For years, 42 CFR Part 2 has operated as a separate, more stringent set of rules than HIPAA. However, following the CARES Act, the HHS has issued a Final Rule to bring these two frameworks into closer alignment.
The compliance deadline is February 16, 2026. It is important to understand who is affected and what changes are required.
Who Needs to Comply?
The revised Part 2 ruling applies primarily to “federally assisted” Substance Use Disorder (SUD) programs, including those that:
- Receive federal funding (Medicare/Medicaid)
- Are tax-exempt under the IRS
- Are authorized by a federal agency (e.g., DEA registration)
What Changes Need to be Made?
The goal of the 2024 Final Rule is to simplify care coordination while maintaining data privacy:
- Unified Patient Consent: Patients can sign one “global” consent for all future TPO disclosures.
- Updated Notice of Privacy Practices (NPP): Must include specific language on Part 2 protections.
- Breach Notification: Part 2 programs must now follow the HIPAA Breach Notification Rule.
- SUD Counseling Notes: These must be kept separate from the rest of the medical record.
What This Means for Your Organization
Organizations must take the following steps to ensure compliance:
- Revise Forms: Update consent forms and NPPs to meet the 2026 requirements.
- Update Policies: Modify workflows for record desegregation, while keeping SUD Counseling Notes isolated.
- Educate Staff: Train workforce members on the new definitions and breach protocols.
What This Means for Patients
For patients and PHI owners, the changes offer integrated care and tighter legal security:
- Better Care Coordination: Easier information sharing between primary care and SUD counselors.
- Enhanced Rights: Right to file complaints directly with the HHS Secretary.
- Legal Protection: Strengthened “firewall” against the use of records in criminal or civil proceedings.
The Consequences of Noncompliance
Under the new rule, HIPAA-style civil and criminal penalties now apply to Part 2 violations. According to the HHS Office for Civil Rights (OCR), penalties can range from a few hundred dollars to over two million dollars per year, depending on negligence levels.
Next Steps
The February 16, 2026, deadline is firm. Start auditing your forms today. For official guidance, visit the HHS Fact Sheet.
