In 2024, HHS amended 42 CFR Part 2 to improve alignment with HIPAA. One of these changes involves new protections for "substance use disorder (SUD) counseling notes." This resource explains these new protections in detail.
Sharing and protecting records
To improve treatment outcomes and promote continuity of care, it may be essential for staff at different programs to share client information about treatment for mental health and substance use disorders. The resources in this section are meant to explain when programs and providers can receive and re-disclose substance use disorder treatment information and mental health information.
Sharing and protecting records resources
This module is designed to help professionals who provide or administer substance use disorder related services identify what constitutes a medical emergency, and describes who may receive records pursuant to the medical emergency exception under Part 2.
Archived recording of May 2023 webinar facilitated by the CoE-PHI to explain how the federal health privacy regulations apply to medications for opioid use disorder (MOUD) in correctional entities, especially jails, prisons, and detention centers. This webinar includes common scenarios in which patient information may or may not be shareable, and assists learners in determining the proper course of action for each scenario.
The federal confidentiality protections for substance use disorder (SUD) treatment records under 42 CFR Part 2 generally require a patient’s written consent to share information. Providers often have questions about how to fill out a consent form that authorizes disclosures to multiple parties in a way that complies with Part 2 and the HIPAA Privacy Rule.
Archived recording of March 2023 two-part virtual learning series facilitated by the Mental Health Technology Transfer Center (MHTTC) Network and the CoE-PHI to assist mental health professionals working in schools in understanding how the federal health privacy laws apply to student mental health information
During the COVID-19 public health emergency (PHE) the U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) sought to increase patient access to telehealth services by waiving penalties for violations of certain requirements under HIPAA. OCR also provided flexibility for sharing patient identifying protected heath information (PHI) for public health purposes. With the end of PHE, these measures have expired.