OCR Vested with Authority to Enforce Federal Rules Protecting Substance Use Disorder Records
11/1/2025
The Office for Civil Rights (OCR) within the U.S. Department of Health & Human Services (DHHS) is responsible for enforcing the HIPAA Privacy and Security Rules. OCR’s authority includes investigating complaints, conducting audits and issuing penalties for violations of HIPAA. Earlier this year, the DHHS published a notice in the Federal Register announcing that OCR is delegated with the authority to enforce federal regulations governing the confidentiality of substance use disorder (SUD) patient records at 42 CFR Part 2 (Part 2 Rules). Such authority previously was vested in the Substance Abuse and Mental Health Services Administration.
By way of background, DHHS published a Final Rule in the Federal Register on February 16, 2024 amending the Part 2 Rules to better align the regulations with HIPAA. Among other things, the amended Part 2 Rules require Part 2 Programs to implement security protocols and to provide notification of breaches of Part 2 records, subjecting Part 2 record holders to the same breach notification requirements as those under the HIPAA Breach Notification Rule. The Final Rule also implements DHHS’s civil enforcement authority, including the imposition of civil money penalties for violations of the Part 2 Rules, which authority—as well as the authority to enter into resolution agreements and corrective action plans to resolve allegations of noncompliance—is delegated to the OCR in the Notice. Such authority will become effective on February 16, 2026, the compliance date of the Final Rule.
Part 2 Programs and other holders of SUD patient records must take action to implement or revise their privacy and security policies and procedures to comply with the Part 2 Rules by the compliance effective date.
Click Here to read the entire November 2025 Healthcare Law Update now!
If you need assistance with your HIPAA compliance program, an OCR investigation, or a data breach incident, please contact:
Lani M. Dornfeld, CHPC | 973.403.3136 | ldornfeld@bracheichler.com
Lani M. Dornfeld
CHPC, Member
Healthcare Law
973.403.3136 · 973.618.5536 Fax
ldornfeld@bracheichler.com
