Putting Part 2’s Data Privacy Protections into Play: 3 Key Considerations

Last year, more than 30 million American adults believed they had a substance use problem, while one out of five young people who suffered a major depressive episode also struggled with substance use disorder (SUD), a SAMHSA survey found. 

But until recently, regulations that governed whether and how SUD data covered by Part 2 treatment could be shared with other providers came saddled with a thick layer of administrative burden, especially when it came to obtaining patient consent. This obstacle limited the ability to carefully coordinate care and services and left some providers in the dark regarding their patients’ whole health needs.

Now, a provision finalized by the U.S. Department of Health and Human Services (HHS) earlier this year strengthens privacy protections around this SUD data while easing the ability to integrate this data with patients’ medical records when patients provide informed consent. The final rule—“Confidentiality of Substance Use Disorder (SUD) Patient Records at 42 CFR Part 2,” or more simply, “Part 2”—aligns more closely with HIPAA once a patient consents to share their information.

It’s a move that helps make this information more broadly available to providers and expands allowable instances of information exchange so this data can be better incorporated into a patient’s general healthcare. For healthcare leaders, though, it presents a host of new considerations around how to effectively manage patient consent to achieve the final rule’s ambitious goals and the missing technologies to do so.

Understanding the Part 2 provision

Perhaps the biggest change to the revised Part 2 regulation, which was finalized in April 2024, is that it allows patients to provide a single consent for sharing of SUD information regulated by Part 2 for the purposes of treatment, payment and healthcare operations. This consent is good for as long as the patient desires, including not having an expiration, though patients may revoke their consent in writing at any time. 

Under the Part 2 final rule, a single signed consent form is all that is needed to share records with past, current and future care partners unless the patient changes or revokes this authorization. Previously, each disclosure required written patient consent, and the records could not be further disclosed except as permitted under the regulations. Moreover, the previous version of Part 2 did not allow patients to consent generally to their data being shared, unless it was a general consent to share with treating providers. Practically, this restriction meant that a patient and provider had to fill-out a consent any time a patient wanted to share information with payers, care coordinators, or anyone besides a treating provider.

While Part 2’s final rule simplifies processes for patients, there is much healthcare leaders must consider in determining how to protect categories of sensitive information like records related to behavioral health and SUD diagnosis and treatment that are covered by Part 2.

For instance, there’s the matter of how to communicate this change to both patients and clinical staff. Already, we’re seeing a lot of misinformation related to the Part 2 rule, such as the belief that the process for sharing SUD records covered by Part 2 is “just like HIPAA now.” It isn’t just like HIPAA — not when there’s still a requirement to obtain separate, informed patient consent to allow HIPAA-covered entities to share these specific records. 

Second, and just like HIPAA’s Privacy Rule for psychotherapy, the notes from SUD counseling sessions must be handled differently. For leaders, this presents the technological question: “How will we parse therapy notes from other data in a patient’s SUD medical record to ensure these notes are not accidentally disclosed?”

There’s also the matter of how to roll out the revised CFR 42 Part 2 informed consents to patients before the final rule takes effect on Feb. 16, 2026. Providers may have consents on file, but these consents likely do not allow for sharing for all treatment, payment, and operations purposes, meaning that providers would need to collect new consents for this type of data sharing.

In addition, because patients are allowed to revoke consents, technologists and other leaders must continue to track these data even once the consent is provided.  A patient may decide to no longer consent, and technologists would have to stop sharing these data within their systems.

Key actions for providers

So much is at stake when it comes to implementing the Part 2 final rule — in particular, patient trust. As allowable instances for SUD data sharing are expanded, if the guidelines for data sharing are not adhered to by providers, then all the work that has gone into revising this regulation will have been for nothing. But the road to compliance doesn’t have to be overwhelming. Here are three essential steps for healthcare leaders in navigating the soon-to-be Part 2 landscape.

1. Determine how to communicate to patients the value of authorizing consent. Data around SUD diagnosis and treatment is highly sensitive, and it’s natural for patients to fear they could be stigmatized by other care professionals and social services agencies if it were shared. That’s why it’s important to communicate to patients not only how the data will be used — to ensure they get the services they need, faster, and for the provision of integrated, whole-person care — but also that they are ultimately in control of their data. Emphasize that patients have the right to know who their information is disclosed to and that they may change or revoke their consent at any time.
2. Evaluate how existing Part 2 consents are maintained and how they hold up under the revised Part 2 final rule. For instances where patients have already provided informed consent, it’s important that new consents be signed to reflect the introduction of Part 2’s revision to allow disclosure for payment and operations in addition to treatment. From there, organizations will have to keep track of which patients that have previously given their consent have signed the new agreement and which ones have not and ensure that those who’ve only consented to sharing their data for treatment purposes are not being disclosed for other, newly permitted uses. If your organization participates with other data exchange and interoperability services, such as a health information exchange (HIE), now is the time to assess plans for incorporating the various types of consent before the final rule takes effect in early 2026.
3. Audit your technological capabilities for complying with Part 2. Although data sharing will likely be easier under the new rule, the data must still be tagged within a system so that these data continue to follow the rules of Part 2, including allowing patients to revoke their consent.  With a slew of evolving state and federal regulations related to SUD medical records, the ability to manage consent and data parsing will remain an ongoing challenge across the healthcare sector. With just over a year before the final rule takes effect, now is the time to evaluate your organization’s interoperability and data management capabilities and dive into the work of complying with the Part 2 final rule to pave the way for smooth implementation.

By taking steps to plan for the new Part 2 regulation, healthcare leaders can gain a head start on engaging patients and their clinical and IT teams and partners in this effort. That’s a prescription for trust in protecting sensitive data for all.

Photo: Flickr user Rob Pongsajapan

This post appears through the MedCity Influencers program. Anyone can publish their perspective on business and innovation in healthcare on MedCity News through MedCity Influencers. Click here to find out how.