On January 18, 2017, the Secretary of Health and Human Services (HHS) published a final rule that amends the federal regulations responsible for safeguarding the privacy of patient records maintained by substance use disorder treatment programs across the country. These regulations, known simply as Part 2 after their location in the Code of Federal Regulations, were first promulgated in 1975 and had not been revised substantively since 1987. According to the HHS Substance Abuse and Mental Health Services Administration (SAMHSA), which administers Part 2, the changes in the final rule are intended "to better align [Part 2] with advances in the U.S. health care delivery system while retaining important privacy protections." The Part 2 law and implementing regulations were written at a time when treatment for substance use disorders was offered primarily by specialty providers. Some individuals with substance use disorders, however, were reluctant to seek treatment because they feared that disclosure of information about their condition might lead to prosecution, discrimination by health insurers, or loss of employment, housing, or child custody. The aim of Part 2 was to encourage these individuals to get the treatment they needed by establishing strong privacy protections. Today, the health care system is embracing new models for delivering services—including accountable care organizations (ACOs) and patient-centered health homes—that rely on sharing patient information to coordinate and integrate care. There is also a focus on measuring performance and patient outcomes. These efforts, in turn, depend on use of electronic health records (EHRs) and the development of a health information technology (HIT) infrastructure to support the exchange and use of digital health information. Under Part 2, the disclosure of substance use disorder treatment records requires a patient's written consent, unless the type of disclosure falls under one of a handful of specific statutory exceptions. For example, Part 2 generally requires consent to release information about a patient's substance use disorder history and treatment regimens to clinicians at another facility, except in the case of a medical emergency. This contrasts with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, which permits clinicians to share patient information for treatment and payment purposes. Health care providers have become increasingly frustrated with the restrictions that Part 2 places on their ability to share the medical records of patients with substance use disorders. They argue that Part 2 makes it difficult for addiction treatment providers and general medicine providers to exchange information and coordinate patient care. Consider a patient who receives counseling and medications at an alcohol or drug treatment program. The records for this care are protected under Part 2. If the patient also receives treatment (including addiction treatment) at a primary care facility, the records for the care at that location are HIPAA-protected. Whereas the primary care facility is permitted under HIPAA to share the patient's information with the Part 2-covered alcohol and drug treatment program and any other health care facility providing care, the alcohol and drug treatment program generally needs the patient's consent under Part 2 to release information to another health care facility. Integrated health systems that handle patient records from multiple providers must separate Part 2 data from other medical information and manage patient consent preferences for its use and disclosure. Some health information exchanges (HIEs) exclude Part 2 data altogether because of the difficulty and expense of segregating the data and managing consent. Researchers, too, have expressed concern about access to Part 2 data. They were especially critical of a decision by the HHS Centers for Medicare & Medicaid Services (CMS) in late 2013 to begin withholding from research data sets any Medicare or Medicaid reimbursement claim that included a substance use disorder diagnosis or procedure code. CMS took this action to comply with Part 2. While the regulations permit disclosures for research purposes, subject to certain conditions, only substance use disorder program directors are allowed to authorize such disclosures. Third-party payers that receive Part 2 data, including CMS, are subject to the general prohibition on redisclosing the information. Researchers complained that they were losing access to an important data source at a particularly challenging time, as the nation expands its efforts to combat the abuse of prescription opioids and heroin. SAMHSA launched its effort to revise Part 2 in response to these concerns. Its stated goal in developing the final rule was to ensure that individuals with substance use disorders are able to participate in, and benefit from, the new systems of care without compromising their privacy. This report summarizes the changes that the final rule made to the Part 2 regulations and describes stakeholders' reactions to these revisions. The report begins with an overview and comparison of Part 2 and the HIPAA Privacy Rule. It concludes with some discussion of new HIT standards and applications for data segmentation and consent management that support the exchange of Part 2 data. Part 2 is much narrower in scope than the more familiar HIPAA Privacy Rule, which provides a baseline of privacy protections for