Quick Takeaway
A significant federal medical-privacy change became mandatory on February 16, 2026, affecting records related to substance use disorder (SUD) treatment.
Technically, this is not simply a new “HIPAA rule.” It is the implementation of an updated federal confidentiality framework under 42 CFR Part 2, which protects certain SUD patient records and has now been aligned more closely with HIPAA and HITECH.
The changes do two things that may initially seem contradictory:
They can make it easier to share SUD records for legitimate healthcare purposes.
At the same time:
They strengthen important privacy, breach-notification and enforcement protections.
For patients, one of the biggest changes is that you may now provide one consent covering future uses and disclosures for treatment, payment and healthcare operations, rather than repeatedly signing separate permissions in many situations.
But that does not mean your addiction-treatment history suddenly becomes available to anyone who wants it.
Some of the strongest protections—particularly restrictions on using SUD records against patients in legal proceedings—remain.
First: HIPAA and Part 2 Aren’t the Same Thing
Most Americans have heard of:
HIPAA.
Far fewer know about:
42 CFR Part 2.
HIPAA establishes broad federal privacy protections for protected health information held by covered healthcare organizations and their business associates.
Part 2 provides additional confidentiality protections for certain records involving:
Substance use disorder treatment.
HHS explains that Part 2 applies to federally assisted programs that provide SUD diagnosis, treatment or referral for treatment.
That distinction matters.
Not every reference to alcohol or drug use somewhere in an ordinary medical chart automatically becomes a:
“Part 2 record.”
Part 2’s applicability depends on where the information originated and whether the relevant program and records fall within the federal rule.
Why Were SUD Records Given Special Protection?
Imagine someone considering treatment for an opioid or alcohol problem.
They’re afraid the record might eventually be used to:
Damage their career
Create legal problems
Expose them socially
or:
Lead to discrimination.
That fear could stop them from seeking treatment.
Part 2 exists partly because Congress recognized that unusually strong confidentiality protections can encourage people to seek substance-use treatment without fearing that their treatment records will later be used against them.
HHS specifically identifies fear of discrimination and prosecution as reasons confidentiality protections are important.
What Changed in 2026?
The underlying final rule was issued in:
2024.
But organizations subject to it were required to comply with its applicable provisions by:
February 16, 2026.
That’s why consumers are seeing the practical effects now.
The major changes involve:
Patient consent
Record redisclosure
Privacy notices
Breach notification
Patient rights
SUD counseling notes
Legal proceedings
and:
Federal enforcement.
Let’s break them down.
Change #1: One Consent Can Cover Future Healthcare Uses
This is one of the biggest practical changes.
Under the updated rules, a patient can provide a single consent covering future uses and disclosures of Part 2 records for:
Treatment
Payment
and:
Healthcare Operations.
This is sometimes called:
TPO consent.
HHS says the new framework allows a single consent for all future TPO uses and disclosures.
Why Does That Matter?
Imagine you’re receiving treatment through an SUD program while also seeing:
A primary-care physician
A psychiatrist
and:
Another specialist.
Healthcare providers may need relevant information to coordinate your care safely.
Historically, Part 2’s strict consent framework could create administrative barriers to sharing information.
The 2026 framework makes legitimate healthcare coordination easier.
Instead of requiring repeated permissions in many circumstances, one properly executed TPO consent can support ongoing sharing.
Change #2: HIPAA Organizations Can Redisclose Certain Records
Here’s another major change.
When a HIPAA-covered entity or business associate receives Part 2 records pursuant to the applicable TPO consent, it may generally redisclose those records as permitted by HIPAA.
That means information can potentially move more normally through legitimate healthcare operations.
For example:
SUD treatment provider
→
Primary-care provider
→
Other authorized healthcare operations.
But there’s an extremely important limitation.
Your Records Still Can’t Simply Be Used Against You
The updated framework preserves strong protections regarding:
Civil proceedings
Criminal proceedings
Administrative proceedings
and:
Legislative proceedings.
HHS states that Part 2 records generally cannot be used or disclosed in legal proceedings against a patient without:
the patient’s consent
or:
an appropriate court order and subpoena or similar legal mandate.
So easier healthcare sharing doesn’t equal:
easier use of your treatment history against you.
Example: Treatment vs. Investigation
Imagine you consent to your addiction-treatment information being shared with your primary-care physician.
Your physician uses that information to:
avoid prescribing a medication that could create a dangerous interaction.
That’s healthcare coordination.
Now imagine someone later wants the same records to:
build a legal case against you.
Your original healthcare consent does not automatically authorize that use.
HHS’s model privacy notice explicitly explains that Part 2 SUD information cannot be shared for investigations or legal proceedings against the patient without written consent or the required court order and legal process.
Change #3: Stronger Protection for SUD Counseling Notes
The new rule created a specific category called:
SUD counseling notes.
