LEGAL ALERT: OCR Announces New Enforcement Program to Protect the Confidentiality of SUD Patient Records
In February, the U.S. Department of Health and Human Services (“HHS”), Office for Civil Rights (“OCR”) announced a new program to implement and enforce statutory and regulatory requirements protecting the confidentiality of substance use disorder (“SUD”) patient records, effective February 16, 2026. Such a development marks the first time civil enforcement authority will be exercised over 42 CFR Part 2 (“Part 2”) regulated entities to protect the confidentiality of these records.
Background
Part 2 is a federal law that protects the confidentiality of patient records for those receiving services related to SUDs and describes how and when such records may be used and disclosed. These rules apply to any federally assisted program that provides SUD diagnosis, treatment, or referral for treatment and even entities who merely receive Part 2 records. On February 8, 2024, these regulations were amended to more closely align with other health privacy laws including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) regarding not only confidentiality, but also penalties for violations and breach notification requirements.
Enforcement activity following the amendment has been limited and HHS’s new program aims to change that. The goal of the enforcement program is to instill confidence in patients and encourage them to seek SUD treatment from covered providers. Additionally, the hope is that compliance with the amended Part 2 regulations will improve care coordination and reduce administrative burdens.
Key Details
Beginning February 16, 2026, OCR began accepting complaints regarding (1) violations of the regulation protecting the confidentiality of SUD patient records and (2) notifications of breaches of SUD patient records. The enforcement framework will be aligned with HIPAA, including a civil enforcement mechanism empowering OCR to investigate, resolve, and assess civil monetary penalties for non-compliance. Investigations under the program can be resolved through various civil enforcement mechanisms including resolution agreements, monetary settlements, commitments to corrective action, and civil monetary penalties for the failure to comply.
Implications
Although enforcement activity following the amendment of Part 2 was initially limited, recent regulatory and enforcement developments make clear that Part 2 compliance is an active federal priority. The Trump Administration has underscored its emphasis on addiction treatment and recovery, including through Executive Order 14379, Addressing Addiction Through the Great American Recovery Initiative, issued on January 29, 2026. In response, HHS announced a comprehensive strategy to strength prevention efforts, expand access to treatment, and implement Executive Order 14379’s directives. Taken together with HHS’s new enforcement program, these initiatives evidence the continued importance of maintaining compliance with Part 2 and regularly reviewing and updating policies and procedures. If you or your business may be affected by these changes, please contact Kessler Collins to assist you in navigating these challenges and protecting your interests.
