What it governs: Confidentiality of substance use disorder (SUD) treatment records maintained by federally assisted programs, a stricter and more specific standard than general HIPAA.
Current rule: HHS (OCR and SAMHSA) issued the final rule aligning Part 2 with HIPAA on February 8, 2024. It took effect April 16, 2024, and the compliance date was February 16, 2026. OCR announced it would accept complaints from that date, and enforcement follows the HIPAA process and penalty structure.
| Date | Event |
|---|---|
| February 8, 2024 | Final rule issued |
| April 16, 2024 | Rule took effect |
| February 16, 2026 | Compliance date; OCR began accepting complaints |
Key changes:
| Area | What changed |
|---|---|
| Consent | A single patient consent may cover all future uses and disclosures for treatment, payment and health care operations. HIPAA-regulated recipients may redisclose in line with the Privacy Rule. |
| Record segregation | Part 2 records no longer need to be segregated from other records. |
| Breach notification | The HIPAA Breach Notification Rule applies to Part 2 records. |
| Notice of Privacy Practices | Must be updated to describe Part 2 protections and patient rights. |
| Patient rights | Patients can get an accounting of disclosures, request restrictions, and complain to HHS; covered entities must have a complaint process. |
| Proceedings | Use of records or testimony in proceedings against a patient remains restricted without consent or a court order. |
Practical takeaway: Confirm that your NPP, consent form, breach plan and complaint process were updated by February 16, 2026.
Last verified against agency sources on October 30, 2026.
General information, not legal advice. Requirements change; confirm against the official source before you act, or ask us how this applies to your organization.