On February 16, 2024, the US Department of Health and Human Services (HHS), through the Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA), published the Final Rule modifying the Confidentiality of SUD Patient Records regulations (February Final Rule) to align certain 42 CFR Part 2 (Part 2) regulations more closely with HIPAA regulations. Two months later, on April 22, 2024, OCR issued a Final Rule modifying the HIPAA Privacy Rule (April Final Rule) and addressed both the HIPAA Privacy Rule and Part 2-related modification requirements to the NPP.
February Final Rule overview
As part of the February Final Rule, OCR and SAMHSA added new provisions to align the Part 2 Patient Notice with the NPP. The February Final Rule noted that the changes aligning the Part 2 Patient Notice with the NPP were applicable to the Part 2 Patient Notice only and did not include finalized changes to the NPP, which would be released in a future HIPAA rulemaking. For Part 2 providers that are not considered covered entities, the Part 2 Patient Notice must be updated to:
- Adopt the new header language identified in 42 C.F.R. § 2.22(b)(1)(i);
- Provide descriptions of permitted uses and disclosures of Part 2 records, which include uses and disclosures not requiring consent and those specifically requiring patient consent, respectively;
- Outline the rights of a patient receiving Part 2 services; and
- Lay out the duties of the Part 2 program, i.e., inputting required statements related to the privacy of Part 2 records, the requirement that the Part 2 program abide by the terms of the Part 2 Patient Notice currently in effect, the Part 2 program’s right to change the terms of the Part 2 Patient Notice at any time, etc.
April Final Rule overview
That future HIPAA rulemaking was the April Final Rule, which requires Part 2 programs and covered entities that create, receive, maintain, or transmit SUD records to update their NPP to address the following:
- Describe how uses and disclosures of PHI for treatment, payment, and healthcare operations, or without an authorization, are prohibited by, or materially limited by, “other applicable law,” such that the NPP should reflect any Part 2 limitations.
- Describe that a Part 2 record, or testimony relaying the content of a Part 2 record, may not be used or disclosed in a civil, criminal, administrative, or legislative proceeding against the individual without either the individual’s written consent or a court order after the individual is provided notice and an opportunity to be heard. The NPP must state that a court order authorizing this use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure prior to the record being used or disclosed.
- Provide a “clear and conspicuous” opportunity for an individual to elect not to receive fundraising communications if the covered entity intends to use Part 2 records for fundraising purposes.
The April Final Rule also contained requirements related to privacy protections for reproductive healthcare that would have required additional edits to the NPP. On June 18, 2025, a federal court in Texas[1] struck down these protections, thereby making the additional edits no longer applicable.
Additional compliance considerations
In addition to the required NPP changes going into effect on February 16, 2026, OCR’s authority to enforce Part 2 will take effect, which will allow the following:
- Individuals will be able to file complaints with OCR for alleged Part 2 violations;
- Part 2 providers will be required to report breaches of unsecured Part 2 records; and
- OCR can begin investigation and enforcement activities, including the imposition of civil monetary penalties for violations.
Upcoming OCR guidance
On February 2, 2026, OCR released its “OCR Resources in Support of Substance Use Disorder Treatment Month” guidance, indicating that it will provide additional information about Part 2 in a future announcement, including how to file Part 2 complaints and breach reports. OCR also stated that it will share a model Part 2 Patient Notice and updated model NPP.
Takeaways
COMPLIANCE DATE AND ENFORCEMENT
Covered entities creating, receiving, maintaining, or transmitting Part 2 records are required to update their NPP by February 16, 2026, and OCR will begin enforcing Part 2 infractions on that date.
SCOPE OF NPP CHANGES
NPP updates must include Part 2-specific limitations and information on due process protections in legal proceedings, and must provide a clear opt-out for fundraising that uses Part 2 records.
SCOPE OF PART 2 PATIENT NOTICE CHANGES
Part 2 programs that are not also covered entities must align their Part 2 Patient Notice requirements with NPPs, including adopting new header language, providing descriptions of permitted uses and disclosures of Part 2 records, outlining patient rights, and adding in required statements with respect to the Part 2 program’s duties.
WHAT’S NOT REQUIRED NOW
Reproductive health-related NPP elements and the redisclosure statement from the April Final Rule were vacated and are not required.
For more information on the content of this alert, please contact your Nixon Peabody attorney or the authors of this alert.
- See Purl v. United States Dept. of Health and Human Services, 787 F.Supp.3d 284 (ND Tex. 2025).
[back to reference ]