View Rule

This final rule, to be issued in coordination with the Substance Abuse and Mental Health Services Administration (SAMHSA), would implement provisions of section 3221 of the CARES Act. Section 3221 amended 42 U.S.C. 290dd-2 to better harmonize the 42 CFR part 2 (part 2) confidentiality requirements with certain permissions and requirements of the HIPAA Rules and the HITECH Act. This final rule also would implement the requirement in section 3221 of the CARES Act to modify the HIPAA Privacy Rule NPP provisions so that HIPAA covered entities and part 2 programs provide notice to individuals regarding part 2 records, including patients’ rights and uses and disclosures permitted or required without authorization.

Overall Description of Deadline: The CARES Act requires revisions to regulations with respect to uses and disclosures of information occurring on or after the date that is 12 months after the date of enactment of the Act (March 27, 2021); and not later than one year after the date of enactment, an update to the Notice of Privacy Practices (NPP) provisions of the HIPAA Privacy Rule at 45 CFR 164.520.