Why Part 2’s compliance date reached hospitals that never ran a treatment program

The week

On February 16, 2026, new federal obligations took hold for some of the most sensitive information in health care: the record that a person has been treated for addiction. For decades, those records have had their own federal privacy rules, stricter than the ones that govern most medical information. The reason is simple: people are less likely to seek treatment if they fear the record could cost them a job, custody of a child or their liberty.

Those rules live in a federal regulation known as 42 CFR Part 2, usually just called Part 2. It covers substance use disorder treatment records from federally assisted programs, which in practice means most addiction treatment programs in the country.

The date was the compliance deadline for a February 2024 final rule from the Department of Health and Human Services that revised Part 2. The rule implemented changes Congress made in the CARES Act, the 2020 pandemic relief law. Its purpose was to bring Part 2 closer to HIPAA, the federal law that sets privacy and security rules for most health information, while keeping the extra protections that matter most.

The changes were significant. The rule allowed a patient to give a single consent covering treatment, payment and health care operations, the routine business of running a health organization, rather than signing a separate consent for each use. It let covered entities, meaning health care providers, health plans and clearinghouses, and their business associates, the vendors that handle health data on their behalf, redisclose records received under that consent as HIPAA permits.

It also applied HIPAA-style breach notification to Part 2 records and moved civil enforcement to HIPAA’s penalty framework. And it kept limits on using the records in proceedings against the patient, such as criminal cases.

Under a separate 2024 HIPAA rule, covered entities that maintain Part 2 records also had to update their notices of privacy practices, the documents that tell patients how their information is used, by the same date.

On February 13, HHS’s Office for Civil Rights, the office that enforces HIPAA, announced its Part 2 enforcement program. On February 16, it began accepting Part 2 complaints and breach reports.

The 2024 rule was in part a data-labeling problem: easier consent only works if systems know which data is which. That remains true, but the compliance date added something different.

Part 2 used to be enforced mainly through criminal provisions that were rarely used, and it lived in the specialty programs that generated the records. From February 16, it sat inside the same civil enforcement machinery as HIPAA, run by an office that takes complaints from patients and breach reports from organizations every day. A rule that had been strict on paper but seldom enforced now had a well-staffed, well-known enforcer.

That change mattered most to organizations that do not think of themselves as Part 2 programs. Consider a general hospital that receives a discharge summary from an outside treatment program, or a health plan that pays its claims. Add the health information exchange and the business associates behind them. All now hold Part 2 records with HIPAA-style obligations attached.

For those recipients, the rule asks three things over the life of a record: what they tell patients, how they use and pass on what they receive, and what happens when something goes wrong. First, how these records move and why the old approach is changing.

A locked room inside the HIPAA building

HIPAA is the law most executives have heard of. It sets national rules for how health care providers, health plans and their vendors may use and share health information, requires them to protect it, and requires them to report breaches. Under HIPAA, information can generally flow for treatment, payment and operations without a patient’s specific permission each time. HIPAA is enforced by the Office for Civil Rights, known as OCR, which investigates complaints and breach reports and can impose civil penalties.

Part 2 is narrower and historically stricter. It applies to records that identify someone as a patient of a federally assisted substance use disorder program. For years it required specific written consent for almost every disclosure, and records received under Part 2 carried restrictions that followed them to the next holder. Many hospitals and health plans kept these records apart from the rest of the medical record, or avoided receiving them at all, because the rules were hard to apply inside systems built for HIPAA.

If HIPAA is a building where staff with the right badge move between floors, Part 2 was a locked room inside it with its own keys. The 2024 rule keeps the room but lets patients hand over one key for routine care and business, while the door to the courthouse stays locked.

Why was Part 2 so strict in the first place? The concern was that people with addiction would avoid treatment if their records could be used against them, by an employer, an insurer, a landlord or a prosecutor. That concern has not gone away, and the rule’s limits on use in proceedings against the patient are its most important surviving protection. What changed is a recognition that the old consent rules also had a cost: clinicians treating a patient for something else, such as heart disease or pain, often could not see that the patient was in recovery, which could affect the medications they prescribed. Congress, through the CARES Act, chose to make routine sharing easier while keeping the legal shield.

A business associate is a company that handles health information for a covered entity: a billing company, a cloud hosting provider, an analytics firm, a records release vendor. Business associates sign agreements that set out what they may do with the data and what they must do if something goes wrong.

A health information exchange is a network that lets different hospitals, clinics and plans share patient records electronically, so that an emergency department can see a patient’s medications from another health system.

