42 CFR Part 2 Is Now Enforced Like HIPAA: What Therapists Treating SUD Must Do
Prices and facts checked October 13, 2026. We don't accept payment for rankings.
On this page
What happened: February 16, 2026 was the compliance deadline for the updated substance use disorder (SUD) confidentiality rule, 42 CFR Part 2. Three days earlier, HHS's Office for Civil Rights announced a civil enforcement program, and it began accepting complaints and breach reports on the 16th (HIPAA Journal). It's the first time OCR has used civil enforcement for Part 2, with penalties that match HIPAA's (Healthcare Innovation).
Why it matters today: if your practice is a Part 2 program, or receives Part 2 records from one, the rules are now enforceable in the same way as HIPAA. That includes the vendors that handle those records, such as AI note-taking tools.
Not legal advice. Whether you're a "Part 2 program" depends on federal assistance and how you hold yourself out. Confirm your status with counsel.
Who it applies to
- Federally assisted SUD treatment programs are directly covered and subject to civil enforcement (Foley Hoag).
- Covered entities that receive Part 2 records, and business associates, which the rule adds to the definition of qualified service organization (Baker Donelson).
Many therapists who treat co-occurring conditions receive Part 2 records even if they aren't a Part 2 program themselves.
The key changes
| Area | What changed |
|---|---|
| Consent | One prospective consent can cover treatment, payment and health care operations (TPO) |
| Redisclosure | HIPAA-regulated recipients may redisclose under HIPAA, except for use in proceedings against the patient |
| No segmentation | Records received under a TPO consent don't need to be kept separate |
| SUD counseling notes | Need their own separate consent, like HIPAA psychotherapy notes |
| Legal proceedings | Records can't be used against a patient without consent or a court order |
| Breach notification | HIPAA breach rules now apply to Part 2 records |
| Patient rights | Request restrictions; accounting of disclosures (compliance date postponed) |
| Penalties | HIPAA's civil penalty tiers, plus possible criminal penalties |
Sources: Baker Donelson; HIPAA Journal; CHCS.
What this means for AI note tools
AI scribes and note generators for sessions involving SUD treatment are handling Part 2 information. Practical implications:
- Your vendor agreement needs Part 2 terms. Check your BAA, or qualified service organization agreement, covers Part 2 records (Foley Hoag).
- Counseling notes are special. If an AI tool drafts detailed SUD counseling notes kept separately from the record, treat them like psychotherapy notes: separate consent before disclosing.
- Breaches are reportable. A vendor breach involving SUD records now triggers HIPAA-style notification duties.
- No training on client data without a clear legal basis. Ask vendors whether de-identified transcripts are used to improve models.
Our general guide covers consent for AI note takers under HIPAA.
Your compliance checklist
- Update your Notice of Privacy Practices. OCR released model notices (Healthcare Innovation).
- Revise consent forms for the single TPO consent, plus separate counseling-note consent.
- Update BAAs and vendor contracts, including AI tools.
- Set up a complaints process and breach procedures covering SUD records.
- Train your staff, including anyone using AI tools on SUD sessions.
FAQ
Is Part 2 the same as HIPAA now?
Closer, not the same. Part 2 still restricts use of records in legal proceedings and requires separate consent for SUD counseling notes.
Do solo therapists have to comply?
If you're a federally assisted program that holds itself out as providing SUD treatment, or you receive Part 2 records, parts of the rule apply. Check your status.
Has OCR fined anyone yet?
Not that we've found as of October 2026. The program began accepting complaints on February 16, 2026.
Sources
Pages we used for this article, checked on or before the update date above.
- HIPAA Journal · hipaajournal.com
- Healthcare Innovation · hcinnovationgroup.com
- Foley Hoag · foleyhoag.com
- Baker Donelson · bakerdonelson.com
- CHCS · chcs.org
Changelog: Oct 13, 2026: first published.