HHS’ Office for Civil Rights has begun enforcing confidentiality protections for substance use disorder patient records as part of President Donald Trump’s Great American Recovery Initiative.
The program, which launched Feb. 16, implements the substance use disorder confidentiality provision of Section 3221 of the Coronavirus Aid, Relief and Economic Security Act and its implementation regulation at 42 CFR part 2. Civil enforcement mechanisms will be available to protect the confidentiality of SUD patient records by covered SUD programs, according to a Feb. 13 HHS news release.
Penalties for noncompliance align with those available under the Health Insurance Portability and Accountability Act of 1996 Privacy, Security and Breach Notification Rules. OCR investigations may be resolved through resolution agreements, monetary settlements, commitments for corrective action or civil money penalties, according to the release.
The OCR accepts complaints alleging violations of the regulation protecting the confidentiality of SUD patient records and notifications of breaches of SUD patient records.
HHS published a final rule in February 2024 modifying 42 CFR part 2 to implement Section 3221 of the CARES Act and align federal privacy standards for SUD records more closely with HIPAA and the Health Information Technology for Economic and Clinical Health Act of 2009.
