By Neil Brown, Alaina Crislip, Lindsay Petrosky, and Parker Zopp
In 2024, Jackson Kelly attorneys authored an insight detailing how the U.S. Department of Health and Human Services (HHS) had published a new rule that significantly changed the federal regulations codified at 42 C.F.R. Part 2 (“Part 2”) (hereafter, the “2024 Part 2 Rule”).[1] As detailed in the blog post, Part 2 regulations protect the privacy of patients’ substance use disorder (SUD) records.
The 2024 Part 2 Rule places new compliance obligations on SUD diagnosis and treatment programs defined as “Part 2 Programs” under Part 2, as well as entities that lawfully receive SUD records from Part 2 Programs known as “Lawful Holders.” The deadline for compliance with certain requirements of the 2024 Part 2 Rule is February 16, 2026. The following is a non-exhaustive list that may offer a glimpse of the type of changes that could apply to your organization under the 2024 Part 2 Rule.
- Simplified Patient Consent for Routine Uses and Disclosures
Patients can now sign a single written consent that covers all future uses and disclosures of their SUD records for treatment, payment, and healthcare operations.[2] Further, when such records are disclosed for TPO purposes, a covered entity or business associate under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) may further use and disclose those SUD records in accordance with the HIPAA regulations until the patient revokes that consent.[3]
- New Requirements for Sharing SUD Records
Whenever SUD records[4] are disclosed with a patient’s written consent, the disclosure must include a copy of the consent or a clear explanation of the scope of the consent, along with one of the 2 specific notice statements detailed in the Part 2 regulations.[5] Organizations must update their documentation and processes to meet these requirements.
- Integration of SUD Records with Other Health Records
The 2024 Part 2 Rule includes an express statement a Part 2 program, HIPAA covered entity, or HIPAA business associate that receives records based on a single consent for all TPO is not required to segment or segregate Part 2 records.[6] This makes scenarios more likely that a non-Part 2 Program will receive Part 2 records and therefore become a Lawful Holder. Organizations should be mindful of how receiving Part 2 records may affect their operations.
- Mandatory Updates to Part 2 Patient Notice and HIPAA Notice of Privacy Practices
Part 2 Programs must have a patient notice of federal confidentiality requirements that aligns with the Notice of Privacy Practices (NPP) required by HIPAA.[7] Furthermore, Lawful Holders such as HIPAA covered entities must adapt their NPPs to include specific language pertaining to Part 2 by the February 16, 2026, compliance deadline.[8] It is important to note that for organizations that are required to have both a patient notice under Part 2 and an NPP under HIPAA, those organizations may use combine the required notices into a single notice, as long as all of the required elements are included.[9]
- Stricter Standards for De-Identifying SUD Records
SUD records must now be de-identified using the same strict standards as HIPAA.[10] Part 2 Programs and Lawful Holders that previously relied on Part 2’s less restrictive language for de-identifying records may need to evaluate whether they will have to change operations to comply with one of the methods for de-identification permitted by HIPAA.
- Breach Notification Rules Now Match HIPAA
The 2024 Part 2 Rule requires that Part 2 Programs follow HIPAA’s breach notification process.[11] This will be a notable change for those Part 2 Programs that are not also HIPAA covered entities, as Part 2 did not set forth its own federal process for data breach reporting in the event of an unauthorized access to, or acquisition of, Part 2 records. Part 2 Programs must become familiar with the HIPAA breach notification process, which can be stricter than various state data breach reporting laws.
