HHS-OCR Kicks Off Enforcement Program for Substance Use Disorder Treatment Records and Issues Updated Model Notices of Privacy Practices
In an eleventh-hour Press Release, the Department of Health and Human Services (HHS), Office of Civil Rights (OCR) announced a new program aimed at enforcement of the new statutory and regulatory requirements protecting the confidentiality of Substance Use Disorder (SUD) treatment records pursuant to 42 CFR Part 2 (Part 2). As discussed in a previous Client Alert, the federal government aligned Part 2 regulations with the Health Insurance Portability and Accountability Act (HIPAA), with a few additional protections for Part 2 records on February 16, 2024. Compliance with the revised Part 2 and HIPAA rules became effective February 16, 2026.
OCR Enforcement of Part 2 Violations
Prior to issuance of the 2024 Part 2 Final Rule, violations of Part 2 confidentiality protections were only subject to criminal penalties enforced by the US Department of Justice (DOJ). However, in aligning Part 2 and HIPAA, the new Rules extend the same penalties and penalty structure applicable to HIPAA violations, namely civil and administrative penalties. Given OCR’s experience with HIPAA enforcement, on August 25, 2025, the Secretary of HHS delegated civil and administrative enforcement of Part 2 to OCR, while the DOJ continues to have enforcement authority for criminal penalties.
As of February 16, 2026, any Covered Entity that creates, maintains or uses Part 2 records (either as a Part 2 Program or a Covered Entity that simply receives Part 2 records) must treat a breach of those records like any other breach involving Protected Health Information (PHI). Further, OCR has updated its HIPAA website, including the Breach Portal to accept complaints alleging violations of Part 2 and notification of breaches of SUD patient records.
Model Notice of Privacy Practices (“Notice”)
In addition to announcing the Part 2 enforcement program, OCR also issued updated Model Notice of Privacy Practices to assist Covered Entities (Providers and Health Plans) and Part 2 Programs in their compliance obligation to update their Notice by February 16, 2026. For Covered Entities and Part 2 Programs that have already revised their Notices, reference to the Model Notice is a good way to confirm all necessary elements are included. For those Covered Entities and Part 2 Programs that have yet to update their Notice, the OCR’s Model version should be used to quickly update their existing HIPAA Notice or create a separate Part 2 Notice comply with the February 16, 2026, deadline.
If you have any questions, you are encouraged to contact the authors of this Client Alert or a member of Butzel’s Health Care Industry Team with any time‑sensitive questions.
Debra Geroux
248.258.2603
geroux@butzel.com
Mark Jane
734.213.3617
jane@butzel.com
Mark Lezotte
313.225.7058
lezotte@butzel.com
Robert Schwartz
248.258.2611
schwartzrh@butzel.com
