Seyfarth Synopsis: The Department of Health and Human Services has delegated enforcement authority to the Office of Civil Rights for 42 CFR Part 2, which protects the confidentiality of substance use disorder records. Covered entities must update their HIPAA documents to reflect these changes by February 16, 2026.
On August 25, 2025, the U.S. Department of Health and Human Services (HHS) Office of the Secretary authorized the Director of the Office for Civil Rights (OCR) to enforce the “Confidentiality of Substance Use Disorder (SUD) Patient Records” regulations found at 42 CFR Part 2, including the right to impose civil penalties, issue subpoenas and take corrective actions for noncompliance. These rules, finalized in February 2024, aim to protect the privacy of patients’ SUD treatment records, and require updates to HIPAA Privacy Policies and Notices of Privacy Practices.
As a reminder, in February 2024, 42 CFR Part 2 was modified to strengthen the confidentiality protections around a patient’s substance use disorder treatment records that covered entities or their business associates may encounter. In doing so, the provisions and definitions in a covered entity’s HIPAA Privacy Policy and Notice of Privacy Practices were required to be reviewed and revised to ensure such protections were provided to employees.
Action Item: Review and update HIPAA documents now to meet the February 16, 2026 deadline.
For more information, a fact sheet on the modified rule can be found here.