Skip to Main Content
Services Talent Knowledge
Site Search


Our attorneys stay on top of changes in legislation, agency regulations, case law, and industry trends—then craft timely legal alerts to keep clients up to date on legal developments important to their business.

April 2, 2020

COVID-19: CARES Act Makes Significant Changes to 42 CFR Part 2

The COVID-19 pandemic has prompted seismic changes to the way providers are allowed to handle substance-use disorder (SUD) information after years of affording it heightened confidentiality. The changes to so-called “Part 2” information are permanent and are not limited to the duration of the COVID-19 pandemic. 

The important changes to the federal regulation found at 42 CFR Part 2—which governs the handling of SUD information—accomplish two things. First, SUD information is treated in a way more aligned with the Health Insurance Portability and Accountability Act (HIPAA). Second, the act contains strong anti-discrimination language to protect individuals who are receiving or have received SUD treatment. 

One of the most significant changes made by the CARES Act is to allow the disclosing SUD information for treatment, payment, and health care operations (TPO) purposes with a patient’s written consent. Disclosing health information for these three purposes is obviously familiar to many providers who are subject to HIPAA and allows the disclosure of protected health information for many routine functions such as treating the patient, billing for services, and operating the practice or facility. 

The CARES Act also states that, once SUD information is disclosed for a TPO reason, the information can then be re-disclosed as permitted by HIPAA. Under the current changes, a covered entity, business associate, or program that receives Part 2 information pursuant to a patient’s written consent may use or re-disclose the Part 2 information for TPO purposes without needing additional consent from the patient. Prior to the CARES Act, entities and individuals receiving information from a Part 2 program were generally prohibited from re-disclosing the information.

The CARES Act adopts another HIPAA provision by giving patients the right to request a restriction on using or disclosing SUD information for TPO purposes and also requires entities to “make every reasonable effort to the extent feasible to comply with a patient’s request” to restrict the disclosure. With that said, there are some important differences between what is permissible under the new CARES Act and the HIPAA TPO exceptions. Unlike the HIPAA TPO exceptions, providers will still be required to obtain written patient consent before disclosing SUD for any TPO purpose.

The CARES Act also allows disclosing SUD data to certain public health authorities as long as disclosures are consistent with HIPAA. In other words, the Part 2 information must be de-identified in accordance with HIPAA’s de-identification standards prior to disclosure. SUD entities must additionally follow HIPAA-required breach notification procedures. Practically, this provision only creates a change for the limited Part 2 information that was not already subject to HIPAA.

The CARES Act also creates additional protections for SUD information that are not required by HIPAA. The most important of these protections is the new anti-discrimination provision that prohibits using SUD information to discriminate against individuals relative to health care, employment, access to courts, access to social services benefits, and the sale or rental of housing. The CARES Act further prohibits, in broad fashion, any recipient of federal funds from discriminating against an individual on the basis of Part 2 information when providing services paid for by federal funds such as Medicare and Medicaid.

The CARES Act also states that SUD data cannot be used in various civil, criminal, administrative, or legislative proceedings without a court order or patient consent. It specifically replaces the narrower language in Part 2 (no use for initiation or substantiation of criminal charges or conduct of an investigation) with much broader regulatory language: no use or disclosure in any civil, criminal, administrative, or legislative proceeding. The broader language leaves little to no room for exceptions or interpretation.

So, what comes next? The CARES Act is effective immediately, and it requires the US Department of Health and Human Services (HHS) and the Substance Abuse and Mental Health Services Administration (SAMHSA) to revise Part 2 within 12 months. We recommend that providers wait until SAMHSA releases its revisions to Part 2 before revising their policies and procedures.  We are following this issue and will be alerting providers when the revised regulations are released.

If you have any questions regarding the content of this alert, please contact Eric Naegely, partner, at or another member of the firm’s Health Care & Human Services Practice Area.

We also have a specific team of Barclay Damon attorneys who are actively working on assessing regulatory, legislative and other governmental updates related to COVID-19 and who are prepared to assist clients. You can reach our COVID-19 Response Team at


Click here to sign up for alerts, blog posts, and firm news.

Featured Media


EPA Lists Two New "Forever Chemicals" Under CERCLA


NYS Governor Hochul Announces Final RFP for New Certified Community Behavioral Health Clinics


The Second Department Affirms Successful Storm in Progress Defense of Slip and Fall Case


The New York FY 2025 Budget – CDPAP FIs Under Threat


Website Accessibility Lawsuits: Several "Tester" Plaintiffs—Anderson, Beauchamp, Murray, Angeles, Monegro, and Bullock—Targeting Businesses in Recent Flurry of Lawsuits


Updated Bulletin on Tracking Technologies in the Health Care Industry

We're Growing in DC!

We’re excited to announce Barclay Damon’s combination with Washington DC–based Shapiro, Lifschitz & Schram. SLS’s 10 lawyers, three paralegals, and four administrative staff will join Barclay Damon while maintaining their current office in DC’s central business district. Our clients will benefit from SLS’s corporate, real estate, finance, and construction litigation experience and national energy-industry profile, and their clients from our full range of services.

Read More

This site uses cookies to give you the best experience possible on our site and in some cases direct advertisements to you based upon your use of our site.

By clicking [I agree], you are agreeing to our use of cookies. For information on what cookies we use and how to manage our use of cookies, please visit our Privacy Statement.

I AgreeOpt-Out