Unless your medical practice “creates or maintains” substance use disorder (SUD) records covered by federal law (42 CFR Part 2), you can ignore the barrage of panic-inducing emails you have been receiving informing you that you should update your Notice of Privacy Practices by February 16. Even if your medical practice does “create or maintain” SUD records, the February 16 deadline may or may not require much action on your part, depending upon your desire to consolidate forms.

Part 2 protects “[r]ecords of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance use disorder education, prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States.”

The upcoming deadline was set in motion two years ago. On February 16, 2024, the Department of Health and Human Services’ Substance Abuse and Mental Health Services Administration and the Office for Civil Rights published a final rule amending HIPAA’s Notice of Privacy Practices requirements to align with the Part 2 requirements for the use and disclosure of SUD patient records. Part 2 limits the uses and disclosures of SUD records that would be permissible under HIPAA without authorization from the patient, such as uses or disclosures for treatment, payment, or healthcare operations purposes. In the past, notice of restrictions on the use and disclosure of SUD records would be provided to patients by a SUD program through a separate patient notice.

The final rule states: “We have stated both in HIPAA and part 2 guidance that notices for different purposes may be separate or joint/combined so long as the required elements are included. Thus, either using separate HIPAA, state law, or part 2 notices or combining these notices into one form would be acceptable so long as all required elements are included.”

In short, the final rule gives covered entities that “create or maintain” SUD records the flexibility to choose to combine HIPAA and SUD notices into one form, as part of the same Notice of Privacy Practices, so long as the Notice contains all of the information that is required to be included in a Part 2 patient notice. Or, SUD providers can choose to continue to offer separate notices to patients under HIPAA and Part 2.

For more information, please contact me or your regular Parker Poe contact. Click here to subscribe to our latest alerts and insights.