The revised federal rules for substance use disorder (“SUD”) records will be enforced effective February 16, 2026. (42 CFR part 2, hereafter “Part 2”). Failure to comply with the new Part 2 rules may subject healthcare providers and other recipients of covered SUD records to HIPAA penalties ranging from $145 to $2,190,294 per violation along with the affirmative obligation to self-report violations to affected individuals and the Office for Civil Rights. (42 CFR § 2.3; see also 45 CFR § 102.3). Providers rendering SUD treatment or receiving SUD records must determine whether and to what extent the new Part 2 rules apply to them.
I. Federally Assisted SUD Programs. Part 2 generally applies to SUD records1 created by or for federally assisted SUD programs (“Part 2 Program”). Part 2 Programs must comply with burdensome confidentiality and administrative obligations in Part 2. Thus, the initial query is whether you are a federally assisted SUD program.
A. “Federally Assisted.” Part 2 defines “federally assisted” quite broadly: a program is “federally assisted” if:
(1) It is conducted in whole or in part, whether directly or by contract or otherwise by any department or agency of the United States…;
(2) It is being carried out under a license, certification, registration, or other authorization granted by any department or agency of the United States including but not limited to:
(i) Participating provider in the Medicare program;
(ii) Authorization to conduct maintenance treatment or withdrawal management; or
(iii) Registration to dispense a substance under the Controlled Substances Act to the extent the controlled substance is used in the treatment of substance use disorders;
(3) It is supported by funds provided by any department or agency of the United States by being:
(i) A recipient of federal financial assistance in any form, including financial assistance which does not directly pay for the substance use disorder diagnosis, treatment, or referral for treatment; or
(ii) Conducted by a state or local government unit which, through general or special revenue sharing or other forms of assistance, receives federal funds which could be (but are not necessarily) spent for the substance use disorder program; or
(4) It is assisted by the Internal Revenue Service of the Department of the Treasury through the allowance of income tax deductions for contributions to the program or through the granting of tax exempt status to the program.
(42 CFR § 2.12(b)). While it is possible that a purely private pay program that does not otherwise satisfy this definition may avoid Part 2, most SUD providers are likely to be “federally assisted”; thus, the relevant question is more likely to be whether they constitute a “program.”
B. “Program.” For purposes of part 2, “Program” means:
(1) A person (other than a general medical facility) that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or
(2) An identified unit within a general medical facility that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment; or
(3) Medical personnel or other staff in a general medical facility whose primary function is the provision of substance use disorder diagnosis, treatment, or referral for treatment and who are identified as such providers.
(42 CFR § 2.11, definition of “program”). Thus, the program tests differ depending on whether the entity is a “general medical facility” or a “person (other than a general medical facility).”
1. “General Medical Facility.” SAMHSA commentary states,
while the term “general medical care facility” is not defined in the definitions section of 42 CFR 2.11, hospitals, trauma centers, or federally qualified health centers would generally be considered “general medical care” facilities. Therefore, primary care providers who work in such facilities would only meet part 2’s definition of a program if (1) they work in an identified unit within such general medical facility that holds itself out as providing, and provides, substance use disorder diagnosis, treatment or referral for treatment, or (2) the primary function of the provider is substance use disorder diagnosis, treatment or referral for treatment and they are identified as providers of such services. In addition, a practice comprised of primary care providers could be considered a “general medical facility.” As such, only an identified unit within that general medical care facility which holds itself out as providing and provides substance use disorder diagnosis, treatment or referral for treatment would be considered a “program” under the definition in the part 2 regulations. Medical personnel or staff within that facility whose primary function is the provision of those services and who are identified as such providers would also qualify as a “program” under the definition in the part 2 regulations. Other units or practitioners within that general medical care facility would not meet the definition of a part 2 program unless such units or practitioners also hold themselves out as providing and provide substance use disorder diagnosis, treatment or referral for treatment.
