On February 16, 2024, the US Department of Health and Human Services (HHS), through the Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA), published the Final Rule modifying the Confidentiality of SUD Patient Records regulations (February Final Rule) to align certain 42 CFR Part 2 (Part 2) regulations more closely with HIPAA regulations. Two months later, on April 22, 2024, OCR issued a Final Rule modifying the HIPAA Privacy Rule (April Final Rule) and addressed both the HIPAA Privacy Rule and Part 2–related modification requirements to the NPP.
As discussed in our overview of these compliance requirements, covered entities creating, receiving, maintaining, or transmitting Part 2 records are required to update their NPP by February 16, 2026. Part 2 programs that are not also covered entities must align their Part 2 Patient Notice requirements with NPPs, including adopting new header language, providing descriptions of permitted uses and disclosures of Part 2 records, outlining patient rights, and adding in required statements with respect to the Part 2 program’s duties.
New OCR guidance
On February 13, 2026, OCR updated the webpage Understanding Confidentiality of Substance Use Disorder (SUD) Patient Records or “Part 2” to provide in part the following:
- Updated Model HIPAA NPP for HIPAA covered entities;
- Model Part 2 Patient Notice for Part 2 programs;
- Online portal to file a Part 2 complaint if a person believes that an individual or an organization shared SUD patient records in noncompliance with Part 2; and
- Guidance for Part 2 programs regarding reporting breaches of unsecured Part 2 records (similar to how HIPAA breaches are reported).
We note that, in connection with updating its model NPP to incorporate the requirements related to SUD treatment records, OCR also eliminated the various formats of its prior model NPPs, consolidating them down into one version for health care providers and one for health plans.
Takeaways
Compliance date and enforcement
Covered entities creating, receiving, maintaining, or transmitting Part 2 records are required to update their NPP by today, February 16, 2026, and OCR now has the authority to begin enforcing Part 2 infractions. We note that these updates apply to organizations beyond Part 2 programs. For example, if a primary care physician receives a patient’s medical record from a hospital operating a Part 2 program, and that record contains SUD treatment records, the primary care physician will need to have an updated NPP, as the physician received Part 2 records.