Coverage built for recovery work.

Part 2 records after the 2024 final rule

If your program provides substance use disorder treatment covered by 42 CFR Part 2, its records follow Part 2, not only HIPAA. HHS's Office for Civil Rights and SAMHSA published a final rule in the Federal Register on February 16, 2024. It took effect April 16, 2024, and persons subject to Part 2 had to comply with it by February 16, 2026, so that date has passed. The main changes, as the agencies summarized them:

• One consent for treatment, payment and health care operations. A patient can sign a single consent for future uses and disclosures for those purposes. It applies until the patient revokes it in writing.
• Redisclosure. A HIPAA covered entity or business associate that receives records under that consent may redisclose them in accordance with the HIPAA regulations, except for certain proceedings against the patient.
• Proceedings against the patient. Use and disclosure of records in civil, criminal, administrative or legislative proceedings requires separate consent, and testimony conveying record information in proceedings against a patient is limited absent consent or a court order.
• SUD counseling notes. The rule adds a definition of these notes and consent provisions for their use and disclosure.
• Penalties. Section 2.3 references the HIPAA enforcement authorities in the Social Security Act: section 1176 for civil penalties and section 1177 for criminal penalties.

Part 2 also requires formal policies and procedures that reasonably protect against unauthorized uses and disclosures. For paper and electronic records, they have to cover how records are moved or transmitted, stored, destroyed and de-identified (42 CFR 2.16(a)).

Underwriters for this class often ask how a program handles records. Have the current consent form and the date it was updated ready. Part 2 is a federal rule, so it follows the program into every state where it treats patients.

What DHCS licensing asks of the facility

In California, the State Department of Health Care Services (the "department" under Health and Safety Code 11752) has sole authority in state government to license adult alcohol or other drug recovery or treatment facilities (11834.01). Several of its rules belong in an underwriting submission:

• Two-year licenses, with site visits. DHCS issues new licenses for two years and makes at least one onsite compliance visit during the license period. It may also make announced or unannounced site visits (11834.01).
• Naloxone on site. A licensee must keep at least two unexpired doses of naloxone or another FDA-approved opioid antagonist on the premises at all times, with at least one staff member on site who knows where it is and has been trained to give it. Training is documented in the staff member's personnel file (11834.26(g)).
• Relapse plan. A licensee must have a plan for when a resident relapses, including when a resident is on the premises after using (11834.26(e)). Admission can't be denied based solely on a valid prescription for an FDA-approved narcotic replacement or medication-assisted treatment drug, or on having been under the influence (11834.26(d)).
• Incidental medical services. A facility may permit these services only once DHCS approves it, and the license shows that approval. They are provided by, or under the supervision of, one or more physicians and surgeons knowledgeable about addiction medicine (11834.026). DHCS must offer a single application for licensure plus these services on or before January 1, 2027 (11834.01(d)).
• Detox-only licenses end. A license to provide detoxification-only services expires on July 1, 2027 (11834.26(b)(2)).

When you send a submission, include the license page that shows any incidental medical services approval, your naloxone training log, and your relapse policy. For residential programs, I also quote abuse and molestation coverage at the same time. Outside California, facility licensing varies by state, so start from your state agency's rules.