Compliance alert: Are you ready for the Part 2 deadline?

As a practicing psychologist, you are likely very familiar with HIPAA’s requirements. But if your practice provides SUD services, there are some regulatory changes that may affect you. Recent changes to federal regulations governing the confidentiality of SUD patient records—known as 42 CFR Part 2 (Part 2)—require updated privacy notices and new operational procedures. If your practice provides SUD services or receives SUD records, February 16, 2026, marks a critical compliance deadline that could affect your practice based on the 2024 Part 2 final rulesopens in new window.

With the Office of Civil Rights (OCR) within the Department of Health and Human Services (HHS) now in charge of enforcement and penalties aligned with HIPAA’s tier-based structure, failure to comply by February 16 could expose your practice to the same rigorous enforcement and tiered civil monetary penalties as HIPAA violations.

Originally issued in 1975, the Part 2 regulations were designed to safeguard the privacy of individuals receiving SUD treatment, protecting them from potential adverse consequences such as criminal prosecution, child custody disputes, divorce proceedings, and employment discrimination. These regulations impose stricter confidentiality protections than HIPAA, generally prohibiting disclosure of any information that could identify a person as having or having had a SUD without patient’s written consent. While these enhanced protections serve an important purpose, maintaining two separate regulatory frameworks for different types of health information has created significant compliance challenges. 

In response to the Coronavirus Aid, Relief, and Economic Security Act of 2020, which directed HHS to better align Part 2 with HIPAA, HHS issued a final ruleopens in new window on February 8, 2024, that took effect on April 16, 2024. This overhaul aimed to reduce the administrative burden on providers while maintaining rigorous privacy protections for patients. To better align 42 CFR Part 2 regulations with HIPAA, several fundamental shifts in how SUD records are managed were introduced. They include:

• Single patient consent: Patients can now sign one broad consent form for all future uses and disclosures of their records for treatment, payment, and health care operations (TPO).
• Redisclosure permissions: HIPAA-regulated entities that receive SUD records under a broad consent are now generally permitted to redisclose them in accordance with standard HIPAA Privacy Rules.
• Unified enforcement: Enforcement authority has been transferred to OCR, and penalties for Part 2 violations now mirror the significant, tier-based structure of HIPAA, ranging from $141 to over $2.1 million per year.
• Breach notification: The HIPAA Breach Notification Rule now applies to Part 2 records, requiring providers to report data breaches to HHS and affected individuals.
• Patient rights expansion: Patients now have the right to request an accounting of disclosures of their SUD-related health data and can file formal complaints regarding Part 2 violations with HHS.

The compliance deadline for all individuals subject to the regulation is February 16, 2026.

Not all psychologists fall under Part 2. To be considered a Part 2 Program—and therefore required to comply by the February 16 deadline—you must meet both of these criteria:

1. You are “holding yourself out” as an SUD provider

Under 42 CFR 2.11opens in new window, a “program” means a person (other than a general medical facility) that holds itself out as providing and provides SUD diagnosis, treatment, or referral for treatment. This would mean that to qualify, you specifically market or identify your practice as providing SUD diagnosis, treatment, or referral. This is distinct from a general practice where a patient happens to have a substance use issue as part of a broader mental health presentation.

Treating patients who happen to have SUD within a general mental health practice—without holding the practice out as an SUD provider—does not by itself make you a Part 2 program.

2. You are “federally assisted”

This definition is intentionally broad and includes receiving any federal financial assistance, having a DEA registration to dispense controlled substances for SUD treatment, or holding tax-exempt 501(c)(3) status.

Note: Tax-exempt status [501(c)(3)] counts as federal assistance. If you hold yourself out as an SUD treatment provider and have tax-exempt status, you are likely a Part 2 program.

If you are a general practice psychologist treating various conditions and have not marketed yourself as an SUD specialist, you are generally not a Part 2 program.

If you are considered a Part 2 Program based on the information above, you must provide patients with a Part 2 Patient Notice, which can be combined with your HIPAA Notice of Privacy Practices (NPP) that complies with 42 CFR 2.22opens in new window. The required elements include:

• A prominent header explaining that the notice describes health information use, patient rights, and complaint procedures. The regulation (42 CFR 2.22) specifies the exact language that must be used.
• A uses and disclosures section: A description of each purpose for which you may use or disclose records without consent for TPO; a description (with at least one example) of disclosures that require written consent; and a statement that patients can now provide a single consent for all future TPO disclosures, easing care coordination.
• Legal protections: Clear language stating records cannot be used in civil, criminal, administrative, or legislative proceedings without written patient consent or a court order.
• Patient rights: A summary of patients’ rights, including their right to an accounting of disclosures and the right to request restrictions.

