With the February 16, 2026, deadline looming, health care providers subject to federal programs like Medicaid must take swift action to comply with updated regulations under 42 CFR Part 2. These rules, which aim to safeguard the privacy of substance use disorder (SUD) treatment records, bring significant changes to enforcement and align penalties with HIPAA.

Heightened Oversight and Penalties

Historically, enforcement of Part 2 regulations was limited, primarily focusing on criminal penalties. However, recent updates have shifted oversight to the Department of Health and Human Services (HHS) Office for Civil Rights (OCR). Providers now face penalties comparable to those under HIPAA, underscoring the urgency for compliance.

To avoid enforcement actions, providers must implement several critical changes to their privacy practices, including updates to Notice of Privacy Practices (NPP), consent forms, and record-keeping procedures.

Major Changes for Providers

The new rules introduce several key requirements:

  • Updated NPPs: All HIPAA-covered entities handling Part 2 records must revise their NPPs to include language reflecting the stricter protections for SUD records. This includes a prohibition on using such records in legal proceedings without explicit patient consent or a court order.
  • Streamlined Consent Process: Providers can now use a single consent form for Treatment, Payment, and Health Care Operations (TPO). Unlike HIPAA, which allows disclosures for TPO without consent, Part 2 mandates specific authorization for such purposes. Consent forms must be updated accordingly.
  • SUD Counseling Notes: A new category, "SUD Counseling Notes", has been introduced, similar to HIPAA psychotherapy notes. These notes must be kept separate from a patient’s medical record and require separate authorization for most disclosures. Failure to maintain separation forfeits their Part 2 protection.
  • Redisclosure Protections: Any disclosure of Part 2 records must include a notice prohibiting further redisclosure unless explicitly allowed by the regulations.

Essential Steps for Compliance

Health care providers should prioritize the following actions to meet the February 16 deadline:

  1. Audit and Update NPPs: Ensure NPPs include mandatory language regarding Part 2 protections.
  2. Revise Consent Forms: Update authorization forms to align with Part 2 requirements and secure TPO consent at intake.
  3. Handle SUD Counseling Notes Properly: Maintain these notes separately to preserve their protected status.
  4. Train Staff: Conduct comprehensive training for staff handling SUD records. The OCR views inadequate training as "willful neglect" in enforcement investigations.
  5. Review Vendor Agreements: Providers must establish Qualified Service Organization Agreements (QSOAs) with vendors accessing SUD records. These agreements act as the Part 2 equivalent of HIPAA’s Business Associate Agreements (BAAs) and should address both sets of requirements.

Conclusion

With only weeks remaining until the February 16, 2026, deadline, providers offering SUD treatment must take immediate steps to align their practices with the revised 42 CFR Part 2 rules. The updates bring stricter oversight and penalties, making compliance a critical priority for avoiding enforcement actions and safeguarding patient privacy.

Read the source