BY Phuong D. Nguyen, Esq. and Michael R. Alexander, Esq., Brown & Fortunato, P.C.
In 2024, the Department of Health and Human Services (“HHS”) published a final rule updating protections for the confidentiality of substance use disorder (“SUD”) patient records. The final rule updated regulations pertaining to the confidentiality of SUD patient records found at 42 CFR Part 2, commonly referred to as “Part 2.” The intent of the final rule was to align certain aspects of Part 2 with HIPAA. The updated rules impact both Part 2 Programs, which are providers that provide SUD treatment, as well as those providers who may receive SUD patient records, which are called “lawful holders” under the regulations.
On February 13, 2026, HHS announced a program to implement and provide for civil enforcement of the final rule under the Office for Civil Rights (“OCR”). Beginning February 16, 2026, persons subject to Part 2, which includes health care entities and providers, must comply with the final rule’s requirements to protect the confidentiality of SUD patient records. In addition, beginning on that date, OCR accepted complaints alleging violations of the final rule and accepted notifications of breaches of SUD patient records.
Although Part 2 generally applies to the use and disclosure of SUD patient records, there are differences which depend on whether the health care provider is a “Part 2 Program” or “lawful holder.” One difference that we want to highlight are the requirements pertaining to notice of privacy practices. But first, it is useful to first determine whether a health care provider is a Part 2 program or lawful holder. A Part 2 program is defined as a federally assisted program that meets the definition of a “Program” under Part 2. A program is “federally assisted” if:
- It is conducted in whole or in part, directly or by contract, by any department or agency of the United States, with some exceptions for the Department of Veterans Affairs and Uniformed Services;
- It is being carried out under a license, certification, registration or other authorization granted by any department or agency of the United States (e.g., a Medicare participating provider);
- It is supported by funds provided by any department or agency of the United States; or
- It is assisted by the Internal Revenue Service through the allowance of income tax deductions for contributions to the program or through the granting of tax-exempt status to the program.
Hence, many health care providers meet the definition of being federally assisted under Part 2.
The next question is whether the health care provider is a “Program.” Part 2 defines a “Program” to mean:
- A person (other than a general medical facility) that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or
- An identified unit within a general medical facility that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or
- Medical personnel or other staff in a general medical facility whose primary function is the provision of substance use disorder diagnosis, treatment, or referral for treatment and who are identified as such providers.
Examples of Programs include treatment or rehabilitation programs, employee assistance programs, programs within general hospitals, school-based programs, and private practitioners who hold themselves out as providing, and provide SUD diagnosis, treatment, or referral for treatment. On the other hand, emergency department personnel who refer a patient to the intensive care unit for an apparent overdose are not considered to be a Part 2 program unless the primary function of such personnel is the provision of SUD services or the emergency department has promoted itself to the community as a provider of SUD services. Under these definitions, a general hospital facility or physician office would likely not be a Program under Part 2 unless they hold themselves out to provide SUD services.
That being said, health care facilities and providers that are not Part 2 programs may still be subject to Part 2 as lawful holders. Part 2 defines a “lawful holder” as a person who is subject to Part 2 because the person received SUD patient records pursuant to the patient’s written consent or under an applicable exception. For example, a primary care provider that receives SUD patient records from a Part 2 program is a lawful holder under Part 2.
Similar to the requirements under HIPAA—which Part 2 programs may already be subject to as covered entities—Part 2 Programs are required to provide to patients a notice, written in plain language, of the Program’s legal duties and privacy practices. The content of the notice must contain certain elements required by Part 2, some of which are more stringent than what HIPAA requires. The OCR has published a model Part 2 Patient Notice that Part 2 Programs can review.
While Part 2 does not directly require lawful holders to provide a notice of privacy practices, as many lawful holders are also covered entities, they are required by HIPAA to provide patients with a notice of privacy practices. And the notice of privacy practices required under HIPAA must include, among other requirements, “sufficient detail to place the individual on notice of the uses and disclosures that are permitted or required by this subpart [42 CFR 164.520] and other applicable law, such as 42 CFR part 2.” 45 CFR 164.520(b)(1)(ii)(D). Hence, if a covered entity determines that it might receive SUD patient records, even though it is not a Part 2 Program, it may want to consider updating its notice of privacy practices, including those requirements set forth in Part 2. The OCR has published a model notice of privacy practices for HIPAA covered health care providers that covered entities can review and adapt, as needed.