The compliance deadline for the 2024 final rule amending the US Confidentiality of Substance Use Disorder Patient Records regulations (42 CFR Part 2) arrives today.
Key points
- Patients can give a single consent for future uses and disclosures for treatment, payment and healthcare operations.
- HIPAA-style breach notification requirements now apply to Part 2 records.
- Security policies and procedures are required for both paper and electronic records.
- Civil and criminal penalties are aligned with HIPAA, while limits on use in legal proceedings against patients remain.
UK providers of health software or services handling US substance use disorder records should check that their consent, security and breach response processes meet the updated rules.
Source: 42 CFR Part 2 final rule (Federal Register)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
