OCR Begins Enforcing Part 2 — What Behavioral Health Providers Must Know Now

For years Part 2 — the federal regulation governing confidentiality of substance use disorder patient records — operated in a separate enforcement universe from HIPAA. Different rules. Different standards. Different agencies. And, critically, different consequences for violation.

That changed on February 16, 2026.

What happened on February 16, 2026

Beginning February 16, 2026, entities and persons subject to the regulation protecting the confidentiality of SUD patient records must comply with all applicable requirements. The penalties for noncompliance align with the penalties available under HIPAA Privacy, Security, and Breach Notification Rules.

OCR will begin accepting complaints alleging violations of the regulation that protect the confidentiality of SUD patient records, and notification of breaches of SUD patient records.

This is a significant enforcement expansion. Before this date, Part 2 violations were enforced through a different mechanism with limited penalty authority. As of February 16, 2026, OCR — the same agency that enforces HIPAA — is now the enforcement authority for Part 2, with the same penalty structure it applies to HIPAA violations.

Who is affected

Part 2 applies to any program that provides substance use disorder diagnosis, treatment, or referral for treatment and receives any form of federal assistance. The definition of federal assistance is deliberately broad.

Organizations subject to Part 2 include hospitals with SUD treatment programs, federally qualified health centers, opioid treatment programs, residential rehabilitation facilities, outpatient SUD treatment programs, and any provider that accepts Medicare or Medicaid patients for SUD treatment.

Critically, this is not limited to specialized addiction treatment centers. A general hospital with a detox unit, a primary care practice that provides medication-assisted treatment for opioid use disorder, and a mental health center that also treats substance use disorders are all potentially subject to Part 2.

How Part 2 differs from HIPAA

The core distinction between Part 2 and HIPAA is the consent standard for disclosure.

Under HIPAA, covered entities can use and disclose PHI for treatment, payment, and healthcare operations without patient authorization. A primary care doctor can share records with a specialist. A hospital can share records with an insurance company for billing. These disclosures do not require individual patient consent.

Under Part 2, disclosures of SUD records historically required specific written patient consent for nearly every disclosure — including many disclosures HIPAA would permit without consent. This stricter standard reflects Congress's judgment that the stigma associated with substance use disorder creates unique barriers to treatment that heightened confidentiality protections can help address.

The 2024 rule modifications aligned some Part 2 requirements more closely with HIPAA — allowing, for example, a single consent form to cover both HIPAA and Part 2 disclosures in certain treatment contexts. But the core principle of heightened protection for SUD records remains intact.

What OCR's enforcement program covers

OCR investigations conducted under the new program may be resolved through a range of civil enforcement mechanisms. These include OCR entering into resolution agreements, securing monetary settlements, obtaining commitments for corrective action, or imposing civil money penalties for the failure to comply.

This mirrors exactly how OCR enforces HIPAA. Resolution agreements, corrective action plans, and civil money penalties are all available remedies — the same tools OCR uses in ransomware breach investigations and right of access enforcement.

OCR Director Paula Stannard stated that OCR's civil enforcement program will instill confidence in patients and encourage them to seek SUD treatment from covered SUD providers, and that compliance with the updated Part 2 regulation will improve care coordination and reduce administrative burdens.

The updated Notice of Privacy Practices requirement

One immediate compliance action every affected organization must take: update its Notice of Privacy Practices.

HHS developed a model patient notice and updated its model HIPAA Notices of Privacy Practices for regulated entities to use in providing notice to patients on how federal law protects the confidentiality of SUD patient records.

Patients receiving SUD treatment must be informed of their specific Part 2 rights. The updated NPP templates are available on the HHS website and should be reviewed and adopted immediately.

What behavioral health providers must do now

Step 1 — Determine whether Part 2 applies to your organization. Assess whether you provide any SUD diagnosis, treatment, or referral services and whether you receive any form of federal assistance. If both conditions are met, Part 2 applies.

Step 2 — Review your consent forms. Your patient consent forms must specifically authorize Part 2 disclosures. A general HIPAA authorization is not sufficient for Part 2 SUD records. Review your forms with legal counsel to ensure they meet both HIPAA and Part 2 requirements.

Step 3 — Update your Notice of Privacy Practices. Use HHS's updated model NPP to ensure your privacy notice accurately reflects patients' Part 2 rights alongside their HIPAA rights.

Step 4 — Train your workforce. Staff who handle SUD patient records must understand the heightened confidentiality requirements Part 2 imposes — including restrictions on disclosures that HIPAA would otherwise permit. This training should be documented.

Step 5 — Establish a breach response process for SUD records. Part 2 breach notifications must now be reported to OCR using the same breach portal used for HIPAA breaches. Your incident response procedures must be updated to address Part 2 breaches specifically.

Step 6 — Audit your business associate agreements. If you share SUD patient records with business associates, your BAAs may need to be updated to address Part 2 obligations in addition to HIPAA requirements.