- New Patient Rights
Patients now have more control over their SUD records in ways that mirror rights under HIPAA. For instance, a Part 2 Program must permit a patient to request that the Part 2 Program restrict uses or disclosures of records about the patient to carry out TPO, even when the patient has signed written consent for such disclosures.[12] A Part 2 Program generally does not have to agree to such a request, except in a couple of designated circumstances.[13]
- Increased Legal Protections
The 2024 Part 2 Rule updates various aspects of Part 2 to protect SUD records from being used or disclosed in any civil, criminal, administrative, or legislative proceedings against a patient without the patient’s specific written consent or a court order.[14]
- Enforcement Aligned With HIPAA
Under the 2024 Part 2 Rule, civil and criminal penalties for Part 2 noncompliance are now aligned with HIPAA. This means violations can result in steep fines—over $70,000 per violation per day, and up to $2.1 million per year for identical offenses.[15]
As the Part 2 federal regulations move SUD record confidentiality protections more in line with HIPAA, there is potential for enforcement, including significant penalties if subject organizations are noncompliant. The incoming regulatory changes are not just limited to the summary discussed in this post. If your organization handles SUD records, now is the time to review and update your policies, procedures, and systems before February 16, 2026.
If you have any further questions, please contact Alaina Crislip at Jackson Kelly.
[1] Confidentiality of Substance Use Disorder (SUD) Patient Records, 89 Fed. Reg. 12472 (published April 16, 2024). As discussed further below in this post, HHS is also requiring certain changes related to Part 2 updates to HIPAA’s Notice of Privacy Practices (NPP) that were detailed in another HHS rule entitled “HIPAA Privacy Rule To Support Reproductive Health Care Privacy” (hereafter, the “HIPAA Reproductive Health Rule”). See 89 Fed. Reg. 32976 (published April 26, 2024). Jackson Kelly attorneys previously provided an overview of the HIPAA Reproductive Health Rule in a 2024 blog post. However, on June 18, 2025, the U.S. District Court for the Northern District of Texas issued an order declaring unlawful and vacating most of the HIPAA Reproductive Health Rule. See Carmen Purl, et al. v. U.S. Department of Health and Human Services, et al., No. 2:24-cv-00228-Z (N.D. Tex. June 18, 2025). With respect to the rule’s new requirements for NPPs detailed at 45 C.F.R. § 164.520, the court vacated only the provisions that were deemed unlawful, which were 45 C.F.R § 164.520(b)(1)(ii)(F), (G), and (H). HHS has posted a notice on its website stating that the remaining modifications to the NPP requirements are undisturbed and remain in effect. See HIPAA Privacy Rule Final Rule to Support Reproductive Health Care Privacy: Fact Sheet, HHS, https://www.hhs.gov/hipaa/for-professionals/special-topics/reproductive-health/final-rule-fact-sheet/index.html.
[2] See 42 C.F.R. § 2.33(a)(2).
[3] See id. § 2.33(b)(1).
[4] Please note that Part’s 2 definition of “records” does not include a new category of documentation referred to as “SUD counseling notes.” The definition of SUD counseling notes includes, in part, “notes recorded (in any medium) by a part 2 program provider who is a SUD or mental health professional documenting or analyzing the contents of conversation during a private SUD counseling session or a group, joint, or family SUD counseling session and that are separated from the rest of the patient’s SUD and medical record.” Id. § 2.11. This definition makes SUD counseling notes similar to “psychotherapy notes” under HIPAA. See 45 C.F.R. § 164.501. A patient must provide a separate written consent for a use or disclosure of SUD counseling notes, as a written consent for SUD counseling notes may only be combined with another written consent for a use or disclosure of SUD counseling notes. See 42 C.F.R. § 2.31(b)(2).
[5] See id. § 2.32.
[6] See id. § 2.12(d)(2)(C).
[7] See id. § 2.22.
[8] See 45 C.F.R. § 164.520.
[9] HIPAA Reproductive Health Rule, 89 Fed. Reg. 32976, 33047 (published April 26, 2024).
[10] See 42 C.F.R. § 2.52(b)(3), § 2.54(b).
[11] See id. § 2.16(b).
[12] Id. § 2.26(a)(1).
[13] See id. § 2.26(a)(2).
[14] See id. § 2.12(d)(1).
[15] Annual Civil Monetary Penalties Inflation Adjustment, 89 Fed. Reg. 64815 (published Aug. 8, 2024).