New HHS Regulations on Substance Use Disorder Record Privacy

The U.S. Department of Health and Human Services (HHS) has released a Final Rule revising the regulations under 42 CFR Part 2, which governs the confidentiality of substance use disorder (SUD) records. Traditionally, these regulations have imposed stricter privacy standards than those outlined in the Health Insurance Portability and Accountability Act (HIPAA), due to the sensitive nature of SUD treatment data. As a result of these updates, covered entities must adjust their Notices of Privacy Practices (NPP) to integrate provisions for managing SUD records, ensuring adherence to the new requirements.

The deadline for compliance with these modifications to the NPP, which involves specific disclosures concerning the handling of SUD records under Title 42 CFR Part 2, is set for February 16, 2026. This is crucial for any HIPAA-covered entity engaged in the diagnosis, treatment, or referral for SUD treatment, particularly those entities connected with a U.S. government department or agency. The regulations cover records containing identifiable patient information related to diagnosis, prognosis, or treatment data associated with SUD education, prevention, and related programs.

Entities that have not yet updated their NPP are urged to act swiftly to meet regulatory compliance requirements and avoid potential penalties. The Office for Civil Rights (OCR) is responsible for enforcing this regulation and may conduct reviews and investigations for alleged noncompliance with Part 2. The enforcement framework, established under section 3221 of the CARES Act and codified at 42 CFR Part 2, aims to bolster patient rights and enhance privacy protections for SUD records. Penalties for non-compliance align with existing HIPAA standards and take immediate effect without phased implementation.

HHS provides resources to assist organizations in aligning with these regulatory compliance requirements. While templates are available for preliminary guidance, it's strongly recommended for organizations to consult legal counsel to ensure their final NPP notices conform to the updated regulations. Additionally, working alongside legal advisors can help verify that proper procedures and training measures are implemented, as compliance needs may vary among organizations.

Organizations should examine their current NPP to determine whether it adequately addresses the usage and disclosure of SUD records under Title 42 CFR Part 2. Should they anticipate transactions or strategic shifts that could invoke these regulations, an early assessment is advised to prevent unforeseen compliance issues. For guidance in updating your Notice of Privacy Practices in accordance with revisions to 42 CFR Part 2, reach out to Jean Pechette, Jillian Cash, or another member of Buchanan's healthcare team for assistance.