Part 2 Privacy Compliance Deadline Approaching: Is Your Organization Ready?

Through its rulemaking authority, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has set February 16, 2026 as the deadline for compliance with the new rules governing Substance Use Disorder (SUD) patient records, Notice of Privacy Practices (NPP) updates and related compliance policies and documents. 

All health care providers who operate a SUD program, as well as those who hold SUD records, have less than a month to come into compliance with the updates made to the 42 CFR Part 2 (Part 2) regulations.

Background

In the Final Rule issued on February 16, 2024, the Part 2 regulations protecting SUD records were aligned with the HIPAA regulations. At the same time, the OCR published a Final Rule on April 26, 2024 outlining a requirement that all health care providers, health plans and health care clearinghouses revise their NPPs to support the rule changes addressing SUD records. The compliance date for making these regulatory updates is fast approaching. Below, we summarize key impacts from the Part 2 rulemaking and practical recommendations to address the Part 2 and NPP updates.

Part 2 Final Rule Key Impacts

The Final Rule establishes the process for an authorization to specifically include the use and disclosure of SUD records (not to include SUD counseling notes) for Treatment, Payment and/or Health Care Operations (TPO) if certain content requirements are met.[1]  With appropriate authorization, Part 2 programs, covered entities and business associates:

• Are permitted to use and disclose SUD records for TPO purposes until the time the patient revokes the authorization in writing.
• Are not required to segregate SUD records. 
  • Please note that while the Final Rule removes the requirement to segregate SUD records, the additional protections of SUD records remain and are subject to the prohibition of disclosure in proceedings against the patient as outlined below.
• Are permitted to disclose de-identified SUD records to public health authorities.

The Final Rule establishes a separate consent for the use and disclosure for a new category of SUD records -- SUD Counseling Notes -- and aligns the handling of SUD Counseling Notes with the use and disclosure requirements for Psychotherapy Notes under HIPAA.[2]

The Final Rule establishes an additional patient right to obtain an accounting of all TPO disclosures of SUD records made through an electronic health record for up to three years prior to the date the accounting is requested by the patient.[3]

The Final Rule establishes a patient’s right to identify and request restrictions on disclosure of SUD records otherwise permitted under an authorization for TPO purposes.  In addition, a patient has a right to restrict disclosure of SUD records to health plans for any services that the patient pays directly.[4]

The Final Rule prohibits (as did the prior enactment), with very limited exceptions, use of SUD records in any criminal prosecution or civil, administrative or legislative action/proceedings without patient consent or court order.[5]

The Final Rule permits patients to file complaints with the Secretary of HHS alleging potential Part 2 violations and establishes that Part 2 programs must identify a process for receiving patient complaints.[6]

Practical Recommendations

1. We encourage all Part 2 programs and Covered Entities and Business Associates that encounter SUD records to review their current HIPAA policies, consent and authorization forms and update them to meet Part 2 disclosure requirements established by the rule.
2. All health care providers, health plans and health care clearinghouses must revise their NPPs to address the changes made in the Part 2 Final Rule.  This can be accomplished with a separate NPP for all patients and a separate NPP for Part 2 patients, or the NPPs can be combined into one NPP that addresses all requirements including Part 2 requirements.
3. We suggest that all Part 2 programs and Covered Entities and Business Associates that encounter SUD records identify and review all policies, procedures, protocols or practices involving the recordkeeping, use and disclosure of SUD records.  This process should identify any additional impact of the Part 2 rulemaking, such as notifications required when producing SUD records, interactions with law enforcement, obtaining court orders prior to production of SUD records and whether this impacts information provided to health information exchanges.

Need assistance?

With HIPAA penalties and breach notification obligations now being extended to all SUD records covered by Part 2, it is even more important to ensure compliance with all applicable requirements as of February 16, 2026. If your organization has questions about the new Part 2 requirements or the required NPP updates, your Dinsmore health care attorney is available to help with these changes.