HIPAA Enforcement Agency Announces “Landmark Enforcement Program” for SUD Treatment Records – Take Action Now
2/17/2026
On February 13, 2026, the U.S. Department of Health and Human Services (DHHS), Office for Civil Rights (OCR) announced that its “Landmark Enforcement Program for Substance Use Disorder Records Begins February 16, 2026.” The new program is being implemented to enforce legal requirements for protection of the confidentiality of substance use disorder (SUD) treatment records, and is the first time civil enforcement mechanisms will be available to protect the confidentiality of such records.
Brief Background
By way of brief background, federal regulations at 42 CFR Part 2 protect the confidentiality of patient identifying information and records maintained by federally-funded SUD treatment programs. These regulations were amended on February 8, 2024 to implement the confidentiality provision of Section 3221 of the CARES Act, which required DHHS to better align the regulations at 42 CFR Part 2 with the regulations under HIPAA.
Relevance to Non-SUD Treatment Providers
HIPAA covered entities that are not federally-funded SUD treatment programs may become obligated to comply with both HIPAA and 42 CFR Part 2 under certain circumstances.
By way of example, if an internal medicine practice receives copies of a patient’s records that include records originally created by a Part 2 Program, then the internal medicine practice will be bound to protect such records as a “lawful holder” under the regulations at 42 CFR Part 2. Therefore, providers must be cognizant of the fact that SUD treatment records from a Part 2 Program may have become incorporated into the records maintained by such providers, triggering compliance not only with HIPAA but also with 42 CFR Part 2.
In a number of instances, the regulations at 42 CFR Part 2 place more stringent protections on SUD treatment records than the protections afforded under HIPAA. Therefore, providers who become lawful holders of SUD records cannot treat such records in the same manner as records containing protected health information under HIPAA. They must ensure, for example, that patient authorizations are obtained for certain uses and disclosures of SUD records, and that such records are not released for purposes of civil or criminal actions involving the individual without either written authorization from the individual or a subpoena and court order obtained after following the procedures set forth in 42 CFR Part 2.
How Enforcement Actions Might be Triggered
Enforcement actions are often triggered through complaints filed by individuals with the OCR and through a provider’s notification to the OCR about a breach of protected health information. Beginning February 16, 2026, OCR will begin accepting both complaints alleging violations of the regulations that protect SUD records and breach notifications involving SUD records. Penalties for non-compliance relating to the confidentiality of SUD records align with penalties under HIPAA relating to protected health information. OCR investigations may be resolved through a range of civil enforcement mechanisms, including civil money penalties, corrective action plans and a period of monitoring by the OCR.
What to Do Now
Providers should:
- Review their privacy and security program policies and procedures and update them where needed.
- Determine mechanisms for identifying SUD records incorporated into a patient’s records maintained by the provider.
- Ensure mechanisms are in place to obtain authorizations to use and disclose SUD records when required.
- Provide staff training.
- Ensure their Notice of Privacy Practices is up to date, including additional provisions that must be included by February 16, 2026.
We Can Help
If you need assistance with your privacy and security program or updating your policies and Notice of Privacy Practices, contact:
Lani M. Dornfeld, Esq., CHPC, Member, Healthcare Law, ldornfeld@bracheichler.com, 973.403.3136
Lani M. Dornfeld
CHPC, Member
Healthcare Law
973.403.3136 · 973.618.5536 Fax
ldornfeld@bracheichler.com