How Part 2 records reach organizations that never treated anyone

The obligations follow the records, whatever the type of organization. A hospital without an addiction treatment unit can still hold Part 2 records, and the route is mundane.

Suppose a man in recovery is treated at an outpatient addiction program. He is later admitted to a regional hospital for a heart problem. With his consent, the treatment program sends a summary to the hospital’s cardiology team so they know about his medications and history. That summary is now in the hospital’s electronic health record.

His health plan, meanwhile, has been paying the treatment program’s claims, so it holds diagnosis and service information that identifies him as a patient. The plan shares claims data with a care management vendor and an analytics firm. The hospital uses an outside company to answer records requests and a cloud provider to host its data.

Each of those organizations now holds Part 2 information, and not one of them runs a treatment program. Before February 16, many of them may not have thought about Part 2 at all. After it, each of them was subject to HIPAA-style obligations for those records, with a federal office ready to receive complaints about how they were handled.

What recipients tell patients

HIPAA’s notice provisions, revised in a separate 2024 rule, required covered entities that create or maintain Part 2 records to update their notices of privacy practices by the compliance date. This is the most visible obligation and the easiest to verify. A patient, an advocate or OCR can compare the notice on a hospital’s website with the rule’s requirements in minutes.

The work is mostly legal and administrative. The notice must describe how Part 2 records may be used and disclosed, including the limits on use in proceedings against the patient. Release of information staff, patient access teams and call centers need to explain the notice when asked.

Organizations that rely on a parent system’s notice, or on one notice across affiliated entities, should confirm that it covers every entity that actually receives Part 2 records. Counsel should review the language, because it is the document a complaint investigator reads first. A dated record of when each entity’s notice changed, and where it was posted and distributed, is cheap to keep and useful to produce.

How recipients use and pass on records

The rule’s main simplification applies here. A covered entity or business associate that receives records under a single consent for treatment, payment and operations may use and redisclose them as HIPAA permits. HHS said such recipients do not have to segregate the records. That removes much of the friction that kept these records out of integrated care, and it is good news for patients whose doctors need the full picture.

Two limits travel with the records anyway. First, the restriction on use in civil, criminal, administrative or legislative proceedings against the patient still applies, absent specific consent or a qualifying court order. Second, the consent itself can be revoked, and disclosures for purposes outside treatment, payment and operations still need their own basis.

In practice, that puts the burden on processes that handle legal demands and unusual disclosures, not on everyday clinical sharing. The subpoena desk, the risk management office and anyone who responds to law enforcement requests need a reliable way to ask whether responsive records include Part 2 material.

Now suppose a subpoena arrives at the hospital in a civil lawsuit against the patient, asking for all his records. The records team pulls the chart, which now includes the treatment program’s summary. If nobody flags that the summary is Part 2 material, it could be produced without the specific consent or court order the rule requires. That single mistake is the kind of thing a patient complaint to OCR would describe.

Business associate agreements should say how the associate will handle a legal demand for such records and how quickly it will tell the covered entity.

Health plans deserve particular attention. They receive Part 2 information through claims and care management, often without a direct relationship with the treating program. Their redisclosures to vendors, analytics partners and other plans now sit within HIPAA’s rules, which are familiar to them. Their handling of legal demands may not have been written with Part 2 in mind.

Return to the patient’s health plan. Its claims system holds codes showing he was treated at an addiction program. Its care management vendor uses that information to offer him support. Its analytics firm includes it in reports on high-cost members. All of that can now proceed under HIPAA’s familiar rules, provided the records were received under the patient’s consent. But suppose the plan receives a request from a lawyer in a dispute involving the patient, or a demand from an agency investigating him. The plan’s legal team, used to HIPAA’s rules for routine requests, may not realize that the claims data in question carries Part 2’s extra protection against use in proceedings against him. The fix is straightforward: a flag in the claims system, a question on the legal team’s intake checklist and a clause in each vendor agreement. What matters is that someone decides to put them in place.

The same logic applies to consent revocation. If a patient withdraws consent, the organizations that received records under it need a way to know, and a way to stop disclosures that depend on it. For most organizations that means a clear process between the treatment program, the hospital or plan, and the vendors that act for them.

What happens when something goes wrong

The compliance date brought Part 2 records under HIPAA-style breach notification. An incident that exposes them is now assessed and reported through the same process as any breach of protected health information, with notices to individuals, to HHS and, for large breaches, to the media.

Incident response plans need one added step: determining whether compromised data included Part 2 records, because the answer affects how the breach is described and what patients may fear from it. A notice that says “your health information may have been exposed” lands differently from one that tells a patient their addiction treatment history may have been. Organizations should prepare that language with care before they need it, not draft it under deadline pressure.

