Seyfarth Synopsis: The Department of Health and Human Services has delegated enforcement authority to the Office of Civil Rights for 42 CFR Part 2, which protects the confidentiality of substance use disorder records. Covered entities must update their HIPAA documents to reflect these changes by February 16, 2026.
On August 25, 2025, the U.S. Department of Health and Human Services (HHS) Office of the Secretary authorized the Director of the Office for Civil Rights (OCR) to enforce the “Confidentiality of Substance Use Disorder (SUD) Patient Records” regulations found at 42 CFR Part 2, including the right to impose civil penalties, issue subpoenas and take corrective actions for noncompliance. These rules, finalized in February 2024, aim to protect the privacy of patients’ SUD treatment records, and require updates to HIPAA Privacy Policies and Notices of Privacy Practices.
As a reminder, in February 2024, 42 CFR Part 2 was modified to strengthen the confidentiality protections around a patient’s substance use disorder treatment records that covered entities or their business associates may encounter. In doing so, the provisions and definitions in a covered entity’s HIPAA Privacy Policy and Notice of Privacy Practices were required to be reviewed and revised to ensure such protections were provided to employees.
As we previously reported, the rules related to reproductive health care were vacated in light of a decision by a federal court in Texas. As a result, HIPAA documents will not be required to be updated for the specific privacy and security concerns surrounding reproductive health care. Covered entities should be reviewing and updating their HIPAA documents for the 42 CFR Part 2 changes. If you have any questions on how to ensure compliance under the law to avoid the expected enforcement mechanisms, please reach out to your benefits counsel.
Action Item: Review and update HIPAA documents now to meet the February 16, 2026 deadline.
For more information, a fact sheet on the modified rule can be found here.