These are notes in which an SUD clinician documents or analyzes conversations from counseling sessions and maintains those notes separately from the rest of the patient’s treatment and medical record.
They’re treated somewhat similarly to:
psychotherapy notes.
HHS says SUD counseling notes require specific consent and cannot simply be disclosed based on broad TPO consent.
That’s an important additional layer of privacy.
Your General Consent Doesn’t Necessarily Unlock Everything
Suppose you sign a consent permitting:
Treatment, Payment and Healthcare Operations.
That can facilitate sharing of relevant Part 2 information.
But separately maintained:
SUD counseling notes
receive additional protection.
HHS specifically requires separate consent for their use or disclosure in applicable circumstances.
So don’t assume signing one healthcare consent gives every organization unrestricted access to every detail discussed during counseling.
Change #4: Breach Notifications Now Look More Like HIPAA
Suppose an SUD treatment program experiences a data breach.
Previously, the regulatory structure for Part 2 records wasn’t fully aligned with HIPAA’s breach-notification framework.
That’s changed.
The updated Part 2 rule applies HIPAA-style breach-notification requirements to breaches involving Part 2 records.
HHS says Part 2 programs must report breaches of unsecured Part 2 records and notify affected individuals, HHS and, in some circumstances, the media.
This gives patients a clearer framework when protected information is compromised.
Change #5: You Can File a Federal Complaint
Beginning:
February 16, 2026
patients gained a direct federal enforcement route for alleged Part 2 violations.
HHS’s Office for Civil Rights—OCR—now administers and enforces Part 2 and accepts complaints alleging violations.
That’s significant because OCR is already the federal agency familiar to many consumers through HIPAA enforcement.
If you believe your SUD records were improperly disclosed, you can potentially file a complaint with OCR.
HHS Office for Civil Rights complaint information
Change #6: Penalties Now Align More Closely With HIPAA
The rule also strengthened the enforcement framework.
Part 2 violations are now subject to civil and criminal enforcement authorities aligned with those used for HIPAA violations.
OCR may investigate complaints and compliance issues.
HHS says available civil enforcement mechanisms can include:
Resolution agreements
Monetary settlements
Corrective-action commitments
and:
Civil monetary penalties.
For patients, that means privacy protections aren’t simply promises on paper.
There is now a clearer federal civil-enforcement structure behind them.
Change #7: Privacy Notices Changed
You may have recently received a new:
Notice of Privacy Practices.
Don’t automatically throw it away.
Beginning February 16, 2026, HIPAA-covered healthcare providers and health plans subject to the applicable requirements must include information concerning Part 2 SUD records in their privacy notices.
Part 2 programs also have updated patient-notice requirements.
The notice should explain things such as:
How your information may be used
How it may be disclosed
Your privacy rights
and:
The organization’s responsibilities.
Change #8: You Don’t Have to Accept Fundraising Communications
The rule also establishes protections concerning fundraising.
Patients have a right to opt out of receiving fundraising communications involving Part 2 information.
HHS also says patients must receive clear advance notice and a choice concerning fundraising communications that use their Part 2 information.
That’s a relatively small part of the rule—but an important privacy detail.
What Didn’t Change?
This may be the most reassuring part.
HHS explicitly says a fundamental Part 2 protection remains:
SUD treatment records cannot be used to investigate or prosecute the patient without written consent or the required court order.
That protection wasn’t removed simply because Part 2 became more aligned with HIPAA.
Does Your Employer Get to See Your SUD Records?
Generally, don’t confuse:
your employer
with:
your health insurance plan.
They’re not automatically entitled to identical information.
HIPAA-covered health plans may receive protected information for permitted purposes.
That doesn’t mean your supervisor or manager automatically gets access to your medical record.
The exact rules depend on the organization, health-plan structure and purpose for which information is being used.
The 2026 Part 2 update isn’t a blanket authorization allowing:
your boss to read your addiction-treatment records.
Does Your Health Insurer Get Access?
Potentially, for permitted purposes such as:
Payment
and certain:
Healthcare operations,
depending on the applicable consent and circumstances.
For example, insurance claims need enough information to determine:
Whether a service is covered
What the plan should pay
and:
What the patient owes.
That’s different from giving an insurer unlimited authority to use your SUD records for unrelated purposes.
Can Your Primary-Care Doctor See the Records?
Potentially, yes.
One purpose of the new framework is to reduce unnecessary barriers to legitimate care coordination.
With the appropriate TPO consent, Part 2 information can be shared and redisclosed under applicable HIPAA rules by covered entities and business associates.
That could be clinically valuable.
Your primary-care doctor knowing about your SUD treatment might affect decisions involving:
Pain medication
Sedatives
Drug interactions
or:
Other treatment considerations.
Does This Put All SUD Records Into One Giant Database?
