HHS OCR Announces Civil Enforcement Program for Confidentiality of Substance Use Disorder Patient Records

On February 13, 2026, the U.S. Department of Health and Human Services (“HHS”), Office for Civil Rights (“OCR”) announced its civil enforcement program to implement the updates to the Substance Use Disorder (“SUD”) confidentiality provisions of the regulation at 42 CFR Part 2 (“Part 2”).¹ The new enforcement program became effective February 16, 2026, in accordance with the deadline set by the 2024 Final Rule modifying Part 2 (“2024 Final Rule”).

Background
The revised Part 2 regulations aim to align federal privacy standards for SUD records more closely with standards under Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act (collectively, “HIPAA”). In February 2024, HHS published the 2024 Final Rule that:

1. Permitted a single consent to authorize all future uses and disclosures (including re-disclosures) of Part 2 records for treatment, payment and healthcare operations purposes as permitted under HIPAA;
2. Aligned Part 2 notice requirements with those of the HIPAA notice of privacy practices;
3. Authorized the disclosure of Part 2 records without consent to public health authorities if de-identified according to the HIPAA standards;
4. Restricted the use of Part 2 records and testimony in civil, criminal, administrative and legislative proceedings against patients without consent or a court order; and
5. Protected investigative agencies from civil or criminal liability if they unknowingly and inadvertently receive Part 2 records without a court order.

Ropes & Gray’s full analysis of the 2024 Final Rule and its implications can be found here.

To date, HHS has taken limited action to enforce Part 2, though the Trump Administration has renewed its focus on addiction and recovery-related policy initiatives, including its issuance of Executive Order 14379, “Addressing Addiction Through the Great American Recovery Initiative” on January 29, 2026,² which seeks to improve the federal government’s coordinated response to the addiction crisis through a number of agency actions. As the enforcement program is launched amid this period of increased attention to addiction policy, entities subject to Part 2 should review their compliance policies and prepare for requests related to enforcement activities initiated by HHS OCR.

Enforcement Program
As of February 16, 2026, OCR began accepting (i) complaints alleging violations of the regulation that protects the confidentiality of SUD patient records, and (ii) notifications of breaches of SUD patient records.

Part 2’s enforcement provisions, including penalties for noncompliance, align with those in HIPAA. OCR investigations conducted under the new program may include a review of the pertinent policies, procedures, or practices of the entity and the circumstances regarding any alleged violation. These investigations may be resolved through a range of informal and formal civil enforcement mechanisms, including resolution agreements, monetary settlements, commitments for corrective action, or the imposition of civil money penalties. Although the enforcement provisions are aligned with HIPAA, it remains unclear whether investigations involving both SUD information subject to Part 2 and PHI subject to HIPAA will be consolidated or proceed separately.

As enforcement activities begin, entities that maintain SUD patient records and are subject to Part 2 should ensure that they have made all necessary compliance program updates as of February 16, 2026. Such entities should specifically review and revise their policies and procedures for handling SUD patient records, review and update notices of privacy practices to reflect the updated Part 2 requirements, establish protocols for responding to complaints and potential breach notifications, and train personnel on the updated requirements and potential penalties for noncompliance.

Our team will continue to monitor developments in this area. If you have any questions regarding this Alert, please contact  Christine Moundas, Jennifer Romig, Sarah Blumenthal or your usual Ropes & Gray advisor.