authorizing use or disclosure must be accompanied by a subpoena or other
legal requirement compelling disclosure before the requested SUD record is used
or disclosed.
If SUD records are disclosed to us or our business associates pursuant to your
written consent for treatment, payment, and healthcare operations, we or our
business associates may further use and disclose such health information without
your written consent to the extent that the HIPAA regulations permit such uses
and disclosures, consistent with the other provisions in this Notice regarding
PHI.
More information about regulations regarding the use and disclosure of medical records can be found at the Center of Excellence for Protected Health Information website.
