Mid-Atlantic Health Law TOPICS

As of February 16, 2026, all covered entities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) that receive or maintain substance use disorder (SUD) patient records were required to update their notice of privacy practices (NPP) to include information addressing the modified confidentiality of SUD patient records regulations, known as Part 2.

Specifically, providers must include the following statement in their NPP:

“To the extent that we have your substance use disorder patient records, subject to 42 CFR part 2, we cannot use or share information in those records in civil, criminal, administrative, or legislative investigations or proceedings against you without (1) your consent or (2) a court order and a subpoena.”

Providers must also give patients adequate notice about the potential for such records to no longer be protected by federal law upon redisclosure. To address this, providers may consider incorporating the following language into their NPPs:

“Please be aware that after we have shared your information in a permitted way, it is possible for the information to be redisclosed by the recipient, including substance use disorder treatment records. Upon redisclosure, this information may be disclosed in accordance with the HIPAA Privacy Rule and will no longer receive heightened Part 2 protections.”

Applicability

Part 2 rules apply to any federally assisted program that provides SUD diagnosis, treatment, or referral for treatment (Part 2 Programs). The law provides safeguards and procedures for using and disclosing Part 2 records, including criteria for court orders to authorize disclosure of SUD records.

Some Part 2 requirements also apply to Qualified Service Organizations, HIPAA covered entities, business associates, intermediaries, and investigative agencies that may receive and maintain Part 2 records.

Specific Changes

Part 2 previously restricted the redisclosure of SUD patient records from a Part 2 Program absent a specific, separate authorization for each disclosure. Now, Part 2 allows a single consent for all future uses and disclosures for treatment, payment, and health care operations (TPO) purposes.

This means Part 2 Programs may revise patient consent forms to remove the previous prohibition on redisclosure, creating easier collaboration among providers. 

Providers that are not Part 2 Programs may now also receive records under the single TPO consent and redisclose Part 2 records in accordance with HIPAA regulations. However, authorization restrictions still apply to the use and disclosure of Part 2 records in civil, criminal, administrative, and legislative proceedings against patients.

Under these circumstances, providers must receive explicit patient consent or a court order prior to disclosure. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested record is used or disclosed. 

Providers who fail to comply with these updated changes risk additional enforcement measures from HHS.

To avoid any compliance concerns, providers are encouraged to review and revise their current NPPs based on suggested options published by HHS.

Kennedy M. Hagens
410-576-4146 • khagens@gfrlaw.com