Author: A. Ant, CADC-II, Licensing & Accreditation Expert.
Disclaimer: This content is provided for general informational purposes only and should not be construed as medical, clinical, legal, financial, tax, accounting, insurance, licensing, accreditation, regulatory, billing, employment, or compliance advice. Requirements change often. Consult qualified professionals or contact Continued Compliance, Inc. at (213) 864-8554 for guidance specific to your situation.
Photo: A behavioral health compliance officer reviews an updated consent and privacy policy binder alongside a laptop displaying an electronic health record consent screen.
If your program has not updated its consent forms, Notice of Privacy Practices, and redisclosure procedures for the 42 CFR Part 2 2026 update, you are not looking at an upcoming deadline. You are already out of step with an actively enforced federal requirement. The compliance deadline for the 2024 Part 2 Final Rule was February 16, 2026, and the HHS Office for Civil Rights began accepting complaints and conducting enforcement that same day.
What 42 CFR Part 2 Actually Protects
42 CFR Part 2 is the federal confidentiality law governing substance use disorder patient records created by “Part 2 programs” — federally assisted programs that provide SUD diagnosis, treatment, or referral for treatment. For decades, Part 2 operated as a stricter, separate privacy regime from HIPAA, requiring specific written consent for nearly every disclosure of SUD treatment records, even between providers coordinating care for the same patient. That separation created real friction: a hospital emergency department, for example, might not be able to see that a patient was in active SUD treatment because Part 2 consent had not been obtained for that specific disclosure.
42 CFR Part 2 2026: What the Final Rule Changed
On February 8, 2024, HHS finalized a rule implementing Section 3221 of the CARES Act, which required Part 2 to be more closely aligned with HIPAA. The rule took effect April 16, 2024, with a compliance deadline of February 16, 2026 — the 42 CFR Part 2 2026 deadline that has now passed, with OCR enforcement active since that date.
The changes that matter most for a rehab center’s day-to-day operations:
- Single, unified consent. A patient can now sign one consent covering future disclosures of their SUD records for treatment, payment, and health care operations (TPO), rather than a separate consent for every recipient. That consent remains valid until the patient revokes it in writing.
- HIPAA-aligned redisclosure. Once a HIPAA-covered entity or business associate lawfully receives Part 2 records, it may redisclose them in accordance with HIPAA — with one critical exception, described below.
- Updated Notices of Privacy Practices. Part 2 programs must update their NPPs to include Part 2-required elements aligned with HIPAA, under the amended requirements at 42 CFR Section 2.22.
- HIPAA Breach Notification Rule now applies. A breach involving SUD records now triggers the same four-factor risk assessment and notification timelines that apply to HIPAA breaches generally.
- OCR enforcement authority with real penalties. The Office for Civil Rights now has explicit enforcement authority over Part 2, with tiered civil monetary penalties reaching HITECH-Act levels — up to $2 million per violation category.
Where Part 2 Is Still Stricter Than HIPAA
The 2024 rule modernized 42 CFR Part 2. It did not eliminate its heightened protections. Two things still separate SUD records from ordinary HIPAA-covered health information, and both matter operationally:
- Consent for sharing remains more protective. Even with the new unified consent option, the baseline requirement for written patient consent to disclose SUD treatment records is stricter than standard HIPAA authorization rules for routine sharing.
- The legal-proceedings prohibition survives intact. Records received from a Part 2 program — or testimony relaying their content — cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against the individual unless there is written consent or a court order issued after notice and an opportunity for the individual or record holder to be heard. This protection predates the 2024 rule and was deliberately preserved through it.
What This Means for Your Program Right Now
Because the deadline has passed, this is not a planning exercise. It is a compliance gap-check. Confirm: Has your Notice of Privacy Practices been updated with the required Part 2 elements under Section 2.22? Have your consent forms been revised to reflect the unified TPO consent option, including revocation rights? Do your redisclosure practices distinguish between what HIPAA now permits and the legal-proceedings prohibition that still requires consent or a court order? Does your breach response plan incorporate the HIPAA Breach Notification Rule’s risk assessment and timelines for incidents involving SUD records? Have front-line staff been trained on the difference between routine TPO disclosures and the categories that still require heightened protection?
A program that treats this as settled because “the deadline already passed and nothing happened” is misreading the situation. OCR’s authority to investigate complaints and conduct compliance reviews did not expire on February 16, 2026 — it began that day.
The legal-proceedings prohibition described above is exactly what protects a client when law enforcement shows up with a subpoena. For the specific requirements around subpoenas, search warrants, and court orders, see Police Show Up With a Subpoena for Your Client — Does 42 CFR Part 2 Protect Them?
Continued Compliance helps behavioral health and substance use disorder providers align their consent forms, privacy notices, and redisclosure practices with the current 42 CFR Part 2 and HIPAA framework. If we partner, we will guarantee in writing to get your facility licensed, accredited, or certified, or your money back. Period. For a free consultation, contact Continued Compliance through our website or call (213) 864-8554.
Frequently Asked Questions
Is the 42 CFR Part 2 compliance deadline still upcoming?
No. The compliance deadline was February 16, 2026. As of that date, the Office for Civil Rights began accepting complaints and enforcing the updated Part 2 and HIPAA-aligned requirements. Programs that have not updated their consent forms, Notices of Privacy Practices, and redisclosure procedures are currently out of compliance, not preparing for a future deadline.
Does the 2024 rule mean Part 2 records are treated exactly like other HIPAA records now?
No. Redisclosure generally follows HIPAA once records are lawfully received, but two protections remain stricter than standard HIPAA: the consent requirements for sharing SUD records, and the prohibition on using Part 2 records or related testimony against a patient in legal proceedings without consent or a court order.
What is a “unified consent” under the new rule?
A single patient consent that authorizes a program’s use and disclosure of SUD records for treatment, payment, and health care operations going forward, rather than requiring a new consent for each recipient. It remains in effect until the patient revokes it in writing.
Leave a Reply