View Rule

View EO 12866 Meetings Printer-Friendly Version     Download RIN Data in XML

HHS/OCR RIN: 0945-AA16 Publication ID: Fall 2022 
Title: Confidentiality of Substance Use Disorder Patient Records 

This rulemaking, to be issued in coordination with the Substance Abuse and Mental Health Services Administration (SAMHSA), would implement provisions of section 3221 of the CARES Act. Section 3221 amended 42 U.S.C. 290dd-2 to better harmonize the 42 CFR part 2 (part 2) confidentiality requirements with certain permissions and requirements of the HIPAA Rules and the HITECH Act. This rulemaking also would implement the requirement in section 3221 of the CARES Act to modify the HIPAA Privacy Rule NPP provisions so that HIPAA covered entities and part 2 programs provide notice to individuals regarding part 2 records, including patients’ rights and uses and disclosures permitted or required without authorization.

Agency: Department of Health and Human Services(HHS)  Priority: Other Significant 
RIN Status: Previously published in the Unified Agenda Agenda Stage of Rulemaking: Proposed Rule Stage 
Major: No  Unfunded Mandates: No 
CFR Citation: 42 CFR 2    45 CFR 160    45 CFR 164   
Legal Authority: 42 U.S.C. 290dd-2 amended by the Coronavirus Aid, Relief, and Economic Security Act (the CARES Act), Pub. L. 116-136, sec. 3221 (March 27, 2020)    Health Information Technology for Economic and Clinical Health (HITECH) Act, Pub. L. 111-5, sec. 13402 and 13405 (February 17, 2009)    Health Insurance Portability and Accountability Act of 1996 (HIPAA) Pub. L. 104-191, sec. 264 (August 21, 1996)    Social Security Act, Pub. L. 74-271 (August 14, 1935) (see secs. 1171 to 1179 of the Social Security Act, 42 U.S.C. 1320d to 1320d–8).   
Legal Deadline:
Action Source Description Date
NPRM  Statutory    03/27/2021 

Overall Description of Deadline: The CARES Act requires the revisions to regulations with respect to uses and disclosures of information occurring on or after the date that is 12 months after the date of enactment of the Act (March 27, 2021); and not later than one year after the date of enactment, an update to the Notice of Privacy Practices (NPP) provisions of the HIPAA Privacy Rule at 45 CFR 164.520.

Action Date FR Cite
NPRM  12/02/2022  87 FR 74216   
NPRM Comment Period End  01/31/2023 
Regulatory Flexibility Analysis Required: No  Government Levels Affected: None 
Small Entities Affected: No  Federalism: No 
Included in the Regulatory Plan: No 
RIN Data Printed in the FR: No 
Agency Contact:
Marissa Gordon-Nguyen
Senior Advisor for Health Information Privacy Policy
Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue SW,
Washington, DC 20201
Phone:800 368-1019
TDD Phone:800 537-7697