The 2024 overhaul of 42 CFR Part 2 took effect in February 2026, easing SUD record sharing for care coordination while adding HIPAA-style penalties and breach rules.
Key Takeaways
- A decades-old privacy regime has been modernized: The 2024 final rule overhauling 42 CFR Part 2, the federal law protecting addiction records, reached its compliance deadline on February 16, 2026. Enforcement by the HHS Office for Civil Rights began the same day.
- Record sharing got easier, on purpose: Patients can now sign a single consent covering future disclosures for treatment, payment, and operations, and recipients may redisclose under HIPAA. The change is designed to unblock care coordination the old rule made cumbersome.
- The Part 2 penalties are new and serious: Violations now carry the same civil and criminal enforcement as HIPAA, and breaches trigger HIPAA breach-notification duties. A regime once loosely enforced now has teeth.
- Compliance is not optional and not finished: Programs must update consent forms, privacy notices, and breach procedures, and many entities that merely touch addiction records are covered too. The work should already be underway.
For half a century, the medical records of Americans in addiction treatment have carried a protection stronger than almost anything else in a patient’s chart, and for most of that half century the protection had almost no teeth. The rule, known by its address in the federal code as 42 CFR Part 2, grew out of a plain and durable insight: a person will not walk into treatment for a drug or drinking problem if she believes the fact of that treatment can later surface in a custody hearing, a courtroom, or a background check. So the government wrapped those records in consent rules far stricter than ordinary medical privacy, and then, for decades, barely enforced them.
That changed this year. On February 16, 2026, a long-gestating overhaul of Part 2 reached its compliance deadline, and the HHS Office for Civil Rights, the same agency that spent two decades turning HIPAA into a rule providers actually fear, began enforcing it. For addiction programs, and for the much larger universe of hospitals, primary-care practices, and health plans that merely handle addiction records, it is among the most consequential privacy shifts in years, and one many organizations have been slow to take seriously.
What the 42 CFR Part 2 Final Rule Changed
The rewrite has a lineage. It traces to the CARES Act of 2020, which told federal agencies to bring Part 2 into closer alignment with HIPAA. The Department of Health and Human Services, working through the Office for Civil Rights and the Substance Abuse and Mental Health Services Administration, issued the final rule on February 8, 2024; it took effect that April, with the compliance clock set for February 16, 2026. Three days before that deadline, on February 13, the Office for Civil Rights announced a civil enforcement program and said it would begin taking complaints, a fairly unambiguous signal that Part 2 had graduated from theoretical risk to active one.
The change providers had wanted for years is the one that loosens the rule. The old version generally demanded a fresh consent for every disclosure, which turned routine care coordination into a slog and, in practice, often meant addiction records simply did not travel with the rest of a patient’s file, even as the rest of behavioral health leaned harder on shared digital systems and payer-owned data platforms. The new rule lets a patient sign a single consent covering future uses and disclosures for treatment, payment, and health-care operations. Once that signature is in place, a downstream provider, plan, or business associate governed by HIPAA can use and redisclose the records under HIPAA’s rules until the patient revokes it in writing, and recipients no longer have to quarantine Part 2 data from everything around it. For a field long hobbled by the silos separating mental health and addiction care and reimbursement, the whole point is to make coordinated care less of a fight.
New Part 2 Penalties and Breach Notification Rules
Loosening the sharing came bundled with sharpening the consequences, which is the half of the rewrite that should hold a compliance officer’s attention. Part 2 violations now draw the same civil and criminal penalties as HIPAA, replacing an old criminal-only structure almost never invoked, with civil monetary penalties climbing into the millions at the top tier. A breach of Part 2 records now triggers the HIPAA Breach Notification Rule, so a program must alert affected patients, notify the government, and, in a large enough breach, tell the media.
Patients picked up new rights along the way, including the ability to complain directly to the federal government and, in most situations, protection against having their addiction records used against them in civil, administrative, and legislative proceedings, not merely criminal ones as before. The rule also carves out a separate category for a counselor’s private session notes, which, like psychotherapy notes under HIPAA, require their own specific consent and cannot ride along on the general one.
Who the Part 2 Rule Covers Beyond Addiction Programs
The costliest misreading of Part 2 is the assumption that it belongs only to specialty addiction clinics. The definition of a Part 2 program is narrow, a federally assisted operation that diagnoses, treats, or refers for substance use disorder.
But the 2024 rule reaches past that boundary, because so many ordinary health-care entities receive addiction records in the course of treating and coordinating care, and those entities now carry obligations of their own. Any HIPAA-covered provider that creates, receives, or keeps SUD records has to update its Notice of Privacy Practices to reflect the new Part 2 language. That pulls in primary-care offices, hospitals, health plans, and the swelling ranks of integrated and collaborative-care arrangements that treat addiction beside physical and mental health.
A behavioral health organization running both mental-health and addiction lines, which is to say most of them, cannot file this under someone else’s responsibilities. It is, as it happens, the same confidentiality regime now shaping how states verify Medicaid work-requirement exemptions for people in treatment.
A 42 CFR Part 2 Compliance Checklist for Providers
The to-do list is not mysterious, and for anyone who has not worked through it, it is overdue. Revise consent and authorization forms to match the single-consent framework and its required elements. Rewrite the Notice of Privacy Practices, which HHS will let programs merge with the HIPAA notice into one document so long as it carries all the required content, and fix the distribution so current and future patients actually receive it. Realign the internal policies on redisclosure, breach response, and counseling notes, and train the staff on all of it. Every disclosure made under a written consent has to carry the specific line warning that Part 2 forbids passing the information along without authorization.
Beneath the paperwork sits the real shift, which is one of posture. For fifty years Part 2 was a strict rule with a soft enforcement arm, invoked rarely and through criminal channels nobody used. Handing the job to the Office for Civil Rights and matching the penalties to HIPAA’s converts it into something regulators plainly intend to enforce, in the same spirit as the documentation audits and recoupment fights now testing behavioral health providers. A provider already worn down by thin margins and a heavy administrative load may be tempted to slot privacy-notice updates near the bottom of the list, but a passed deadline paired with an announced enforcement program makes that a real gamble. The rule was rewritten to let addiction records finally move with the patient, which is a genuine gift to coordinated care. The bill for that gift is that the records now travel inside a framework someone is finally watching.
