Evan Dumas 

You’re listening to Group Practice Tech, a podcast by Person Centered Tech, where we help mental health group practice owners ethically and effectively leverage tech to improve their practices. I’m your co-host, Evan Dumas.

 

Liath Dalton 

And I’m Liath Dalton, and we are Person Centered Tech.

 

Liath Dalton 

This episode is brought to you by Therapy Notes. Therapy Notes is a robust online practice management and electronic health record system to support you in growing your thriving practice. Therapy Notes is a complete practice management system with all the functionality you need to manage client records, meet with clients remotely, create rich documentation, schedule appointments and bill insurance all right at your fingertips. To get two free months of Therapy Notes as a new Therapy Notes user go to therapynotes.com and use promo code PCT.

 

Evan Dumas 

Hello and welcome to Episode 532: From HIPAA to Part 2: Preparing for OCR’s New Role in Substance Use Disorder Privacy.

 

Liath Dalton 

Indeed. So what is precipitating this conversation is that on August 26 2025, we got a bulletin from the Office of Civil Rights, those are the HIPAA regulators, but also now the Part 2 or more, specifically, 42 CFR Part 2, rules. And the Part 2 rules relate to Substance Use Disorder records and how they are handled.

 

Liath Dalton 

So we actually have clarity on the final role, Final Rule going into effect and being enforced. But part of why we need to talk about this is because these new rules don’t apply to every HIPAA covered entity, necessarily, And anytime there’s a you know, rule change, a Final Rule goes into effect, and we’re notified that there’s a enforcement date, that generates a whole bunch of questions of, what do I need to do? Does this apply to me? Does it not apply to me? And so on. So we thought we’d get into that.

 

Liath Dalton 

All right. Little quick background. So first of all, as we already said, that Part 2 protects confidentiality of Substance Use Disorder treatment records and goes further in terms of the sort of restrictiveness or protections in place, than HIPAA does. And the whole purpose of that being to prevent stigma and discrimination that often arises in connection with Substance Use Disorder, and the, you know, treatment of Substance Use Disorder.

 

Liath Dalton 

So there’s a difference between Part 2 and the HIPAA Privacy and Confidentiality rules, because HIPAA broadly covers all Protected Health Information.

 

Evan Dumas 

Yeah.

 

Liath Dalton 

Whereas Part 2 has had stricter consent and redisclosure rules for Substance Use Disorder treatment records, right?

 

Liath Dalton 

So in that context, who is subject to Part 2 rules, and this is what’s really important, and before we give the overview, want to also share that per usual, we are including a little handout of sorts, which is a checklist decision tree of sorts to be able to determine if you are subject to Part 2, and in what way. So do check that out. And then it also has a little summary and distillation of what the implications are in terms of redisclosure rules if you are subject to it, or if you are just a lawful holder of records that are subject to Part 2. Okay, Evan, what are Part 2 programs?

 

Evan Dumas 

Yeah, Part 2 programs are like federally, community assisted individuals or entities that provide substance use diagnosis, treatment, referrals for treatment, sometimes units within hospitals or clinics that specialize in SUD, and sometimes it’s just individual staff who are just like addictions counselors, whose primary function is Substance Use Disorder treatment.

 

Liath Dalton 

And where, so for the majority of folks in our audience who are listening to this, they would not be a Part 2 program.

 

Evan Dumas 

No.

 

Liath Dalton 

Right? But some practitioners, individual practitioners or private practice clinics may be subject to Part 2 if they have a clinical focus on diagnosis or treatment of Substance Use Disorders.

 

Evan Dumas 

Mhm.

 

Liath Dalton 

So if you are marketing your practice as having a specialty in Substance Use Disorder diagnosis or treatment, or have core services that are Substance Use Disorder focused, and basically are holding out how, how you present your practice to the public as oriented around Substance Use Disorder, then that would also bring you under Part 2, right?

 

Evan Dumas 

Yeah.

 

Liath Dalton 

So that’s, that’s the area that I think is most applicable to our listeners, is whether or not they are specializing in or promoting their practice and services as addressing Substance Use Disorder.

 

Evan Dumas 

Mhm.

 

Liath Dalton 

So then, equally important is who is not subject to Part 2.

 

Evan Dumas 

True, yeah, also.

 

Liath Dalton 

What’s, what’s the overview there?

 

Evan Dumas 

Yeah, those are just like, you know, general practices clinicians who, you know, incidentally, treat patients with substance concerns; general hospital staff outside the Substance Use Disorder units; peer support groups like AA or NA, unless you know it’s a federally assisted program; nonclinician entities without diagnostic, treatment, referral functions; providers who don’t advertise or license themselves as Substance Use Disorders. Like if you’re not telling people, you’re not subject.

 

Liath Dalton 

Exactly. So really, in a nutshell, what this means is, if your primary focus is on anxiety, depression, trauma, you know any other sort of diagnostic focuses where, of course, the Substance Use Disorder may be co-occurring or adjacent to those primary diagnostic focuses that that you’re addressing, that doesn’t mean that that you are subject to Part 2, right? It’s really it being a primary specialization, not just that you happen to see folks who are dealing with Substance Use Disorder in addition to the primary things that you’re working on them with, right? That is going to encompass the majority of our folks.

 

Liath Dalton 

But what is impactful here is that if you are working with folks who have co-occurring Substance Use Disorder, and you receive records from their other providers that relate to their Substance Use Disorder diagnosis and treatment, then you can still become a what’s called a lawful holder.

 

Liath Dalton 

That’s basically just that you’ve received Part 2 protected records. And basically the changes, the new Final Rule for Part 2, makes being a lawful holder easier to manage. Because it’s removed some of the restrictions on redisclosure that got kind of burdensome, or just became barriers to efficiently and effectively being able to manage TPO functions. TPO being treatment, payment and operations.

 

Liath Dalton 

So these changes are actually good in terms of being easier to manage and so knowing what the new redisclosure rules are for lawful holders is what I think most folks want to zero in on.

 

Evan Dumas 

Mhm, yeah.

 

Liath Dalton 

So what are those new rules, and what does compliance with them look like, in terms of the new 2024 Final Rule?

 

Evan Dumas 

Yeah, well, there’s a, there’s like, one time, sort of broad consent for treatment payment and operations for these Substance Use Disorder records. The redisclosure is allowed under HIPAA, but once it’s, you know, consented to, classic breach notification rules still apply, but there’s now sort of like civil enforcement authority that’s been added to it, and we’ll talk a little bit about OCR’s role in that. And there is a deadline for this compliance, and it’s for February 16, 2026.

 

Liath Dalton 

So there is some time to get things in order ahead of it, without rushing or feeling panicked at the last minute. And basically what, what’s new now, as of August 26, is that the OCR, Office of Civil Rights, are now empowered to enforce Part 2. They can impose penalties and are settlements and issue subpoenas, and patients now have a clear path to file complaints with the OCR. So just like patients are entitled to file complaints for HIPAA Privacy Rule breaches or violations, they can now do the same when it comes to Part 2 violations. But in terms of implications for providers, basically it means that enforcement is now real and there are risks for non-compliance. However, the new rules are less restrictive and easier to implement.

 

Liath Dalton 

So really this is a positive in terms of how it’s going to impact providers, particularly those that are lawful holders. Because classically, part of the sort of amplified anxiety around Part 2 records, or records that are subject to Part 2, was that they are more restrictive, right?

 

Evan Dumas 

Yeah.

 

Liath Dalton 

But that if you’re a lawful holder, which the majority of practices and practitioners that we work with do end up being a lawful holder,

 

Evan Dumas 

Yeah.

 

Liath Dalton 

but there was like, I’m not steeped in it, because I’m not subject to Part 2. And so there was just the anxiety of knowing how to treat these records that had to be treated differently to just regular PHI. So that’s being clarified and opened up now, which is great news.

 

Liath Dalton 

So really, what you want to be doing is evaluating whether or not you are a Part 2 program or a practitioner, and if you are a lawful holder, and then prepare accordingly.

 

Evan Dumas 

Yeah.

 

Liath Dalton 

So if you are a Part 2 program or a practice that is subject to Part 2, because that’s one of your specialties, and that’s how you hold yourself or your practice out to clients, then you’ll be wanting and needing to update consent forms, privacy notices, your breach response plans, and if you’re a group practice or have admin support staff, then also updating staff training around how these are managed.

 

Liath Dalton 

So basically, that’s the the main thing to evaluate, is if you are subject to Part 2, or if you’re a lawful holder, if you are subject to part two, then updating those items that I just listed. If you are not subject to Part 2, but are a lawful holder, the=n just familiarizing yourself with the changes to the disclosure and making any necessary updates there.

 

Evan Dumas 

Yeah.

 

Liath Dalton 

Let me actually just quickly go over the brief recap of the new rule in terms of redisclosure, because I think that’ll help alleviate some of the concerns that might be generated by new rule being enforced.

 

Evan Dumas 

Mhm.

 

Liath Dalton 

As Evan said, there is now the one-time broad consent. So patients can grant a single written consent for use or disclosure of SUD records, and that covers all use of it within the context of treatment, payment and healthcare operations. So basically now that pulls the redisclosure rules into alignment with the classic redisclosure rules that are part of HIPAA when it comes to general redisclosure of PHI.

 

Liath Dalton 

So once consent is given, HIPAA covered entities and business associates acting on their behalf can redisclose records in accordance with HIPAA Privacy Rule. So now that redisclosure isn’t subject to something separate to or distinct from HIPAA’s general privacy rule, rules that pertain to redisclosure.

 

Liath Dalton 

And outside of HIPAA, the restrictions remain in terms of like certain law enforcement disclosures and so on, and the other people, other piece that’s really important related to redisclosure is that if records are redisclosed, they have to, patients need to be notified that their records have been redisclosed, and now they’re protected under HIPAA instead of Part 2.

 

Liath Dalton 

So check out the little decision tree checklist and the written summary of the final rule redisclosure elements, and you make any necessary changes to things ahead of the February 2026, deadline, and you should be all set.

 

Liath Dalton 

But these, again, just to reiterate, are positive updates, and it’s nice to see, you know, clarity around things where there’s consistency with the end goal of of patients being empowered and their information being protected, while still not having kind of unreasonable barriers that hinder effective and efficient treatment, payment and operations related to care being provided and received.

 

Liath Dalton 

So it’s all all good news, which I have to say, does make us happy to see, because this year so far, there have not really been any bulletins from the OCR that have any useful or positive impact on providers or patient benefits that we have seen until this one. So I’m kind of just holding on to, oh, we got a good one. Let’s, let’s celebrate for now and appreciate it as a mild antidote to all of the other ones that have come out. Thanks for listening. We hope you found this helpful, and we’ll talk to you next week.

 

Evan Dumas 

Yeah, talk to you next week, everybody.

 

Liath Dalton 

Take care.

 

Liath Dalton 

This has been Group Practice Tech. You can find us at personcenteredtech.com. For more podcast episodes, you can go to personcenteredtech.com/podcast, or click podcast on the menu bar.