Enforcement also changed character. Civil penalties now follow HIPAA’s tiers, and OCR investigates on the basis of complaints and breach reports. For a hospital, that means a patient who believes a substance use record was mishandled has a well-known place to complain. It also means a breach report involving Part 2 data is likely to prompt questions about the notice, the redisclosure controls and the legal-demand process described above. The three parts connect. A weakness in any of them is what an investigation would find.

From a dormant rule to an active complaint channel

Patients and trust. People in recovery often have good reason to guard their history. A mishandled record can affect employment, family matters and legal proceedings. An organization that protects these records well earns trust; one that does not may find patients withholding information their clinicians need.

Regulatory exposure. Part 2 moved from a regime that was rarely enforced to one with an active complaint channel and civil penalties. That is a material change in risk for organizations that hold the records, even incidentally.

Operations. The good news is that the rule makes integrated care easier. Clinicians can see more of a patient’s history, and organizations no longer have to wall off every Part 2 record. The work is concentrated in a few places, not spread across the whole enterprise.

Reputation. A breach involving addiction treatment records attracts attention. How an organization describes it, and whether it can show it was prepared, will shape how patients, regulators and the press respond.

Three places to add Part 2, and who needs training

The work does not call for a new program. It calls for adding Part 2 to existing HIPAA processes in three named places: the notice, the legal-demand workflow and the breach assessment. Compliance officers should be able to show each change on paper.

It also needs a simple map of where Part 2 records enter the organization: referrals and discharge summaries from treatment programs, claims, health information exchange feeds, and data received by business associates. Once the entry points are known, the legal-demand and breach teams can ask the right question quickly.

Training should be targeted rather than broad. Most clinicians need only to know that they can now see and use these records for care. The people who need deeper training are a small group: release of information staff, the subpoena desk, risk managers, privacy officers, breach response leads and the vendor managers who oversee business associates. A short session for each of those teams, with a case drawn from their own daily work, will do more than a general module sent to every employee.

Finally, someone has to own the topic. A named privacy or compliance leader should be responsible for Part 2 across the organization, including affiliates and vendors, and should report on it with the rest of the HIPAA program.

The failures are predictable. Some organizations assume Part 2 does not apply because they do not run a treatment program. Some update the notice on the main website but not for affiliated entities that also receive records. Some leave business associate agreements unchanged. And some treat every subpoena the same way, without a step that checks for Part 2 material.

Where an OCR investigator would look first

• Where do substance use disorder treatment records enter our organization, and do we know when they are in our systems?
• Does every entity in our system that receives these records have an updated notice of privacy practices, and when did each one change?
• When we receive a subpoena or law enforcement request, how do we check whether the response would include Part 2 records?
• Does our breach assessment ask whether Part 2 records were involved, and do we have notice language ready if they were?
• If OCR asked us to show what we changed for the February 16 compliance date, what documents could we hand over today?

Health plans and care management operations should add one more check: whether their legal-demand procedures, and their business associate agreements, were written with Part 2 in mind.

With hindsight

The compliance date held, and OCR’s enforcement program went live on schedule, with complaint and breach intake for Part 2 records from February 16. HHS also published compliance materials shortly before the deadline, giving organizations a late but useful reference for what was expected.

Eight months on, the most visible change for recipients was administrative: updated notices, revised business associate agreements and breach assessments that now ask about substance use records. This is unglamorous work, but each item is a concrete document an organization can point to if a patient complains or a breach occurs.

The less visible change was cultural. Part 2 had long been treated as the treatment program’s concern, with the rest of a health system assuming it held no such records. The rule’s design, which lets protected records flow under HIPAA’s rules, made that assumption harder to sustain. As records move more freely to support integrated care, more organizations will hold them, often without a deliberate decision to do so.

That is the paradox at the heart of the change. Making it easier to share addiction treatment records with the clinicians and plans who need them also spreads the responsibility for protecting them. A general hospital, a health plan or a cloud vendor can become a Part 2 record holder simply by doing its normal job.

Organizations that mapped where Part 2 records arrive, and gave their legal-demand and breach teams a way to identify them, were in a position to answer an OCR inquiry. We would not predict the pace of enforcement. We would expect inquiries to start where complaints and breaches start.

The practical course is to treat Part 2 as part of everyday privacy governance rather than a specialty concern: know where the records come in, make sure the few processes that touch legal demands and breaches can recognize them, and keep a dated record of every change.