For years, health systems and health care providers have struggled to make sense of the rules that govern the use and disclosure of substance use disorder (SUD) treatment records. In particular, providers have questioned how to restrict access enough to comply with the rules, which are codified in 42 CFR Part 2, while enabling access enough to ensure that patients receive proper and comprehensive treatment. The U.S. Department of Health and Human Services recently issued new rules that aim to minimize this dilemma. These rules take effect on April 16th of this year but will not be fully enforced until February 16th, 2026.

To whom do the Part 2 Rules apply?

The Part 2 Rules apply only to federally assisted programs that provide SUD diagnosis, treatment, or referral for treatment. These programs can range from individual SUD treatment specialists (yes, an individual fits within the rule’s definition of “program”), to stand-alone clinics, to dedicated behavioral health or SUD treatment wings of general hospitals. To determine whether a given SUD treatment specialist or unit is subject to the Part 2 Rules, providers are encouraged to review official guidance and err on the side of caution. Does the individual or unit advertise that it delivers SUD treatment services? Does the individual or unit accept, receive, or benefit from a federal tax exemption or reimbursement from a program like Medicare or Medicaid? If the answer to these two questions is yes, then chances are the Part 2 Rules apply.

What information does the Part 2 Rules apply to?

The Part 2 Rules apply broadly to SUD treatment records. These records include medical charts, billing forms, e-mails, voicemails, texts, and other information “created by, received, or acquired by” a Part 2 program with reference to a SUD patient. To date, a non-Part 2 program that received SUD treatment records from a Part 2 program was expected to segregate out and provide special protection to those records. However, the new rules make it clear that such segregation is no longer required. The new rules also clarify that a non-Part 2 program does not become subject to the Part 2 Rules simply by acknowledging in a medical record that a patient received SUD treatment.

What are substantial changes to the Part 2 Rules?

One of the biggest improvements in the new rules is the simplification of patient authorization. The new rules make it possible for a patient to grant access with a single consent document to all of her or his current and future providers and payers for purposes of treatment, payment, and health-care operations. Moreover, the new rules make the content of the consent for Part 2 records the same as that for all other HIPAA-protected records.

The new rules align Part 2 with HIPAA in other respects, as well. Going forward, inappropriate uses or disclosures of Part 2 records will be reported to patients in accordance with the HIPAA Breach Notification Rule. Part 2 patient notices will take the same form as a HIPAA Notice of Privacy Practices. Patients will be entitled to the same rights they possess under HIPAA to restrict disclosure to their health plans about SUD treatments for which they have paid in full, to receive accountings of disclosures, and to opt out of fundraising communications. Even rule enforcement methods and penalties will be harmonized between Part 2 and HIPAA.

What do you need to do now to comply with the new Part 2 Rules?

Although the new rules become effective in April, DHHS will not commence enforcement efforts until February 16, 2026. This nearly two-year grace period is a blessing and a curse. It grants programs additional time to get their ducks in a row, but also eliminates any excuses for remaining noncompliant when the deadline hits. Part 2 programs are therefore encouraged to dust off their notices of privacy practices, policies, procedures, and training manuals while the new rules are on their minds. Even providers who are—or believe they are—not covered by Part 2 would benefit from a quick review of the fact sheets and other materials published by DHHS about the new rules. The lessons they learn will help them not only to meet the emerging standard of care with respect to the use and disclosure of SUD treatment records, but also to provide the best and most respectful care possible for their SUD treatment patients.

This article summarizes aspects of the law and does not constitute legal advice. For legal advice with regard to your situation, you should contact an attorney.