This bill requires the Department of Health and Human Services to update federal health privacy rules (HIPAA) regarding how patients' mental health and substance use disorder information can be shared. When a patient gives permission to disclose this sensitive health information, the authorization must remain valid for at least two years instead of expiring sooner. Additionally, healthcare providers must notify patients in writing at least 30 days before their authorization expires so they can decide whether to renew it. The changes apply to all covered healthcare entities that handle protected health information. The Secretary of HHS must complete these regulatory modifications within one year of the bill's enactment.