Align SUD protections with HIPAA

Emergency & Crisis Response
Parity, Coverage, & Equitable Access
Research & Technology
social determinants of health
No items found.
No items found.
Coverage & Standards
Federal department
Health and Human Services
house committees
House Energy and Commerce Committee
senate committees
Senate Health, Education, Labor, and Pensions Committee


The U.S. Department of Health and Human Services (HHS) must finalize strong regulations to align privacy protections for substance use disorder (SUD) patient recommendations with protections under the Health Insurance Portability and Accountability Act (HIPAA). Congress previously passed legislation to address problems caused by a provision of federal law – 42 CFR Part 2 – that has inhibited the integration of SUD care with mental health and physical health care.[1]


To provide whole-person care, clinical care teams need patient information related to mental health, substance use, and physical health. However, 42 CFR Part 2, a discriminatory provision of federal law, places severe restrictions on the sharing of SUD patient information that go far beyond HIPAA’s requirements. This restriction further stigmatizes SUDs and hinders the integration of SUD care with mental and physical health care. These separate rules have put patient safety at risk by inhibiting sharing of patient information among teams of clinicians (e.g., a physical health care provider might unknowingly prescribe an opioid to an individual with opioid use disorder). These restrictions have also decreased the overall quality of SUD care by making it harder to address patients co-occurring SUD, mental health, and physical health needs, and hindering clinical research that has been made more difficult by keeping SUD data segregated from mental and physical health data.[1]

To address these problems, Congress passed the Protecting Jessica Grubb’s Legacy Act as part of the 2020 Coronavirus Aid, Relief, and Economic Security (CARES) Act.[2][3] The law takes steps to align 42 CFR Part 2 with HIPAA by facilitating the sharing of clinical information with care teams that are essential to accurately diagnose, treat, and provide whole-person care. While HHS has proposed rules that effectively implement many of the CARES Act regulations, the proposed rules do not go far enough. The Congressional sponsors – as well as advocates – have urged HHS to ensure the final rule has patient consent requirements that allow the sharing of SUD information simple and straightforward.[4][5] For example, it is essential that the consent process be folded into the existing HIPAA consent process. HHS should also ensure that SUD patient data does not need to be segregated from other HIPAA-protected data once data has been transmitted between providers. In short, HHS must ensure that the intent of the CARES Act provisions is implemented and that it does not leave barriers that effectively result in a patient’s SUD information, after consent has been given, not being integrated with other patient health information.[1]

If HHS does not effectively address these longstanding barriers in its final regulations, Congress should simply eliminate any discriminatory distinctions between SUD and other patient health information, which are all currently subject to HIPAA’s requirements.


1. The Partnership to Amend 42 CFR Part 2. Home Page. Last Accessed August 17, 2023.

2. Protecting Jessica Grubb’s Legacy Act. S. 3374 (Manchin-Capito), 116th Congress (2019-2020). (n.d.)

3. Coronavirus Aid, Relief, and Economic Security (CARES) Act. Public Law 116-136. Last Updated March 27, 2020.

4. Senator Shelley Moore Capito. “Capito, Manchin, Merkley, Klobuchar, Collins Recommend Bipartisan Improvement to Legacy Act Proposed Rule.” Last Updated February 14, 2023.

5. The Partnership to Amend 42 CFR Part 2. 42 CFR Part 2 - Recommendations for Next Rule. Last Updated April 13, 2021.