The Office for Civil Rights (OCR) will be ready to enforce the 2024 Part 2 Final Rule by the February 16, 2026, compliance deadline now that the U.S. Department of Health & Human Services (HHS) has delegated enforcement authority to OCR last week.
On February 8, 2024, HHS, through the Substance Abuse and Mental Health Services Administration (SAMHSA) and OCR, issued a Final Rule (Part 2 Final Rule) amending the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations, 42 C.F.R. Part 2 (Part 2), to better align Part 2 with the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act in areas where Part 2 previously differed – and in some instances conflicted – with HIPAA and HITECH on the requirements for protecting confidential patient medical records. At the time the 2024 Part 2 Final Rule was issued, the Rule adopted HIPAA's criminal and civil penalty structure found in 42 U.S.C. 1320d-5 and 1320d-6, allowing a consistent enforcement process for HIPAA and Part 2, but the Part 2 Final Rule had not yet identified an enforcing agency.
On August 26, 2025, HHS published in the Federal Register that Secretary Robert F. Kennedy Jr. empowered OCR to administer and enforce the Part 2 Final Rule.
What is the OCR?
OCR is the primary enforcement office of HHS responsible for enforcing federal civil rights laws, including HIPAA, which, among other things, safeguards the confidentiality and privacy of personally identifiable information collected, maintained, or disclosed by HIPAA-regulated entities. Due to the heightened sensitivity surrounding SUD records, Part 2 contains more restrictive regulations to afford greater protections for SUD records. While Part 2 remains a more protective regulation, the Part 2 Final Rule is now better aligned with HIPAA, making OCR a logical agency to enforce it.
What does this enforcement power include?
HHS announced that OCR's enforcement authority includes the following:
- Enter into resolution agreements, monetary settlements, and corrective action plans, or impose civil money penalties for failures to comply with these requirements;
- Issue subpoenas requiring the attendance and testimony of witnesses and the production of any evidence that relates to any matter under investigation or compliance review for failure to comply with these requirements; and
- Make decisions regarding the interpretation, implementation, and enforcement of these requirements.
What does this mean for Part 2-regulated entities?
Regulated entities subject to Part 2 must ensure compliance with the applicable requirements of the Part 2 Final Rule by February 16, 2026. Last week's announcement gives this deadline greater weight now that there is clear enforcement power from OCR behind the Part 2 Final Rule that was not there before.
In prior years, Part 2 violations were given relatively little attention compared to HIPAA. So far in 2025, the number of HIPAA violations reported to OCR has not slowed down, nor has OCR's response to those reports. Many HIPAA-regulated entities may also be Part 2-regulated entities.
Part 2 covers any information about patients receiving diagnosis, treatment, or referral for treatment for a substance use disorder created by a Part 2 program. The regulation defines a Part 2 program as:
1. A person (other than a general medical facility) that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or
2. An identified unit within a general medical facility that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or
3. Medical personnel or other staff in a general medical facility whose primary function is the provision of substance use disorder diagnosis, treatment, or referral for treatment and who are identified as such providers.
For example, this coverage could include treatment or rehabilitation programs, employee assistance programs, programs within general hospitals, school-based programs, and private practitioners who hold themselves out as providing, and provide, substance use disorder diagnosis, treatment, or referral for treatment.
Providers should focus on updating their existing policies and procedures regarding access to records and responding to third-party requests for information. In the past, providers have paid less attention to their Part 2 obligations with respect to SUD information contained within their records, even if they are not the provider of the SUD treatment.
Following the issuance of the Part 2 Final Rule, the penalty structure for violating Part 2 mirrors HIPAA's penalty structure. Now that OCR has enforcement authority and a clearer pathway to penalize Part 2 violations, Part 2 programs are likely to be under a microscope. We may see similar trends with Part 2 enforcement and reporting in 2026 as we have seen with HIPAA in recent years.
Part 2-regulated entities must be in compliance by February 16, 2026. Take a close look at your compliance program and consult legal counsel to ensure you are in compliance.
More information on the Part 2 Final Rule can be found here and here.