HHS Launches Civil Enforcement Program to Bolster SUD Patient Record Confidentiality

New Enforcement Era for Substance Use Disorder Patient Records

The U.S. Department of Health and Human Services (HHS) has officially launched a new civil enforcement program aimed at rigorously protecting the confidentiality of substance use disorder (SUD) patient records. Announced by the HHS Office for Civil Rights (OCR) on February 13, 2026, this program marks a significant shift, introducing civil enforcement mechanisms for the first time to safeguard these sensitive patient data. The initiative is set to become fully enforceable on February 16, 2026.

HHS Secretary Robert F. Kennedy, Jr., emphasized the program's importance, stating, 'Americans seeking treatment for substance use disorder deserve comprehensive care without sacrificing their privacy or legal protections.' This move is part of the 'Great American Recovery Initiative' and seeks to instill confidence in patients, encouraging them to seek necessary SUD treatment.

Alignment with HIPAA and CARES Act Mandates

The new program executes the SUD confidentiality provisions outlined in Section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act and its implementing regulation, 42 CFR Part 2. A final rule modifying 42 CFR Part 2 was published in the Federal Register on February 16, 2024, and became effective on April 16, 2024. The primary goal of these modifications is to align certain aspects of Part 2 with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules.

This alignment aims to enhance the integration of behavioral health information with other medical records, thereby improving patient health outcomes, while simultaneously strengthening confidentiality protections. Previously, Part 2 violators were primarily subject to potential criminal penalties; now, they face the same potential civil and criminal penalties as those for HIPAA violations.

Key Provisions and Patient Protections

The updated regulations introduce several critical changes and enhanced patient rights:

• Single Consent: Patients can now provide a single consent for all future uses and disclosures of their SUD records for treatment, payment, and healthcare operations (TPO).
• Restricted Use in Legal Proceedings: The rules strictly limit the use of SUD records and testimony in civil, criminal, administrative, or legislative proceedings against patients without their explicit consent or a court order.
• HIPAA Breach Notification: The requirements of the HIPAA Breach Notification Rule now apply to breaches of records under Part 2.
• SUD Counseling Notes: New protections are established for SUD counseling notes, similar to HIPAA's safeguards for psychotherapy notes, requiring specific patient consent for their use or disclosure.
• Patient Rights: Patients gain rights akin to those under HIPAA, including the ability to file complaints directly with HHS for Part 2 violations, receive notice of their rights, and request an accounting of disclosures.

Enforcement and Compliance

The HHS Secretary delegated authority to the Office for Civil Rights (OCR) on August 27, 2025, empowering OCR to administer and enforce these regulations. OCR investigations under the new program may result in a range of civil enforcement mechanisms, including resolution agreements, monetary settlements, commitments for corrective action, or the imposition of civil money penalties for noncompliance. Entities subject to these regulations are required to achieve full compliance by the February 16, 2026, deadline to avoid significant financial liabilities.