This winter, health care providers have been training for an important event. The compliance deadline for significant amendments to 42 CFR Part 2 (Part 2), the federal regulation governing the confidentiality of substance use disorder (SUD) records, required regulated entities to revise their compliance programs, including Notices of Privacy Practices (NPP), by February 16, 2026. As we all get up to speed on curling “double touch” rules, do not forget to review the new materials dropped this weekend by the U.S. Department of Health and Human Services (HHS).
Earlier in this Olympic cycle, HHS finalized amendments to Part 2. The February 2024 Final Rule (Part 2 Final Rule) implements CARES Act requirements dictating that HHS align Part 2’s confidentiality requirements more closely with HIPAA. The intent of the amendments was to reduce barriers to information sharing and improve care coordination, while preserving heightened privacy protections that Part 2 has historically provided.
Importantly, the NPP update requirement in the Part 2 Final Rule extends beyond traditional SUD Part 2 treatment programs (Part 2 Programs) to all HIPAA covered entities that create, receive, maintain, or transmit Part 2 records, even if those entities are not themselves Part 2 Programs. In addition, lawful holders of Part 2 records – entities that have received Part 2 records pursuant to consent or other lawful means – must also take steps to ensure ongoing compliance with the new requirements.
The U.S. Health Care Team geared up for the February 16, 2026 compliance date by focusing on a specified training regimen:
- Drafting a single consent for treatment, payment, and health care operations
- Updating general Part 2 consent forms
- Creating a SUD counseling notes category of records
- Operationalizing expanded patient rights processes
- Updating NPPs
Providers struggled with incorporating Part 2 requirements into NPPs – how do we balance the Part 2 and HIPAA headers? Should we add Part 2 language throughout the NPP or only in a designed Part 2 section? Or should Part 2 notice terms be segmented into a specific Part 2 notice (leaving lawful holders’ language as the only Part 2 reference in a general covered entity NPP)? For some regulated entities, combining Part 2 language throughout a general NPP created an unwieldy document that was very difficult for consumers to understand.
Then Friday, as the team finished warmups and got ready to click publish on new NPP language, HHS released its anticipated model NPPs. The HHS models create a separate NPP for Part 2 Programs, streamlining the disclosures and offering sample language that should limit spectator (er, individual) confusion. Of course, every good athlete needs to customize their gear for peak performance, and organizations should not copy and paste the HHS model as-is. Instead, covered entities should be prepared to update and customize the HHS NPP models to match entity specifics and applicable state law.
The judges are watching. On February 13, 2026 HHS announced a new civil enforcement program to implement and “aggressively” enforce Part 2 requirements. Beginning February 16, 2026, the HHS Office for Civil Rights (OCR) began accepting complaints alleging violations of Part 2 and notification of breaches of SUD records. Under the updated regulations, the HIPAA enforcement framework now applies to Part 2 violations, including financial penalties for noncompliance, criminal fines, and possible imprisonment. HHS now has authority to conduct compliance reviews and investigations, and impose corrective action plans, resolution agreements, and civil monetary penalties related to Part 2 noncompliance.
While the compliance line is just behind us, regulated entities may wish to take a quick double touch on their updated NPP language. The HHS model NPPs do address some of the common questions we are hearing from providers. Covered entities can also use this latest guidance from HHS to help finalize consent forms, disclosure protocols, and policy and procedure updates.
The February 16, 2026 compliance deadline represented a significant milestone for regulated entities. While the amendments are intended to reduce compliance complexity and improve care coordination, they require meaningful operational changes across consent management, privacy notices, policies and procedures, training, and vendor relationships. Organizations that have not yet taken action should get started before the Closing Ceremony to reduce enforcement risk and help you bring home a medal. After all, nothing earns gold like a well-run compliance program.
