New federal guidance sets out two situations where existing patient consent already covers it, ahead of a January 2027 deadline for states.

 

What happened

The HHS Office for Civil Rights issued guidance on September 29, 2026, explaining when a state Medicaid agency may use a person's substance use disorder treatment records to confirm they are excluded from Medicaid work requirements, in a press release announcing it. Those records are governed by 42 CFR Part 2, a federal rule that protects the confidentiality of addiction treatment information more tightly than HIPAA does. Federal law now requires certain adults aged 19 to 64 to work, perform community service, or study at least half-time to remain eligible for Medicaid, with exclusions for people who are medically frail or participating in certain treatment programs. States must have the requirement running no later than January 1, 2027. The guidance therefore puts one of the most sensitive categories of health records into state eligibility systems at scale, and those agencies became subject to direct OCR enforcement of Part 2 in February 2026.

 

Going deeper

Two situations permit the use, and both turn on consent that already exists or is newly obtained. In the first, a treatment program has already obtained the patient's written consent covering all future uses and disclosures for treatment, payment, and health care operations, and passes a copy of that consent along with the records. A state agency holding records under that consent may use them to verify an exclusion without asking the patient again, according to the guidance. In the second, the agency obtains written consent from the applicant or beneficiary directly, either for the specific purpose of checking the exclusion or for the broader set of purposes. Any consent the agency obtains must meet the requirements at 42 CFR 2.31(a), including telling the patient they can revoke it and setting an expiration date or event.

 

What was said

The guidance "will help state Medicaid agencies use information they already have to identify individuals who are excluded from the community engagement requirement, while continuing to protect the confidentiality of SUD patient records as required by Part 2," said OCR Director Paula M. Stannard in the announcement. She added that it helps agencies meet their eligibility verification obligations without imposing unnecessary documentation burdens on people who qualify for an exclusion.

 

In the know

Records used this way keep their strongest protection. Part 2 bars the use or disclosure of these records to bring or support criminal charges against a patient, to conduct a criminal investigation of them, or in any civil, criminal, administrative, or legislative proceeding against them, and separate patient consent is required before they can be used that way, the guidance states. That restriction travels with the record into the state agency. The exclusion itself is also narrower than it first appears, since CMS defined “medically frail” to require that the person's condition impairs their ability to meet the work requirement, and excluded people in stable recovery, meaning five or more years, from the addiction category of that definition.

 

The big picture

Part 2 records now carry HIPAA's breach notification requirements alongside their own confidentiality rules, following the 2024 final rule that aligned the two frameworks, according to the OCR. A state agency holding these records answers to one notification standard and two sets of confidentiality obligations, and anyone can file a Part 2 complaint with OCR as of February 16, 2026. What the guidance sets in motion is a larger volume of addiction treatment records moving into eligibility systems that were not built around Part 2, on a deadline of January 1, 2027. Agencies and the health plans feeding them should be establishing which systems will hold these records, whether consent documentation travels with them, and who would carry the notification duty if those systems were breached.

 

FAQs

What makes Part 2 stricter than HIPAA?

Part 2 restricts the use of addiction treatment records in legal proceedings against the patient, a protection HIPAA does not provide. The 2024 final rule brought the two closer together on consent and breach notification while leaving that restriction in place.

 

Which organizations does Part 2 cover?

Federally assisted programs that provide substance use disorder diagnosis, treatment, or referral for treatment. Some requirements also reach organizations receiving those records from such a program, including health plans that pay for treatment and government benefit programs such as Medicaid.

 

Can a patient refuse to let a state agency use their records this way?

Consent can be revoked, and any consent the agency obtains must tell the patient so and carry an expiration date or event. Where the agency is relying on a consent obtained earlier by a treatment program, revocation runs through the terms of that original consent.

 

What happens if a person cannot be verified from records the agency holds?

Federal law requires states to use reliable information already available before asking the individual to supply more, where that is possible. Someone whose exclusion cannot be confirmed from existing records would need to provide documentation themselves.

 

Does receiving Part 2 records change a state agency's security obligations?

The records carry their own confidentiality requirements into the receiving organization, and breach notification duties now mirror HIPAA's. Agencies need to know which systems hold them, since the obligations attach to the records rather than to the type of organization holding them.