HHS Secretary Robert F. Kennedy Jr. has transferred enforcement authority for substance use disorder record regulations to the Office for Civil Rights.
What happened
On August 26, 2025, the U.S. Department of Health and Human Services (HHS) announced that its Office for Civil Rights (OCR) will now oversee and enforce the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations under 42 CFR Part 2. The delegation was formalized by HHS Secretary Robert F. Kennedy Jr. and published in the Federal Register the following day.
Part 2 regulations were created to ensure that individuals receiving treatment for substance use disorders are protected from legal, social, and employment consequences. These rules offer stricter confidentiality protections than HIPAA, and typically prohibit disclosure of any identifying information about SUD patients without written consent.
Going deeper
Historically, having separate privacy frameworks for general health records (regulated under HIPAA) and SUD records (regulated under Part 2) has created tension. These dual frameworks have made it difficult for healthcare providers to coordinate care and manage compliance, with real-world risks such as inadvertently prescribing opioids to patients in recovery due to incomplete medical histories.
In response to these concerns, the 2020 CARES Act directed HHS to align Part 2 more closely with HIPAA. The Final Rule, issued in 2024 by SAMHSA and OCR, introduced significant reforms: individuals must now be notified of breaches involving their SUD records, and they have the right to file complaints for violations, similar to HIPAA protections. The compliance deadline for this rule is February 16, 2026.
The new delegation gives OCR the authority to enforce these provisions by entering into resolution agreements, levying civil monetary penalties, and issuing subpoenas during investigations or compliance reviews.
The big picture
Under the delegation, OCR is empowered to interpret and enforce the updated Part 2 rules. The agency can enter monetary settlements, establish corrective action plans, and conduct investigations. However, the statement of delegation also raises questions about funding and capacity. OCR’s responsibilities have expanded in recent years due to a sharp increase in large-scale breaches and HIPAA complaints, yet the agency has faced budget constraints and staffing reductions.
As enforcement of Part 2 ramps up, it’s unclear how OCR will manage the added workload without additional congressional funding.
FAQs
What types of programs are covered under Part 2 regulations?
Part 2 applies to federally assisted programs that provide diagnosis, treatment, or referral for substance use disorders, including hospitals, clinics, and certain private practices.
How do Part 2 regulations differ from HIPAA?
While HIPAA permits certain data disclosures for treatment and operations without consent, Part 2 generally requires written consent for any disclosure that identifies someone as having a substance use disorder.
What is the significance of the 2024 Final Rule?
The Final Rule brings Part 2 closer in line with HIPAA by allowing for breach notifications and complaint processes, and by clarifying how providers can share SUD information under specific conditions.
Will OCR be able to enforce penalties for Part 2 violations?
Yes. Under the delegation, OCR can impose civil monetary penalties, enter into settlements, and mandate corrective action for violations of Part 2.
What should covered entities do to prepare for the February 2026 compliance deadline?
Organizations should update their privacy policies, train staff on Part 2 requirements, implement breach notification procedures, and ensure that consent forms meet the updated standards.
Farah Amod
