Changes to 42 CFR Part 2: Effective 2/16/26

As a reminder, changes to 42 C.F.R. Part 2 go into effect on February 16th, 2026. These changes modify the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations to create better alignment with HIPAA.  As has always been the case under 42 CRF Part 2, patients’ SUD treatment records cannot be used to investigate or prosecute the patient without written patient consent or a court order. Further, records obtained in an audit or evaluation of a Part 2 program cannot be used to investigate or prosecute patients, absent written consent of the patients or a court order that meets Part 2 requirements.

For additional facts and information about the Part 2 changes, please review the following:

• 42 CFR Part 2 Final Rule HHS Fact Sheet
• 42 CFR Part 2 National Law Review Summary
• Focus PSI 42 CFR Part 2 Fact Sheets & Templates
  • Consent Templates
  • Patient Notice Templates
  • ODM Standard Authorization Form

Some of the key modifications to Part 2 include changes to:

Patient Consent

• Allows a single consent for all future uses and disclosures for treatment, payment, and health care operations.
• Allows HIPAA covered entities and business associates that receive records under this consent to redisclose the records in accordance with the HIPAA regulations.
• Prohibits combining patient consent for the use and disclosure of records for civil, criminal, administrative, or legislative proceedings with patient consent for any other use or disclosure.
• Requires a separate patient consent for the use and disclosure of SUD counseling notes, which are defined in a manner consistent with psychotherapy notes under HIPAA.
• Requires that each disclosure made with patient consent include a copy of the consent or a clear explanation of the scope of the consent.

Other Uses and Disclosures

• Permits disclosure of records without patient consent to public health authorities, provided that the records disclosed are de-identified according to the standards established in the HIPAA Privacy Rule.
• Restricts the use of records and testimony in civil, criminal, administrative, and legislative proceedings against patients, absent patient consent or a court order.

Penalties: Aligns Part 2 penalties with HIPAA by replacing criminal penalties currently in Part 2 with civil and criminal enforcement authorities that also apply to HIPAA violations.

Breach Notification: Applies the same requirements of the HIPAA Breach Notification Rule to breaches of records under Part 2.

Patient Notice: Aligns Part 2 Patient Notice requirements with the requirements of the HIPAA Notice of Privacy Practices.

Safe Harbor: Creates a limit on civil or criminal liability for investigative agencies that act with reasonable diligence to determine whether a provider is subject to Part 2 before making a demand for records in the course of an investigation. The safe harbor requires investigative agencies to take certain steps in the event they discover they received Part 2 records without having first obtained the requisite court order.

Segregation of Part 2 Data: Adds an express statement that segregating or segmenting Part 2 records is not required.