(82 FR 6052, 6066 (1/18/17); see also SAMHSA FAQs #10, available at https://www.samhsa.gov/about/faqs/confidentiality-regulations).
If the entity constitutes a “general medical facility,” then the test turns on whether the facility has an “identified unit” holding itself out as providing SUD care or whether a particular provider’s “primary function” is to provide SUD care.
a. Identified Unit. Part 2 does not define what is meant by an “identified unit.” In one publication, SAMHSA refers to a “specialized unit.” (SAMHSA, FAQs: Applying the Substance Abuse Confidentiality Regulations to Health Information Exchange FAQ #2, available at https://www.samhsa.gov/sites/default/files/faqs-applying-confidentiality-regulations-to-hie.pdf). Presumably, “identified unit” or “specialized unit” means more than simply advertising that the general medical facility provides SUD treatment; otherwise, the specific reference to “identified unit” would be meaningless. So long as a “general medical facility” does not have an identified or specialized unit—some department or specific group of providers who are identified as SUD providers and dedicated to SUD care—then the entity likely would not trigger part 2 coverage unless it has providers whose primary function is to render SUD care.
b. Primary Function. SAMHSA has expressly declined to define “primary function” (82 FR 6066), but SAMHSA has provided the following examples:
Blue Mountain Physician Group is a group of providers that treats the whole person in an integrated care setting. Although Blue Mountain does not advertise that it provides SUD treatment services, its physicians have received waivers from SAMHSA to prescribe buprenorphine for the treatment of opioid use disorders.
Dr. Pierce is a provider at Blue Mountain and treats a diverse group of patients. Occasionally, Dr. Pierce encounters patients with an opioid dependency and provides MAT with buprenorphine. However, he does this only for a handful of patients and such services do not constitute his primary function at Blue Mountain.
…
Is Dr. Pierce covered? Does Part 2 apply?
Dr. Pierce is federally assisted because he is registered with the DEA to prescribe controlled substances for the treatment of OUD and has received a physician waiver from SAMHSA to prescribe buprenorphine. However, Dr. Pierce practices at a general medical facility where his primary function is not providing diagnosis, treatment, or referral for treatment for a SUD. Therefore, Dr. Pierce does not meet the definition of a Part 2 Program.
(SAMHSA, Does Part 2 apply to Me?, available at https://www.healthit.gov/sites/default/files/topiclanding/2018-05/TabA.PDF).
In contrast, the following SAMHSA example demonstrates when the “primary function” test would be satisfied:
Acme Community Mental Health Center (Acme) provides both SUD treatment services and mental health services....
Dr. Tyler, an addiction specialist at Acme, only treats patients with SUDs. Typically, Dr. Tyler uses controlled substances for detoxification or maintenance treatment of a patient’s SUD. ....
Is Acme covered? Does Part 2 apply?
Yes. Dr. Tyler meets the definition of a Part 2 Program because Dr. Tyler works at a general medical facility where her primary function is for the provision of diagnosis, treatment, or referral for treatment of patients with SUDs. Additionally, Dr. Tyler is considered federally assisted because she is registered with the DEA to prescribe controlled substances for detoxification or maintenance treatment of a SUD. Therefore, Dr. Tyler is considered a Part 2 Program.
(Id.). Based on these examples, if a general medical facility’s providers treat SUD as only part of their broader scope of practice but SUD care is not their exclusive or primary practice, then the entity would likely not satisfy the “primary function” test. On the other hand, if SUD care is the provider’s primary practice or function, then Part 2 would likely apply so long as the program is also “federally assisted.”
2. “Person (Other Than a General Medical Facility).” Under Part 2, “[p]erson has the same meaning given that term in 45 CFR 160.103” (id.), i.e., “a natural person (meaning a human being who is born alive), trust or estate, partnership, corporation, professional association or corporation, or other entity, public or private.” (45 CFR § 160.103). Thus, if the entity or provider is not a general medical facility, then it is a Part 2 Program if it is federally assisted and “holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment.” (42 CFR § 2.11, definition of “program”).
