The February 16, 2026, compliance date for the Final Rule modifying the “Confidentiality of Substance Use Disorder Patient Records” regulation, at 42 CFR Part 2, is fast approaching. Privacy and compliance officers should take note: it includes changes likely to impact most healthcare providers subject to the Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations, not just those operating substance use disorder programs.
Part 2 changes affecting SUD records
The Department of Health and Human Services (HHS) published the revised rule in response to Section 3221 of the CARES Act, which Congress enacted in March 2020 to harmonize Part 2 confidentiality requirements with the HIPAA Privacy Rule. The final Part 2 rule, published at 89 Fed. Reg. 12472, includes various changes to reconcile the Part 2 rule with HIPAA requirements, such as aligning Part 2 enforcement penalties with HIPAA enforcement authorities and permitting patients to sign a single consent to authorize all subsequent uses and disclosures for treatment, payment, and healthcare operations purposes. In addition, the rule contains safeguards to protect Part 2 records disclosed with the patient’s consent, like the requirement that any such disclosure must be accompanied by one of two “written statements” codified at 42 C.F.R. § 2.32.
ICYMI: And then there’s the revised HIPAA rule
The Part 2 rule, however, was not the only regulation that HHS revised in response to Section 3221 of the CARES Act. Buried in another final rule titled “HIPAA Privacy Rule to Support Reproductive Health Care Privacy,” published at 89 Fed. Reg. 32976, HHS also included revisions to the HIPAA Privacy Rule requirements applicable to “Notice of Privacy Practices” (NPP). The updated regulation, codified at 45 C.F.R. § 164.520, requires NPPs to address how covered entities use and disclose Part 2 records, and the rule applies to all covered entities, including most healthcare providers, in receipt of Part 2 records—not just those operating substance abuse disorder programs. A federal court vacated most of the rule but did not disturb the provisions regarding Part 2 records. Purl v. U.S. Dep’t of Health & Hum. Servs., 787 F. Supp. 3d 284, 331 (N.D. Tex. 2025). As with the revisions to the Part 2 rule, the compliance date for NPP required changes is February 16, 2026.
What these two updated rules mean for healthcare providers
Taken together, the revisions to the Part 2 rule and the HIPAA Privacy Rule affect covered entities in receipt of Part 2 records—likely including hospitals, primary care providers, emergency departments, behavioral health providers, and countless other so-called “lawful holders” of records—and not just those covered entities that actually operate Part 2 programs.
As the compliance date for revisions to the Part 2 Rule and HIPAA Privacy Rule quickly approaches, all covered entities should evaluate their NPPs, consent forms, and related policies to ensure compliance with both rules’ requirements.