health information maintained by payers and providers of health care—including substance use disorder treatment programs subject to Part 2—across the entire health care system. Part 2 also permits significantly fewer uses and disclosures of patient information without consent. Table 1 compares key provisions of the Privacy Rule and Part 2. The HIPAA Privacy Rule applies to identifiable health information maintained by health plans, health care clearinghouses, and health care providers. It also applies to the business associates of these HIPAA-covered entities, with whom such protected health information (PHI) is shared. Business associates provide specific services (e.g., claims processing, data management) for covered entities to help them operate as businesses and meet their responsibilities to patients and beneficiaries. The Privacy Rule describes multiple circumstances under which covered entities may use or disclose PHI. For example, PHI may be used or disclosed for the purposes of treatment, payment, and other routine health care operations—including case management, care coordination, and outcomes evaluation—with few restrictions. The rule also permits the use or disclosure of PHI for other specified purposes not directly connected to the treatment of the individual, such as public health and research. Covered entities must obtain a patient's written authorization for any use or disclosure that is not expressly permitted or required under the Privacy Rule. By comparison, Part 2 applies specifically to federally assisted substance use disorder treatment programs. Most of the nation's alcohol and drug treatment programs are covered, comprising more than 12,000 hospitals, outpatient treatment centers, and residential treatment facilities. While Part 2 does not apply to general medical facilities or practices, it does cover specialized substance use disorder treatment units (and staff) within such facilities. Part 2 restricts the use or disclosure of any patient information that directly identifies a patient as an alcohol or drug abuser, or that links the patient to an alcohol or drug treatment program. Medical information that does not link the patient to current or past substance abuse, or identify the patient as a participant of a Part 2 program, is not subject to the Part 2 requirements. While such information is not afforded Part 2 protection, it remains covered under the HIPAA Privacy Rule. Under Part 2, patient-identifying information may not be disclosed without a patient's written consent except pursuant to certain specified conditions in the following circumstances: (1) medical emergencies, (2) research, (3) program audits and evaluations, and (4) pursuant to a court order authorizing disclosure. Any information disclosed with the patient's consent must include a statement that prohibits further disclosure of identifying information unless the consent expressly permits such redisclosure, or it is permitted by Part 2. Substance use disorder treatment programs typically are subject to both sets of regulations—Part 2 and the HIPAA Privacy Rule—unless there is a conflict between the two. In that case, the program must comply with the regulations that are more protective of patient privacy, which generally means following the requirements under Part 2. The major provisions in the final rule are summarized below. Although SAMHSA's primary goal was to modify Part 2 to facilitate the sharing of patients' Part 2 data with other providers participating in clinically integrated health care networks, the agency's rulemaking options were constrained by the underlying statutory language. The Part 2 law is prescriptive, which limits SAMHSA's ability to make significant changes through rulemaking. The law defines the types of entities and information subject to its protections. It requires patient consent to disclose protected information, except in a handful of specified circumstances, and it establishes a strict prohibition on redisclosure. By contrast, the HHS Secretary was given broad discretionary authority under HIPAA to develop—and periodically amend—the Privacy Rule. HIPAA instructed the Secretary to submit to Congress detailed recommendations on the privacy of individually identifiable health information, and to promulgate privacy standards based on the recommendations. The law provided few details on the scope of the recommendations other than specifying that they must address (1) patient rights, (2) procedures for exercising such rights, and (3) the uses and disclosures of patient information that should be permitted or required. The final rule modifies the Part 2 requirement that consent forms include the amount and kind of information to be disclosed. It specifies that the form must now include "an explicit description of the substance use disorder information that may be disclosed." According to SAMHSA, the types of information that could be specified include diagnostic information, medications, lab tests, history of substance use, employment information, social supports, and claims or encounter data. Patients may select "all my substance use disorder information" as long as the consent form includes more specific types of disclosures from which to choose. Part 2 traditionally has required patient consent forms to identify "the name or title of the individual or the name of the organization to which the disclosure is made." Under the final rule, more options are available.