Free readiness check
Is your program ready for the new 42 CFR Part 2?
The updated rule has been enforceable since February 16, 2026. Thirteen questions show what changed and where your program is most exposed.
What changed, in plain terms
One consent can now cover all future treatment, payment and operations disclosures.
A new protected category that needs its own separate consent.
A new patient notice, plus rights to an accounting, restrictions and HHS complaints.
HIPAA breach notification rules now apply to Part 2 records.
HHS OCR enforces Part 2 with HIPAA-level penalties as of February 16, 2026.
Records still can’t be used against a patient without consent or a qualifying court order.
This check summarizes the February 16, 2024 final rule amending 42 CFR Part 2 (compliance date February 16, 2026) as reviewed in September 2026. Section numbers refer to 42 CFR Part 2. It is a general readiness screen, not legal advice, and it does not cover state confidentiality laws that may be stricter. The accounting of treatment, payment and operations disclosures made through an electronic health record is on hold until HHS updates the matching HIPAA rule. This tool is provided “as is” for general information only. Continued Compliance, Inc. makes no warranty that this information is accurate, complete or current, and is not liable for any decision made or action taken based on it. Using this tool does not create a consulting, attorney-client or other professional relationship. Rules change and vary by program type. Confirm requirements with HHS, the applicable state agency or qualified legal counsel before relying on them. Continued Compliance, Inc.