Free readiness check
Is your program ready for the new 42 CFR Part 2?
The updated rule has been enforceable since February 16, 2026. Thirteen questions show what changed and where your program is most exposed.
What changed, in plain terms
One consent can now cover all future treatment, payment and operations disclosures.
A new protected category that needs its own separate consent.
A new patient notice, plus rights to restrictions and HHS complaints. An accounting right is coming, but its compliance date is on hold.
HIPAA breach notification rules now apply to Part 2 records.
HHS OCR enforces Part 2 with HIPAA-level penalties as of February 16, 2026.
Records still can’t be used against a patient without consent or a qualifying court order.
This check summarizes the February 16, 2024 final rule amending 42 CFR Part 2 (compliance date February 16, 2026) as reviewed in October 2026. Section numbers refer to 42 CFR Part 2. It is a general readiness screen, not legal advice, and it does not cover state confidentiality laws that may be stricter. Compliance with the accounting of disclosures requirement (section 2.25) is on hold until HHS revises the matching HIPAA accounting rule. This tool is provided “as is” for general information only. Continued Compliance, Inc. makes no warranty that this information is accurate, complete or current, and is not liable for any decision made or action taken based on it. Using this tool does not create a consulting, attorney-client or other professional relationship. Rules change and vary by program type. Confirm requirements with HHS, the applicable state agency or qualified legal counsel before relying on them. Continued Compliance, Inc.
The thirteen readiness questions, in full
The updated 42 CFR Part 2 rule has been enforceable since February 16, 2026. The readiness check above asks thirteen questions. Each is listed below with the section of the rule it comes from, why it matters, and what changed. For each question you answer In place, Partly, or Not yet or not sure. Questions marked high exposure are the gaps most likely to turn into a complaint, a breach or an improper release.
Consent
The biggest change, and where most forms fall short.
1. Your consent form can serve as a single consent for all future treatment, payment and health care operations disclosures, and it has every required element.
42 CFR 2.31 | High exposure
Required elements include a specific description of the information, the recipients, purpose, right to revoke, expiration, a redisclosure statement, the consequences of refusing and, if you fundraise, the fundraising opt-out.
What changed: The rule now allows one consent for all future treatment, payment and operations disclosures, with new required statements.
2. Consent for use in civil, criminal, administrative or legislative proceedings is always separate and never combined with another consent.
42 CFR 2.31
Part 2 bars combining this consent with a consent for any other purpose.
What changed: Consent for proceedings can’t be combined with a consent for any other purpose.
3. If you keep SUD counseling notes, they’re stored apart from the record and released only with their own separate consent.
42 CFR 2.11, 2.31(b) | High exposure
They can’t be released on a general treatment, payment and operations consent, and treatment can’t be conditioned on that consent.
What changed: SUD counseling notes are a new protected category with their own consent.
4. Every disclosure made with consent goes out with the required Part 2 notice and a copy of the consent or a clear explanation of its scope.
42 CFR 2.32
Recipients need to know the limits on what they can do with the records.
What changed: Each consented disclosure must now carry a copy of the consent or a clear explanation of its scope.
Patient rights
New rights that line up with HIPAA.
5. Every patient gets the updated Part 2 Patient Notice no later than the date of first service.
42 CFR 2.22 | High exposure
The notice now follows the HIPAA Notice of Privacy Practices format and had to be in use by February 16, 2026.
What changed: The patient notice was rewritten to match the HIPAA Notice of Privacy Practices.
6. You can produce an accounting of disclosures made with consent for the past 3 years when a patient asks.
42 CFR 2.25
HHS has put the compliance date for all of section 2.25 on hold until it revises the matching HIPAA accounting rule, so this one is not enforceable yet. It still pays to be able to do it before that date is set.
What changed: The rule adds a right to an accounting of consented disclosures, with its compliance date still to be set by HHS.
7. You have a process for requests to restrict disclosures, including a patient who paid in full and asks you not to tell their health plan.
42 CFR 2.26
You can generally decline restriction requests, but not that self-pay one.
