Part 2 records within the wider medical record in order to ensure compliance with “the continuing prohibition on use and disclosure of the records in investigations or proceedings against the patient, absent written consent or a court order.”Adopt HIPAA standards at 45 C.F.R. 164.514(b) for de-identification of records for release to public health authorities.Align civil and criminal penalties for violations, breach notification rules, and patient notice to those under HIPAA.Extend the period that an audit of disclosures of Part 2 records by intermediaries must be maintained from two years to three years.A summary of the new rules was published by HHS and is available .All entities subject to Part 2 must be in compliance by February 16, 2026.Dinsmore health care attorneys are highly skilled in this regulatory environment and are available to help you start transitioning your practice to the new Part 2 requirements. See CARES Act, Section 3221. Section 2.33. Section 2.11. Section 2.31; 89 Fed. Reg. 12472, 12506. Section 2.33. Sections 2.12, 2.23, Subpart E. Section 2.12. 89 Fed. Reg. 12472, 12505, 12513. Sections 2.12, 2.16 and 2.52. Sections 2.3, 2.16, and 2.22.

ement.16 45CFR §§ 164.308(a)(2) and 164.530(a).17 45CFR part 164, subpart E (§§ 164.500-164.534).18 45CFR part 164, subpart C (§§ 164.302-164.318).19 45CFR §164.502, Subpart D (§§ 164.400-414).20 45CFR §164.50221 45CFR §§164.506 and 164.522(a).22See 45CFR § 164.510.23 45CFR § 164.512.24 45CFR §§ 164.502(b) and 164.514(d).25 45CFR § 164.514(h).26 45CFR § 164.522(a).27 45CFR § 164.522(b).28 45CFR § 164.524.29 45CFR § 164.526.30 45CFR § 164.528.31See, e.g., https://www.hhs.gov/about/news/2024/04/01/hhs-office-civil-rights-imposes-civil-monetary-penalty-new-jersey-nursing-facility-failing-provide-timely-access-patient-records.html.32https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html.33 45CFR §§ 164.316(a), 164.404(a), and 164.530(f).34See 75 FR 48078-79.35See Press Release at https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/examples/rite-aid/index.html.36 75 FR 40878 (7/14/10)37 45CFR § 164.508(c).38 45CFR § 164.520.39 89 FR 32976 (4/26/24).40 89 FR 12472 (2/16/24).41 45CFR §§ 164.308(b) and 164.502(e).42 45CFR § 160.103.43 45CFR § 160.103.44 45CFR § 164.504(e)(1).45 45CFR § 160.402(c).46 78 FR 5581.47 45CFR § 164.103.48 45CFR § 164.308(a)(1).49See Press Release at http://www.hhs.gov/news/press/2013pres/12/20131226a.html.50 45CFR § 164.502(a)(1); see Guidance at http://www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/incidentalusesanddisclosures.html.51 45CFR §§ 164.308 to 164.316 and AppendixA to 45CFR part 164, subpart C.52 45CFR § 164.530(c).53 45CFR § 164.530(b); see also 45CFR §§ 164.308(a)(5) and 164.414(a).54 45CFR § 164.530(b).55 75 FR 40879.56 45CFR § 164.530(d)-(f).57 45CFR §§164.314(a)(2) and 164.504(e)(2).58 45CFR § 164.402.59 45CFR § 160.410.60 45CFR § 164.404.61 45CFR § 164.408(c).62 45CFR § 164.408(b).63 45CFR § 164.406.64 45CFR § 164.404(c)-(d).65 45CFR §§ 164.316(b), 164.414(a), and 164.530(j).66 45CFR § 160.203.67 45CFR § 160.202.68 86 FR 6446 (1/21/21).

eedings, or by coroners and medical examiners.Requiring modifications to covered entities’ HIPAA privacy policies and Notice of Privacy Practices to conform to the Rule.Compliance with the rule is required by December 23, 2024, which means that employers who sponsor self-insured group health plans, and other covered entities, must amend their HIPAA privacy and security policies and operations. Covered entities subject to the Rule are not, however, required to amend their Notice of Privacy Practices until February 16, 2026.Notably, the Rule incorporates modifications related to the use and disclosure of substance use disorder information under the Confidentiality of Substance Use Disorder (“SUD”) Patient Records final rule. Inevitably, this means that covered entities must incorporate the recent changes under the SUD final rule.HIPAA Privacy Rule to support Reproductive Health Care Privacy, 89 F.R. 32976 (April 26, 2024); Confidentiality of Substance Use Disorder (SUD) Patient Records, 89 F.R. 12472 (February 16, 2024).

rivacy Rule. However, these records cannot be used in civil, criminal, administrative, and legislative proceedings against patients without specific consent or a court order, which is more stringent than the HIPAA standard. Additionally, the rules require a separate patient consent for the use and disclosure of SUD counseling notes.The final rule also creates a safe harbor that places a limit on civil or criminal liability for investigative agencies that act with reasonable diligence to determine whether a provider is subject to the regulation before making a demand for records in the course of an investigation. The safe harbor requires investigative agencies to take certain steps in the event they discover they received applicable records without having first obtained the requisite court order. Other major changes to the rule include modifications regarding penalties, notification of breaches, and patient notice requirements to better align with HIPAA.The full text of the Final Rule, 89 FR 12472, can be accessed here.Rural Opioid Treatment and Recovery InitiativeOn March 6, 2024, HHS published a press release announcing the Biden-Harris administration’s launch of a nearly $50 million initiative to support opioid treatment and recovery services in rural communities. Through HHS’ Health Resources and Services Administration (HRSA), the Rural Opioid Treatment and Recovery Initiative will support rural areas in responding to the opioid crisis; expand the rural substance use treatment workforce; support key populations such as adolescents, young adults, and individuals with justice involvement; and respond to rural communities’ needs. Applications will be accepted through May 6, 2024, and can be submitted online here.Applicants for the grant are able to integrate supportive services, such as food access, housing support, employment training and opportunities, and other social determinants of health into their proposals. Funding may support transportation to facilitate access to tr