3. “Holds Itself Out”. Whether Part 2 applies to a SUD program most often depends on whether the entity or provider holds itself/herself/himself out as providing SUD care. SAMHSA FAQS state:
The phrase “holds itself out” is not defined in the regulations, but could mean a number of things, including but not limited to state licensing procedures, advertising or the posting of notices in the offices, certifications in addiction medicine, listings in registries, internet statements, consultation activities for non-“program” practitioners, information presented to patients or their families, or any activity that would lead one to reasonably conclude that the provider is providing or provides alcohol or drug abuse diagnosis, treatment or referral for treatment.
(SAMHSA FAQs #10, available at https://www.samhsa.gov/about/faqs/confidentiality-regulations). Elsewhere, SAMHSA stated,
“Holds itself out” is currently not defined in [Part 2]. SAMHSA has previously published guidance relative to the term…. Consistent with that guidance, “Holds itself out” means any activity that would lead one to reasonably conclude that the individual or entity provides substance use disorder diagnosis, treatment, or referral for treatment including but not limited to:
- Authorization by the state or federal government (e.g. licensed, certified, registered) to provide, and provides, such services,
- Advertisements, notices, or statements relative to such services, or
- Consultation activities relative to such services.
(81 FR 6995; see also SAMHSA, Does Part 2 Apply to Me?, at fn.3, available at https://www.healthit.gov/sites/default/files/topiclanding/2018-05/TabA.PDF (“’Holds itself out’ means any activity that would lead one to reasonably conclude that the individual or entity provides substance use disorder diagnosis, treatment, or referral for treatment.”).
If you are a Part 2 Program, then you must not only maintain the confidentiality of your SUD records (42 CFR §§ 2.12 and 2.13), but you must also comply with certain other administrative requirements relating to the records, including but not limited to providing a mandatory notice of privacy rights to SUD patients and honoring those rights (id. at § 2.22); implementing HIPAA-like safeguards to secure the records (id. at § 2.16); obtaining patient consent before using or disclosing SUD records for most purposes (id. at § 2.31); providing a copy of the patient’s written consent and a prescribed written notice to recipients of SUD records explaining their obligations to maintain confidentiality (id. at § 2.32); executing BAA-like agreements with qualified service organizations who perform permissible functions on your behalf (id. at § 2.12); and objecting to non-compliant court orders or subpoenas seeking SUD records in administrative, judicial or criminal proceedings. (Id. at § 2.61 et seq.).
II. Recipients of SUD Records. Even if you are not a Part 2 Program, you may still be subject to Part 2 confidentiality obligations if you receive SUD records from a Part 2 Program as described below.
A. Recipients of SUD Records + Part 2 Notice. Part 2 Programs may disclose SUD records if the SUD patient consents; however, to ensure the recipient knows that the records are protected by Part 2, the Part 2 Program must, along with the records, give the recipient (i) a copy of the consent and (ii) a prescribed written notice advising the recipient that the records are subject to Part 2 protections. (42 CFR § 2.32). Upon receipt of such notice, the recipient is put on notice that the records are subject to Part 2; the recipient must maintain the confidentiality of the records or face Part 2 and/or HIPAA penalties.2 The recipient’s further use or disclosure is generally prohibited subject to limited exceptions.3 The net effect is that, beginning February 16, 2026, recipients of Part 2 records must ensure they understand their Part 2 obligations, train their staff, and implement practices and safeguards that will ensure the confidentiality and security of Part 2 records they may receive.
