As the Feb. 16, 2026, deadline for compliance with the 42 CFR Part 2 (Part 2) Final Rule draws near, Part 2 programs should ensure they are prepared to comply with all changes included in the new requirements. 

Part 2 is the federal law that applies to many individuals and organizations that provide substance use disorder (SUD) diagnosis or treatment, or referral for SUD diagnosis or treatment. Some healthcare providers are subject to both HIPAA and Part 2.  

Enforcement of Part 2 is one of the key changes effective Feb. 16, 2026. Specifically, the HIPAA civil and criminal penalties will apply to Part 2 violations. The Department of Health and Human Services, Office for Civil Rights will be responsible for enforcement of the Part 2 requirements. Here are some of the Final Rule updates for Part 2 programs to address: 

1. Revise forms for patients to consent to certain uses and disclosures of their Part 2 records.
2. For organizations subject to HIPAA and Part 2, update the HIPAA Notice of Privacy Practices (NPP) if applicable.
3. For organizations subject to Part 2 but not HIPAA, create and distribute the required NPP.  
4. Update policies and procedures for all changes to the Final Rule, including a patient's right to an accounting of disclosures and request to limit use and disclosure of Part 2 records.  
5. Draft and implement a policy and procedure for investigating and reporting a breach of Part 2 records.
6. Train all employees on the changes to Part 2 and all new and revised policies and procedures.