On August 25, 2025, the U.S. Department of Health and Human Services (“HHS”) delegated the administration and enforcement (the “Delegation”) of 42 C.F.R. Part 2 (“Part 2”), the federal rules governing the confidentiality and privacy of substance use disorder records, to the HHS Office for Civil Rights (“OCR”).
Part 2 was most recently modified through a final rule in February 2024 (the “Final Rule”) to better align with requirements set forth under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended (“HIPAA”). The Final Rule also included new enforcement provisions, which were previously absent from Part 2. Providers and other entities subject to Part 2 are required to comply with applicable provisions of the Final Rule by February 16, 2026.
Pursuant to the Delegation, HHS OCR may now undertake the following actions when administering and enforcing Part 2:
- Impose civil monetary penalties for failure to comply with Part 2;
- Enter into resolution agreements, monetary settlements and corrective actions plans, or impose money penalties for failure to comply with Part 2;
- Issue subpoenas requiring the attendance and testimony of witnesses and the production of any evidence that relates to any matter under investigation or compliance review for failure to comply with Part 2; and
- Make decisions regarding the interruption, implementation and enforcement of Part 2.
Under the Final Rule, similar to HIPAA, individuals have the ability to file complaints alleging violations of Part 2 and programs and providers subject to Part 2 are obligated to provide notification of breaches of Part 2 program records.
The Substance Abuse and Mental Health Services Administration (“SAMHSA”) previously enforced Part 2. Historically, enforcement of Part 2 has been limited; however, the alignment of Part 2 with HIPAA through the Final Rule and the Delegation suggests the federal government’s intent to actively enforce compliance with Part 2. Such enforcement efforts are consistent with the Trump administration’s approach to enforcing HIPAA. HHS OCR has been increasingly active in its investigations of HIPAA breaches and resolutions of such investigations and has entered into thirteen (13) settlement agreements in 2025 thus far, compared to sixteen (16) in 2024 and fourteen (14) in 2023.
In addition to those previously mentioned, key provisions of the Final Rule included the following: (i) permitting a single consent to authorize all future uses and disclosures (including re-disclosures) of Part 2 records for treatment, payment and healthcare operations purposes as permitted under HIPAA; (ii) aligning Part 2 notice requirements with those of the HIPAA notice of privacy practices; (iii) authorizing the disclosure of Part 2 records without consent to public health authorities if de-identified according to the HIPAA standards; (iv) restricting the use of Part 2 records and testimony in civil, criminal, administrative and legislative proceedings against patients without consent or a court order; and (v) protecting investigative agencies from civil or criminal liability if they unknowingly and inadvertently receive Part 2 records without a court order. Ropes & Gray’s full analysis of the Final Rule and its implications can be found here.
To prepare for the February 16, 2026 deadline and potential enforcement, regulated providers and other entities should proactively review their privacy and breach reporting policies and procedures, notice of privacy practices, consent and authorization forms, contracts with vendors and security safeguards to ensure compliance with Part 2.