B. Qualified Service Organizations. Part 2 allows Part 2 Programs to share SUD records with a qualified service organization (“QSO”), i.e., HIPAA business associates and/or other entities who perform certain functions on behalf of the Part 2 Program such as “data processing, bill collecting, dosage preparation, laboratory analyses, or legal, accounting, population health management, medical staffing, or other professional services, or services to prevent or treat child abuse or neglect, including training on nutrition and child care and individual and group therapy.” (42 CFR § 2.11). Such disclosures do not require patient consent so long as the QSO enters a written agreement with the Part 2 Program by which the QSO acknowledges that, by “receiving, storing, processing, or otherwise dealing with any patient records from the part 2 program, it is fully bound by [the Part 2] regulations….” (Id.). Thus, QSOs also need to understand and take steps to ensure compliance with their Part 2 obligations.
C. Other Lawful Holders. Part 2 allows Part 2 Programs to disclose SUD records to certain other persons or entities for limited purposes without the SUD patient’s consent if certain conditions are satisfied, including but not limited to medical personnel responding to a bona fide medical emergency (42 CFR § 2.51); entities with direct administrative control over the Part 2 Program (id. at § 2.12(c)(3)); auditors and entities performing financial services (id. at 2.53); and courts in some circumstances (id. at § 2.61 et seq.). Part 2 confidentiality obligations may also extend to such “lawful holders.”4
III. Conclusion. If you are a federally assisted SUD program or receive records from such a program, then you are almost certainly going to be subject to the new Part 2 confidentiality obligations. As the OCR recently warned, “[b]eginning February 16, 2026, the public may file complaints alleging violations of Part 2, breaches of unsecured Part 2 records must be reported, and OCR may begin investigation and enforcement activities.” (OCR, OCR Resources in Support of Substance Use Disorder Treatment Month (2/2/26)). If you generate or receive SUD records covered by Part 2, it is time to take appropriate steps to ensure your Part 2 compliance. For more information about the new Part 2 rules, see the OCR Fact Sheet at https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html.
1 “SUD record” is defined far more broadly than just written or electronic records. Part 2 generally applies to any information regardless of the format indicating that the person had, was evaluated for, or referred for treatment of a substance use disorder. “Substance use disorder” means:
a cluster of cognitive, behavioral, and physiological symptoms indicating that the individual continues using the substance despite significant substance-related problems such as impaired control, social impairment, risky use, and pharmacological tolerance and withdrawal….
(42 CFR § 2.11). “Record” generally means:
any information, whether recorded or not, created by, received, or acquired by a part 2 program relating to a patient (e.g., diagnosis, treatment and referral for treatment information, billing information, emails, voice mails, and texts), and including patient identifying information....
(Id.). Part 2’s confidentiality obligations generally apply to any records (i.e., individually identifiable information) which:
(i) Would identify a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person; and
(ii) Contain substance use disorder information obtained by a federally assisted substance use disorder program.... for the purpose of treating a substance use disorder, making a diagnosis for that treatment, or making a referral for that treatment.
(42 CFR § 2.12(a)(1)).
2 Part 2’s restrictions on the use or disclosure of SUD records generally apply to “[p]ersons who receive [SUD] records [and] who are notified of the prohibition on redisclosure” by receipt of the written notice advising the person that the records are subject to Part 2. (42 CFR § 2.12(d)(2)(i)(C); see also id. at §§ 2.13(b) and 2.11, definition of “lawful holder”).
3 For example, Part 2 now allows HIPAA-covered entities and business associates who receive SUD records to further use or disclose the SUD records for treatment, payment or healthcare operations to the extent allowed by HIPAA if the patient consented to the Part 2 Program’s use or disclosure for treatment, payment or healthcare operations. (See 42 CFR § 2.33). Additional conditions apply to other downstream uses or disclosures. (See id).
4 Under Part 2, “lawful holder” means
a person who is bound by this part because they have received records as the result of one of the following:
…
(2) One of the exceptions to the written consent requirements in 42 U.S.C. 290dd-2 or this part.
(42 CFR § 2.11, definition of “lawful holder”).
Subscribe to get our Insights delivered to your inbox.
This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author(s). This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.