As of February 16, 2026, the new rules governing the confidentiality of substance use disorder (SUD) records will be enforced. If they have not done so, federally assisted SUD programs (Part 2 Programs) who are covered entities under HIPAA will need to update their business associate agreement (BAAs) to ensure compliance with the new rules.
SUD Confidentiality Obligations. The new Part 2 rules generally prohibit Part 2 Programs from disclosing SUD information without the patient’s written consent. However, the rules contain an exception that allows Part 2 Programs to disclose SUD information to a qualified service organization (QSO) without the patient’s consent so long as the Part 2 Program has an agreement with the QSO that requires the QSO to comply with Part 2.
Qualified Service Organizations. QSOs are essentially entities that would be business associates under HIPAA. Specifically, Part 2 defines QSOs as
a person [or entity] who:
(1) Provides services to a part 2 program, such as data processing, bill collecting, dosage preparation, laboratory analyses, or legal, accounting, population health management, medical staffing, or other professional services, or services to prevent or treat child abuse or neglect, including training on nutrition and child care and individual and group therapy, and
…
(3) Qualified service organization includes a person who meets the definition of business associate in 45 CFR 160.103, paragraphs (1), (2), and (3), for a part 2 program that is also a covered entity, with respect to the use and disclosure of protected health information that also constitutes a “record” as defined by this section.
(42 CFR 2.11).
QSO Agreements. Part 2 only allows disclosures to an entity as a QSO if the entity
Has entered into a written agreement with a part 2 program under which that person:
(i) Acknowledges that in receiving, storing, processing, or otherwise dealing with any patient records from the part 2 program, it is fully bound by the regulations in this part; and
(ii) If necessary, will resist in judicial proceedings any efforts to obtain access to patient identifying information related to substance use disorder diagnosis, treatment, or referral for treatment except as permitted by the regulations in this part.
(42 CFR 2.11). Thus, Part 2 Programs who are otherwise covered entities under HIPAA should ensure their BAAs contain these additional terms to satisfy the Part 2 exception for QSOs.
Other Terms. Part 2 is more restrictive than HIPAA: it limits some uses or disclosures of SUD records that HIPAA might otherwise allow. Part 2 Programs should review their existing BAAs with business associates/QSOs that received SUD records to ensure that they do not allow the business associate/QSO to use or disclose SUD records for purposes not allowed by Part 2.
Subscribe to get our Insights delivered to your inbox.
This publication is designed to provide general information on pertinent legal topics. The statements made are provided for educational purposes only. They do not constitute legal or financial advice nor do they necessarily reflect the views of Holland & Hart LLP or any of its attorneys other than the author(s). This publication is not intended to create an attorney-client relationship between you and Holland & Hart LLP. Substantive changes in the law subsequent to the date of this publication might affect the analysis or commentary. Similarly, the analysis may differ depending on the jurisdiction or circumstances. If you have specific questions as to the application of the law to your activities, you should seek the advice of your legal counsel.