What Individuals With Substance Use Disorder Treatment Records Should Know About the 2026 Changes to 42 CFR Part 2
- willrothconsulting
- 3 minutes ago
- 5 min read
Confidentiality has always been one of the cornerstones of substance use disorder treatment. People seek help when they believe their information will remain private and protected.
For decades, the federal regulation 42 CFR Part 2 has provided stronger confidentiality protections for substance use disorder treatment records than most other health privacy laws. These rules exist because individuals with substance use disorder have historically faced stigma, discrimination, employment barriers, and legal consequences if their treatment history became public.
Beginning 16 February 2026, important updates to these rules are in full effect. These changes expand certain patient rights and introduce civil enforcement. At the same time, the revisions also create new pathways for information sharing that people should understand before signing consent forms or authorizing the release of their treatment records.
As an addictions professional and Alcohol and Drug Counselor, I want to break this down in clear language so individuals with current or past substance use disorder treatment records understand what these changes mean for them.
What 42 CFR Part 2 Is Designed to Protect
42 CFR Part 2 is a federal regulation that protects the confidentiality of records created by federally assisted substance use disorder treatment programs. These records include information related to diagnosis, treatment, and referral for treatment.
The rule exists for one primary reason: to protect individuals from discrimination and stigma connected to substance use disorder treatment.
Unlike many other healthcare privacy laws, Part 2 historically required specific written consent from the patient before treatment records could be shared with most outside parties.
Without these protections, individuals might avoid seeking treatment because they fear that employers, law enforcement, or insurance companies could gain access to their records.
Why the Federal Government Updated the Law
In 2024, the U.S. Department of Health and Human Services issued a final rule updating 42 CFR Part 2. The goal was to modernize the regulation and bring parts of it closer to the structure of the HIPAA Privacy Rule.
Healthcare systems have changed significantly since Part 2 was first written in the 1970s. Today, providers coordinate care across electronic health records, integrated systems, and large networks of medical professionals.
Federal regulators stated that these updates were intended to support care coordination while maintaining confidentiality protections for substance use disorder treatment information.
The final rule went into effect in 2024, but organizations were given until 16 February 2026 to comply. Now that the compliance date has arrived, the new rules are officially in force.
Key Changes Individuals Should Understand
1. A Single Consent May Now Cover Multiple Disclosures
Historically, patients often had to sign separate consent forms for each entity receiving their treatment information.
Under the new rule, patients may now sign one consent allowing records to be shared for treatment, payment, and healthcare operations across multiple providers.
This can make coordination of care easier. However, it also means that individuals should read consent forms carefully before signing them.
Once consent is granted under this new structure, the receiving provider may be permitted to redisclose that information under HIPAA rules in certain circumstances.
2. Expanded Patient Rights
The revised regulation introduces several rights that mirror HIPAA protections. These include the ability to:
Request an accounting of disclosures
Request restrictions on certain uses or disclosures
Receive clear notice of privacy practices
File complaints regarding violations
These rights provide greater transparency into how treatment information is being used and shared.
3. Civil Enforcement and Penalties
Another major change involves enforcement.
Beginning in 2026, violations of 42 CFR Part 2 can be investigated and enforced by the U.S. Department of Health and Human Services Office for Civil Rights (OCR).
This means:
Complaints can be filed with OCR
Violations may lead to civil penalties
Breaches of substance use disorder records must be reported
This enforcement structure mirrors how HIPAA violations are handled.
4. Confidentiality Protections Still Exist
Even with these updates, important safeguards remain in place.
For example:
Substance use disorder records generally cannot be used in criminal or civil proceedings against a patient without consent or a court order.
Treatment programs must still follow strict rules governing disclosure of records.
Many disclosures still require patient authorization.
These protections continue to recognize the sensitive nature of substance use disorder treatment information.
Why These Changes Matter for Patients
For individuals who have received substance use disorder treatment, these changes affect how their information may move through the healthcare system.
There are two key takeaways.
First, the new rules may improve coordination between healthcare providers. Integrated care can benefit individuals with complex medical needs, including those receiving treatment for substance use disorder.
Second, the expanded sharing framework makes it more important than ever for patients to understand what they are signing when they complete consent forms.
Before signing a release, consider asking the provider:
Who will have access to my records?
Can those recipients share my records with others?
Can I limit what information is disclosed?
How can I revoke my consent if I change my mind?
Understanding these questions can help individuals make informed decisions about their personal health information.
Filing a Complaint if Confidentiality Is Violated
If someone believes their substance use disorder treatment records were improperly disclosed, they have the right to file a complaint.
Complaints can be submitted to the U.S. Department of Health and Human Services Office for Civil Rights (OCR).
OCR is responsible for investigating violations involving both HIPAA and the updated 42 CFR Part 2 regulations.
When filing a complaint, individuals should try to include:
The provider or organization involved
The date of the disclosure
A description of what happened
Any supporting documentation
You can learn more about the process or submit a complaint through the HHS Office for Civil Rights website: Filing a Health Information Privacy Complaint | HHS.gov
In Summary
Confidentiality is not a minor issue in addiction treatment. It is foundational.
People need to know that their personal health information will be protected when they ask for help. At the same time, healthcare systems continue to evolve, and regulations must adapt.
The 2026 updates to 42 CFR Part 2 attempt to balance two competing priorities:
protecting patient privacy
improving coordination of healthcare services
For individuals with current or past substance use disorder treatment records, understanding these rules can help you protect your rights and make informed decisions about your healthcare information.
If you have questions about confidentiality or treatment records, consider speaking with a clinical supervisor or a qualified addiction professional who understands both the clinical and regulatory aspects of substance use disorder treatment.
Sources and Additional Resources
U.S. Department of Health and Human Services. Fact Sheet: 42 CFR Part 2 Final Rule Fact Sheet 42 CFR Part 2 Final Rule | HHS.gov
U.S. Department of Health and Human Services. Understanding Confidentiality of Substance Use Disorder Patient Records Understanding Confidentiality of Substance Use Disorder (SUD) Patient Records or “Part 2” | HHS.gov
Center for Health Care Strategies. Changes to Substance Use Disorder Confidentiality Regulations Changes to Substance Use Disorder Confidentiality Regulations - Center for Health Care Strategies
Center of Excellence for Protected Health Information42 CFR Part 2 Final Rule Webinar May 2024 Archived Webinar: 42 CFR Part 2 Final Rule - What You Need to Know | Focus:PHI