The Privacy Rule and the Data

The data problem in Module 1 has a specific legal history for substance use disorder, and understanding it is necessary to know what changed and what did not.

The barrier was real, and it was justified

Federal regulations at 42 CFR Part 2 have governed the confidentiality of substance use disorder records since the 1970s and were deliberately stricter than the general health privacy rules that came later. Under Part 2, disclosures that HIPAA would permit routinely required patient consent, and records had to be segregated so they could not travel with the rest of the chart.

The reason matters. Records of addiction treatment have been used to fire people, remove their children, and prosecute them. A rule making those records hard to move was protecting patients from documented harm, not indulging paperwork.

The effect on coordination was also real. A patient’s addiction treatment could not follow them to the emergency department that might prescribe them opioids, and the organization accountable for their total cost of care could not see it.

What changed

In February 2024, HHS published a final rule (89 FR 12472) implementing section 3221 of the CARES Act, rewriting Part 2 to align more closely with HIPAA. Three changes matter:

• It replaces consent for each disclosure with permission to use and disclose records “with a single consent given once for all such future uses and disclosures” for treatment, payment, and health care operations.
• It lets recipients redisclose those records under HIPAA’s ordinary rules.
• It states that an entity receiving records under that single consent “is not required to segregate or segment such records.”

The rule took effect in April 2024, and compliance became mandatory on February 16, 2026.

What this means now

That date has passed. The legal justification for behavioral health’s isolation, cited for fifty years, no longer applies in the form it once did. If the data still does not move, then the law was never the only constraint.

Two limits are worth stating precisely, because this change is frequently overstated:

• Part 2 governs substance use disorder records specifically. General mental health records have long been under HIPAA, so the change does not sweep as broadly as some descriptions suggest.
• No national data yet shows whether information actually began moving. Not enough time has passed. The legal barrier changed; whether behavior changed is an open empirical question.

Worth remembering: this is a rare case where a long-standing excuse expired on a known date, which makes it a genuine test. For decades, an organization asked why it could not see a patient’s addiction treatment could point to federal law. That answer is no longer available in the same form. What replaces it will be revealing: if the data still does not flow, the reasons will be the ordinary ones this curriculum names elsewhere, namely that nobody built the interface, no one is accountable for the gap, and the exchange partner had no reason to send it. The privacy rule was a real barrier and it was also, for some organizations, a comfortable one.

Key takeaways

• 42 CFR Part 2 has protected substance use disorder records since the 1970s, more strictly than HIPAA, for documented reasons.
• The February 2024 final rule permits a single consent for treatment, payment, and operations, and removes the segregation requirement.
• Compliance became mandatory February 16, 2026.
• The change covers substance use records specifically, and whether data actually moves is not yet measurable.

Sources

• Confidentiality of Substance Use Disorder (SUD) Patient Records, Final Rule, 89 FR 12472 (opens in a new tab)
• Interoperable Exchange of Patient Health Information Among U.S. Hospitals: 2023 (ONC Data Brief No. 71) (opens in a new tab)