Confidentiality of Substance Use Disorders (SUD) Patient Records (Part 2) and HIPAA Notice of Privacy Practices

In February 2024, the U.S. Department of Health and Human Services (Department) modified the Confidentiality of Substance Use Disorder Patient Records regulations (Part 2) to implement Section 3221 of the CARES Act, which required the Department to align Part 2 regulations more closely with the HIPAA regulations.

Part 2 protects the confidentiality of substance use disorder (SUD) patient records by providing parameters of when and how SUD records may be used and disclosed. Part 2 rules apply to any federally assisted program that provides SUD diagnosis, treatment, or referral for treatment. Some Part 2 requirements also apply to people and organizations who receive Part 2 records, such as other health care providers, Qualified Service Organizations (QSOs), HIPAA covered entities and business associates, intermediaries, and investigative agencies.

In April 2024, HHS published the HIPAA Privacy Rule To Support Reproductive Health Care Privacy. This rule amends provisions of the Privacy Rule under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) to strengthen privacy protections for PHI on reproductive health care and to provide peace of mind so that individuals may obtain lawful reproductive health care. However, on June 18, 2025, the U.S. District Court for the Northern District of Texas found that HHS exceeded its authority and vacated most of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy. Parts of the rule relating to Notice of Privacy Practices (NPP) requirements for SUD patient records remain in effect.

If you are a HIPAA-covered entity that receives or maintains SUD patient records from Part 2 programs, you will need to ensure your NPPs are updated. The NPP requirements for SUD patient records and the Confidentiality of Substance Use Disorders Patient Records (Part 2) Rule both had a February 16, 2026, compliance date.

We recommend you review the links provided in the FAQ along with the model template notices on the HHS website. Information on how to access the templates is included in the FAQ.

FAQ

1. Where can I find the Confidentiality of Substance Use Disorder (SUD) Patient Records (Part 2) Rule?

   This rule was published in the Federal Register and can be found here: Confidentiality of Substance Use Disorder (SUD) Patient Records.

    

2. Where can I find a quick summary of the key requirements of the Confidentiality of Substance Use Disorder (SUD) Patient Records (Part 2) Rule?

   The key requirements are outlined in the HHS Fact Sheet: Fact Sheet 42 CFR Part 2 Final Rule | HHS.gov.

    

3. Where can I find the HIPAA Privacy Rule to Support Reproductive Health Care Privacy?

   This rule was published in the Federal Register and can be found here: HIPAA Privacy Rule To Support Reproductive Health Care Privacy.

    

4. Is the HIPAA Privacy Rule to Support Reproductive Health Care Privacy still in effect?

   Only part of the rule remains in effect. On its website, the Department of Health and Human Services provides the following explanation:

   On June 18, 2025, the U.S. District Court for the Northern District of Texas issued an order declaring unlawful and vacating most of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy at 89 Federal Register 32976 (April 26, 2024).

   With regard to the modifications to the HIPAA Privacy Rule Notice of Privacy Practices (NPP) requirements at 45 CFR 164.520, the court vacated only the provisions that were deemed unlawful, namely 164.520(b)(1)(ii)(F), (G), and (H).

   The remaining modifications to the NPP requirements are undisturbed and remain in effect, see Carmen Purl, et al. v. U.S. Department of Health and Human Services, et al., No. 2:24-cv-00228-Z (N.D. Tex. June 18, 2025). Compliance with the remaining NPP modifications is required by February 16, 2026. HHS will determine next steps after a thorough review of the court’s decision.

   
   

5. What are HIPAA covered entities and federally assisted SUD treatment programs required to provide in their notices?

   HIPAA covered entities are required to include information about substance use disorder (SUD) patient records (described in 42 U.S.C. 290dd-2(a) and 42 CFR part 2 (“Part 2”)) in their notice of privacy practices (NPP). Additionally, federally assisted SUD treatment programs are required to provide a new patient notice that is aligned more closely with the HIPAA NPP. A link to the model notice templates can be found in Question #6.

    

6. Where can I find model notice templates for the HIPAA Health Care Provider NPP and Part 2 Patient Notice?

   The model notice templates that include the updated requirements can be found on the HHS website at: Model Notices of Privacy Practices | HHS.gov.

   
   

7. Is there a requirement to post the updated NPP and Part 2 Notice?

   Covered entities and Part 2 programs are required to make their notices available to any person who asks for it and must prominently post and make their notices available on any web site they maintain that provides information about their customer services or benefits.

    

8. What is the deadline to comply with the HIPAA NPP and Part 2 Notice requirements?

The compliance deadline is February 16, 2026.