No.
Nothing in the new rule creates a universal federal database containing everyone’s addiction-treatment history.
The rules govern:
how covered records may be used and disclosed.
They’re not creating a public or universal SUD-record registry.
Do Part 2 Records Have to Be Separated From Other Medical Records?
Interestingly:
No.
The final rule expressly states that organizations aren’t required to segregate or segment Part 2 records from other records.
That’s another way the updated framework can make health-information systems easier to manage.
But eliminating a segregation requirement doesn’t eliminate:
privacy obligations.
Organizations still have to follow the applicable rules governing the information.
What About Public Health?
The updated rule permits Part 2 records to be disclosed without patient consent to public-health authorities when:
the records have been de-identified according to HIPAA standards.
That’s an important distinction.
It can allow information to contribute to public-health analysis without necessarily identifying individual patients.
What Happens if Your Records Are Leaked?
If you believe your protected SUD information has been improperly disclosed:
1. Document what happened.
Record:
Who disclosed the information
Who received it
When you discovered it
and:
What information was involved.
2. Contact the provider’s privacy office.
Ask for a written explanation.
3. Keep correspondence.
Save:
Emails
Letters
Notices
and:
Screenshots.
4. Consider an OCR complaint.
OCR can investigate alleged violations of both HIPAA and Part 2.
A Simple Before-and-After Example
Imagine Sarah receives treatment through a federally assisted SUD treatment program.
Under the updated framework
Sarah signs an appropriate consent covering:
Treatment
Payment
and:
Healthcare operations.
Her Part 2 treatment information can then be shared for those purposes according to the applicable rules.
A HIPAA-covered physician who receives those records pursuant to the consent can generally redisclose them as HIPAA permits.
But:
Sarah’s SUD records cannot simply be taken and used in a criminal or civil proceeding against her.
That requires the appropriate specific consent or qualifying court process.
That’s the basic balance the new framework tries to achieve:
Better healthcare coordination + continued legal protection.
2026 Patient Privacy Checklist
If you’ve received or are considering SUD treatment:
- Ask whether the provider is subject to 42 CFR Part 2.
- Read the updated Notice of Privacy Practices.
- Understand what you’re consenting to before signing.
- Ask whether consent covers future treatment, payment and healthcare operations.
- Ask which providers or organizations may receive your records.
- Remember that SUD counseling notes can receive additional protection.
- Keep copies of important consent forms.
- Review your medical records periodically.
- Ask how the organization handles Part 2 data breaches.
- Don’t assume your employer can access your medical record.
- Understand that healthcare sharing and legal use are different.
- Report suspected improper disclosures.
- Consider filing an OCR complaint if you believe federal privacy protections were violated.
Frequently Asked Questions
Did HIPAA change in 2026 for substance use records?
The more precise description is that updated 42 CFR Part 2 requirements became mandatory on February 16, 2026. The rule aligns important aspects of SUD-record confidentiality with HIPAA and HITECH.
What is 42 CFR Part 2?
It’s a federal confidentiality framework protecting records associated with SUD services provided by federally assisted Part 2 programs.
Can I give one consent for future treatment-related sharing?
Yes. The updated rule permits a single consent covering future uses and disclosures for treatment, payment and healthcare operations.
Can my records then be shared again?
HIPAA covered entities and business associates receiving Part 2 records under the applicable TPO consent may generally redisclose them as HIPAA permits, subject to important Part 2 restrictions.
Can my SUD records be used to prosecute me?
Part 2 continues to restrict using or disclosing SUD records in legal proceedings against patients without appropriate patient consent or qualifying court process.
Are counseling notes protected?
Yes. The rule creates special protection for separately maintained SUD counseling notes and requires specific consent for applicable uses and disclosures.
What happens after a data breach?
Part 2 records are now subject to HIPAA-style breach-notification requirements. Covered Part 2 programs may have obligations to notify affected individuals and HHS.
Can I report a privacy violation?
Yes. As of February 16, 2026, OCR accepts complaints alleging Part 2 violations.
Final Thoughts
The 2026 changes aren’t about making substance-use treatment records:
less private.
They’re primarily about modernizing how those records can move through legitimate healthcare while preserving important protections against misuse.
Patients can now provide a single consent for future:
Treatment
Payment
and:
Healthcare operations.
HIPAA-covered organizations receiving records under that consent have greater ability to use and redisclose information according to HIPAA.
At the same time:
SUD counseling notes receive special protection.
Breach-notification requirements are stronger.
OCR can investigate Part 2 complaints.
HIPAA-style civil enforcement applies.
And one of Part 2’s most important protections remains:
Your SUD treatment records generally cannot be used against you in legal proceedings without your consent or the required court process.
For patients, the best approach in 2026 is therefore not to avoid sharing medical information entirely.
It’s to understand: