Netsmart Supports Whole-Person Care Provisions in 42 CFR Part 2 Final Rule

Netsmart Media Contact:
Natalie Caruso
ncaruso@ntst.com  
913.308.2080 

OVERLAND PARK, Kan., Feb. 20, 2024 —  Netsmart issued the following statement in response to the U.S. Department of Health and Human Services (HHS), through its Substance Abuse and Mental Health Services Administration (SAMHSA) and Office for Civil Rights (OCR), announcement of a Final Rule modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR Part 2 (“Part 2”).

With this rule, HHS is implementing the confidentiality provisions of section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act, which require the Department to align certain aspects of Part 2 with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Rules and the Health Information Technology for Economic and Clinical Health Act (HITECH).

These modifications aim to enhance privacy protections for individuals receiving SUD treatment. The Final Rule fosters improved coordination among healthcare providers treating individuals with SUD, reinforces confidentiality safeguards through civil enforcement measures, and promotes the integration of behavioral health data with other medical records to support patient health outcomes.

"This Final Rule closely reflects our long-held advocacy position that the ultimate goal of consent should be that any person – whether suffering from mental illness, diabetes, a substance use disorder, or multiple co-occurring conditions – should be able to provide consent to share their health data with their healthcare providers, utilizing today’s technology, with equal simplicity, if they so desire,” said Netsmart Executive Vice President Kevin Scalia. “In addition, allowing a single consent for future uses and disclosures to downstream providers (with associated privacy protections) enables a true continuum of care, removing significant barriers to electronic health information exchanges which we believe will support care to persons with a SUD or history of SUD treatment.”

Significant provisions in the Final Rule include:

• Allows a single consent for future uses and disclosures for treatment, payment and healthcare operations just like people with diabetes or cancer.
• Allows HIPAA-covered entities that receive records under this consent to redisclose the records in accordance with the HIPAA regulations.
• Permits disclosure of records without patient consent to public health authorities, provided that the records disclosed are de-identified according to the standards established in the HIPAA Privacy Rule.
• Aligns Part 2 penalties with HIPAA by replacing criminal penalties currently in Part 2 with civil and criminal enforcement authorities that also apply to HIPAA violations. Penalties issued for violations under HIPAA far exceed those under Part 2.  
• Adds an express statement that segregating or segmenting Part 2 records is not required.
• Retains provision that patients’ SUD treatment records cannot be used to investigate or prosecute the patient without written patient consent or a court order.
• States that records obtained in an audit or evaluation of a Part 2 program cannot be used to investigate or prosecute patients, absent written consent of the patients or a court order that meets Part 2 requirements.
• Strengthens penalties by applying the same requirements of the HIPAA Breach Notification Rule to breaches of records under Part 2.

Netsmart has advocated for more than ten years on behalf of its human services and post-acute clients and other providers across the country for updates to the decades-old 42 CFR Part 2 statute to reflect the evolving focus on care coordination, care integration and care management while also strengthening penalties for privacy violations. As a founding member of The Partnership to Amend 42 CFR Part 2, Scalia stated the long-awaited Final Rule is another step forward for coordinated, whole-person care for individuals nationwide.

These major changes to 42 CFR Part 2 will take effect on February 16, 2026. To learn more about these regulation changes, read the 42 CFR Part 2 Final Rule Fact Sheet and register for the upcoming Netsmart webinar on Thursday, March 28 at 1 p.m. ET. The informative session will feature Netsmart leaders Krista Logan, Senior Regulatory Solution Strategist and Neal Tilghman, Senior Director & GM of Addictions and Mental Health covering human services regulatory and funding forecast and review.

About Netsmart

Netsmart, a leading provider of Software as a Service (SaaS) technology and services solutions, designs, builds and delivers electronic health records (EHRs), health information exchanges (HIEs), analytics and telehealth solutions and services that are powerful, intuitive and easy-to-use. Our platform provides accurate, up-to-date information that is easily accessible to care team members in the human services and post-acute care (which is comprised of skilled nursing, home care, hospice, palliative and senior living), and payer markets. We make the complex simple and personalized so our clients can concentrate on what they do best: provide services and treatment that support whole-person care.

By leveraging the powerful Netsmart network, care providers can seamlessly and securely integrate information across communities, collaborate on the most effective treatments and improve outcomes for those in their care. Our streamlined systems and personalized workflows put relevant information at the fingertips of users when and where they need it.