Healthcare organizations subject to 42 CFR Part 2 have two months remaining to align substance use disorder record protections with revised federal requirements.
The Department of Health and Human Services issued a final rule updating the confidentiality requirements for substance use disorder patient records under 42 CFR Part 2, with full compliance required by February 16, 2026. The rule, released jointly by the HHS Office for Civil Rights and the Substance Abuse and Mental Health Services Administration in February 2024, aligns Part 2 more closely with HIPAA while preserving heightened protections for SUD records. Covered entities were given an extended transition period, and enforcement authority was later delegated to OCR.
The final rule updates long-standing Part 2 requirements that previously operated separately from HIPAA. Under the new framework, patients may provide a single consent for future uses and disclosures of SUD records for treatment, payment, and healthcare operations. Records no longer need to be segregated, and HIPAA-regulated recipients may redisclose Part 2 information in line with the HIPAA Privacy Rule. The changes also expand patient rights, including the ability to request restrictions, receive an accounting of disclosures, and file complaints with HHS. Covered entities must establish a complaints process and ensure breach notification obligations apply to Part 2 records in the same manner as HIPAA.
HHS stated that aligning Part 2 with HIPAA is intended to reduce operational complexity while maintaining strong confidentiality protections for individuals receiving substance use disorder treatment. Federal officials stressed that the updates support care coordination and continuity of care without weakening patient trust. HHS also confirmed that enforcement will follow the same structure used for HIPAA, including investigations, resolution agreements, corrective action plans, and potential civil monetary penalties for noncompliance.
According to the National Law Review, failure to comply with HIPAA and 42 CFR Part 2 “may result in civil monetary penalties or other enforcement actions by HHS OCR,” which has authority to “issue subpoenas requiring attendance, testimony, and the production of documents related to an investigation or compliance review.” The analysis warns that organizations should “review and update their NPPs, policies and procedures, staff training, and compliance protocols well before the 2026 deadline,” noting that proactive engagement can help “mitigate potential enforcement risks” as regulators increase scrutiny around substance use disorder data protections.
The rule applies to federally assisted programs and entities that provide substance use disorder diagnosis, treatment, or referral services and that create or receive Part 2 protected records.
Covered entities must meet all requirements of the final rule by February 16, 2026, including updated policies, consent processes, and notice of privacy practices.
Patients may authorize a single consent for future uses and disclosures related to treatment, payment, and healthcare operations, rather than providing repeated consents.
They are more closely aligned, but Part 2 continues to include specific protections related to legal proceedings and patient rights that go beyond standard HIPAA requirements.
OCR may pursue corrective action, monetary settlements, or civil penalties, with penalty amounts aligned to HIPAA enforcement thresholds and adjusted annually for inflation.