What changed: Patients can request restrictions, and self-pay restrictions to a health plan must be honored.
8. Patients can complain to you and to HHS, and nothing in your forms asks them to waive that right or penalizes them for complaining.
42 CFR 2.4
Intimidation, retaliation and waiver requirements are prohibited.
What changed: Patients can file Part 2 complaints with HHS, and retaliation is prohibited.
Breach and security
Now under the same rules as HIPAA.
9. You have written breach notification policies that cover Part 2 records, paper and electronic, and staff know how to escalate a possible breach.
42 CFR 2.16 | High exposure
The HIPAA Breach Notification Rule now applies to Part 2 programs the same way it applies to covered entities.
What changed: HIPAA breach notification now applies to Part 2 records.
10. You know the notification clock: affected patients without unreasonable delay and no later than 60 calendar days after discovery, plus HHS and, for larger breaches, the media.
42 CFR 2.16
These are the HIPAA Breach Notification Rule timelines that now apply to Part 2 records.
What changed: Part 2 breaches follow the HIPAA notification timelines.
Legal requests and partners
Where one bad release does the most damage.
11. Staff know a subpoena alone isn’t enough, and records are never released for use against a patient without consent or a court order that meets Part 2’s standards.
42 CFR 2.12(d), 2.64 | High exposure
The notice rules also require telling patients that a court order must come with a subpoena.
What changed: The protections against use in proceedings against the patient were kept and spelled out.
12. If you do any fundraising, patients get a clear chance to opt out of fundraising communications.
42 CFR 2.22, 2.31
The opt-out has to appear in the patient notice and in the consent.
What changed: Patients now have a right to opt out of fundraising communications.
13. Contractors and other recipients that get Part 2 records from you are bound in writing to Part 2 where the rule requires it.
42 CFR 2.33
Lawful holders that aren’t covered entities can pass records to contractors only under written contracts that bind them to Part 2.
What changed: Redisclosure rules now depend on whether the recipient is a HIPAA covered entity or business associate.
What changed, in plain terms
- Consent: One consent can now cover all future treatment, payment and operations disclosures.
- SUD counseling notes: A new protected category that needs its own separate consent.
- Patient rights: A new patient notice, plus rights to restrictions and HHS complaints. An accounting right is coming, but its compliance date is on hold.
- Breach notification: HIPAA breach notification rules now apply to Part 2 records.
- Enforcement: HHS OCR enforces Part 2 with HIPAA-level penalties as of February 16, 2026.
- Legal proceedings: Records still can’t be used against a patient without consent or a qualifying court order.
Sources
- Federal Register, 89 FR 12472 (February 16, 2024): Confidentiality of Substance Use Disorder (SUD) Patient Records final rule (checked October 6, 2026)
- HHS OCR: Substance Use Disorder Confidentiality (Part 2) compliance and enforcement (checked October 6, 2026)
- HHS OCR: Fact Sheet, 42 CFR Part 2 Final Rule (checked October 6, 2026)
- 42 CFR 2.3: Civil and criminal penalties for violations (checked October 6, 2026)
- 42 CFR 2.4: Complaints of noncompliance (checked October 6, 2026)
- 42 CFR 2.11: Definitions, including SUD counseling notes (checked October 6, 2026)
- 42 CFR 2.12: Applicability, including restrictions on use in proceedings (checked October 6, 2026)
- 42 CFR 2.16: Security for records and notification of breaches (checked October 6, 2026)
- 42 CFR 2.22: Notice to patients (checked October 6, 2026)
- 42 CFR 2.25: Accounting of disclosures (checked October 6, 2026)
- 42 CFR 2.26: Right to request privacy protection (checked October 6, 2026)
- 42 CFR 2.31: Consent requirements (checked October 6, 2026)
- 42 CFR 2.32: Notice and copy of consent to accompany disclosure (checked October 6, 2026)
- 42 CFR 2.33: Uses and disclosures permitted with written consent (checked October 6, 2026)
- 45 CFR Part 164, Subpart D: HIPAA breach notification for unsecured protected health information (checked October 6, 2026)