Why Part 2’s compliance date reached hospitals that never ran a treatment program

The week

February 16, 2026 was the compliance date for HHS’s February 2024 final rule revising 42 CFR Part 2, the confidentiality rules for substance use disorder treatment records from federally assisted programs. The rule implemented changes Congress made in the CARES Act. It allowed a single patient consent for treatment, payment and health care operations, and let covered entities and business associates that receive records under that consent redisclose them as HIPAA permits. It applied HIPAA-style breach notification to Part 2 records, moved civil enforcement to HIPAA’s penalty framework, and kept limits on using the records in proceedings against the patient. Covered entities that receive Part 2 records had to update their notices of privacy practices by the same date. On February 13, HHS’s Office for Civil Rights announced its Part 2 enforcement program, and it began accepting Part 2 complaints and breach reports on February 16.

Earlier in this series, we looked at the 2024 rule as a data-labeling problem: easier consent only works if systems know which data is which. That remains true. The compliance date added something different. Part 2 used to be enforced mainly through criminal provisions that were rarely used, and it lived in the specialty programs that generated the records. From February 16, it sat inside the same civil enforcement machinery as HIPAA, run by an office that takes complaints from patients and breach reports from organizations every day.

That change mattered most to organizations that do not think of themselves as Part 2 programs. Consider a general hospital that receives a discharge summary from an outside treatment program, or a health plan that pays its claims. Add the health information exchange and the business associates behind them. All now hold Part 2 records with HIPAA-style obligations attached. For those recipients, the rule asks three things over the life of a record: what they tell patients, how they use and pass on what they receive, and what happens when something goes wrong.

What recipients tell patients

The rule required covered entities that create or maintain Part 2 records to update their notices of privacy practices by the compliance date. This is the most visible obligation and the easiest to verify. A patient, an advocate or OCR can compare the notice on a hospital’s website with the rule’s requirements in minutes.

The work is mostly legal and administrative. The notice must describe how Part 2 records may be used and disclosed, including the limits on use in proceedings against the patient. Release of information staff, patient access teams and call centers need to explain the notice when asked. Organizations that rely on a parent system’s notice, or on one notice across affiliated entities, should confirm that it covers every entity that actually receives Part 2 records. Counsel should review the language, because it is the document a complaint investigator reads first. A dated record of when each entity’s notice changed, and where it was posted and distributed, is cheap to keep and useful to produce.

How recipients use and pass on records

The rule’s main simplification applies here. A covered entity or business associate that receives records under a single consent for treatment, payment and operations may use and redisclose them as HIPAA permits. HHS said such recipients do not have to segregate the records. That removes much of the friction that kept these records out of integrated care.

Two limits travel with the records anyway. First, the restriction on use in civil, criminal, administrative or legislative proceedings against the patient still applies, absent specific consent or a qualifying court order. Second, the consent itself can be revoked, and disclosures for purposes outside treatment, payment and operations still need their own basis. In practice, that puts the burden on processes that handle legal demands and unusual disclosures, not on everyday clinical sharing. The subpoena desk, the risk management office and anyone who responds to law enforcement requests need a reliable way to ask whether responsive records include Part 2 material. Business associate agreements should say how the associate will handle a legal demand for such records and how quickly it will tell the covered entity.

Health plans deserve particular attention. They receive Part 2 information through claims and care management, often without a direct relationship with the treating program. Their redisclosures to vendors, analytics partners and other plans now sit within HIPAA’s rules, which are familiar to them. Their handling of legal demands may not have been written with Part 2 in mind.

What happens when something goes wrong

The compliance date brought Part 2 records under HIPAA-style breach notification. An incident that exposes them is now assessed and reported through the same process as any breach of protected health information, with notices to individuals, to HHS and, for large breaches, to the media. Incident response plans need one added step: determining whether compromised data included Part 2 records, because the answer affects how the breach is described and what patients may fear from it.

Enforcement also changed character. Civil penalties now follow HIPAA’s tiers, and OCR investigates on the basis of complaints and breach reports. For a hospital, that means a patient who believes a substance use record was mishandled has a well-known place to complain. It also means a breach report involving Part 2 data is likely to prompt questions about the notice, the redisclosure controls and the legal-demand process described above. The three parts connect. A weakness in any of them is what an investigation would find.

None of this calls for a new program. It calls for adding Part 2 to existing HIPAA processes in three named places: the notice, the legal-demand workflow and the breach assessment. Compliance officers should be able to show each change on paper.

With hindsight

The compliance date held, and OCR’s enforcement program went live on schedule, with complaint and breach intake for Part 2 records from February 16. HHS also published compliance materials shortly before the deadline. Eight months on, the most visible change for recipients was administrative: updated notices, revised business associate agreements and breach assessments that now ask about substance use records.

The quieter change was cultural. Part 2 had long been treated as the treatment program’s concern, with the rest of a health system assuming it held no such records. The rule’s design, which lets protected records flow under HIPAA’s rules, made that assumption harder to sustain. Organizations that mapped where Part 2 records arrive, and gave their legal-demand and breach teams a way to identify them, were in a position to answer an OCR inquiry. We would not predict the pace of enforcement. We would expect inquiries to start where complaints and breaches start.