Beyond the notice updates, Part 2 programs must implement specific operational changes by the February deadline. This includes updating all written consent forms to include mandatory revocation language and the ability for patients to designate a permissible “class of persons” as recipients, rather than just named individuals. Crucially, each disclosure must now be accompanied by either a copy of the patient’s signed consent or a clear explanation of the scope of the consent.

The new rules also establish a category of “SUD Counseling Notes” that function like HIPAA psychotherapy notes—a concept most psychologists are already familiar with. Similar to how psychotherapy notes are handled under HIPAA, practices must formalize a workflow that ensures SUD counseling notes are maintained separately from the rest of the patient’s medical records. Also, because of their sensitive nature, a practitioner is prohibited from conditioning a patient’s treatment on that patient’s consent to disclose these specific notes.

Before the 2024 Final Rule, Part 2 records were not subject to the HIPAA Breach Notification Rule. Now, your practice’s breach response as related to SUD records must fully align with the HIPAA Breach Notification Rule, including conducting formal risk assessments, providing patient notices, and self-reporting to the HHS.

If you are already a HIPAA-covered entity, you must ensure your existing breach response and training procedures now extend to Part 2 records, which previously may have been handled differently or not at all. If you are a Part 2 program that was not previously subject to HIPAA (e.g., a cash-only practice that does not conduct electronic transactions), you will need to establish a breach notification program from the ground up that aligns with the HIPAA Breach Notification Rule. This includes formalizing procedures for conducting risk assessments, providing patient notices, and self-reporting breaches to HHS. Recognizing that building out these protocols for the first time can be daunting, HHS provides a dedicated resource on the Breach Notification Ruleopens in new window to help guide your practice through the necessary steps.

Furthermore, it is important for all staff members who handle SUD records to understand the heightened protection for this information, including the requirement for patient consent for TPO disclosures and the prohibition on use in legal proceedings. OCR often views lack of training as evidence of “willful neglect” in its investigations.

Even if you are not a Part 2 program, but you are a HIPAA-covered entity that receives or maintains records from a Part 2 program (such as a referral from a residential treatment center or care coordination), you are considered a “lawful holder” of that data and therefore you must update your NPPs by February 16, 2026, to explain how you use/disclose Part 2 records and the heightened restrictions. This update must reflect the heightened protections for these records—specifically that they cannot be used in legal proceedings against the patient without specific consent or a court order. If you receive/maintain Part 2 Records (but are not a Part 2 program), you must update your HIPAA Notice of Privacy Practices to include:

• Statement on limits in legal proceedings: SUD treatment records received from Part 2 programs cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against the individual unless based on written consent or a court order (after notice and opportunity to be heard). But the court order must be accompanied by a subpoena or other legal requirement compelling disclosure.
• Reflect more stringent law: A note that, unlike standard protected health information (PHI), use of these specific SUD records for TPO generally requires the patient’s written consent.
• Redisclosure statement: A statement that information disclosed under HIPAA may be subject to redisclosure by the recipient and therefore lose its protection.
• Fundraising opt-out: If you intend to use Part 2 records for fundraising, individuals must first be provided with a clear and conspicuous opportunity to elect not to receive fundraising communications.

Here are the key distinctions:

Understanding these rules and whether they apply to your practice is critical—especially now that, as of August 2026, HHS formally delegated enforcement of Part 2 regulations to OCR through a published Statement of Delegation of Authority (PDF, 206KB)opens in new window. This marks a fundamental shift from historical enforcement by the Department of Justice, which was primarily limited to criminal penalties. Now, psychologists should expect the same level of investigative rigor, compliance reviews, and audits that the OCR currently applies to HIPAA. Similar to the complaint process for alleged HIPAA violations, individuals can now report alleged violations of the Part 2 Regulations to federal authorities. In addition, under this new landscape, the OCR has the power to issue subpoenas, enter into resolution agreements, and impose significant civil monetary penalties for noncompliance.

With OCR now wielding the same enforcement authority for Part 2 as it does for HIPAA, psychologists who provide SUD treatment or receive Part 2 records should act now, as the deadline for compliance is fast approaching. The good news is that the 2024 Final Rule actually simplifies compliance for those subject to both HIPAA and Part 2 by allowing combined notices, eliminating segregation requirements, and permitting single consents for TPO purposes. The key is understanding whether these rules apply to your practice and taking the necessary steps before the deadline. This includes ensuring your NPPs contain the mandatory Part 2 statements, updating consent forms, and conducting potential staff training for any staff handling SUD records.