The U.S. Department of Health and Human Services (HHS) has issued a final rule to better align 42 CFR Part 2, which governs the confidentiality of substance use disorder (SUD) patient records, with the Health Insurance Portability and Accountability Act (HIPAA). This realignment, mandated by the CARES Act, aims to streamline care coordination while maintaining rigorous privacy protections for sensitive health information.
For employers sponsoring group health plans, the deadline to update and distribute the revised Notice of Privacy Practices (NPP) is February 16, 2026.
Key Changes to 42 CFR Part 2
The 2024 final rule introduces several modifications designed to reduce administrative burdens and clarify how SUD records can be shared:
- Single Consent for Treatment, Payment and Health Care Operations. Patients may now provide a single, global consent for all future uses and disclosures of their SUD records for treatment, payment, and health care operations (TPO).
- Enhanced Redisclosure Rights. Once a HIPAA-covered entity or business associate receives SUD records under TPO consent, they may generally redisclose those records in accordance with standard HIPAA regulations.
- Legal Proceeding Protections. The rule strengthens protection against the use of SUD records in civil, criminal, administrative, or legislative proceedings. Such records generally cannot be used against a patient in legal actions without specific written consent or a court order.
- Fundraising Opt-Out. Patients now have a right to opt out of receiving fundraising communications if their SUD records are to be used for such purposes. For example, if a substance use disorder treatment program wants to ask former patients for donations using information from their treatment records, it must first give those individuals a clear chance to opt out of receiving fundraising messages before any request is sent.
Updating the Notice of Privacy Practices (NPP)
Employers who are HIPAA-covered entities including those that manage employer-sponsored health plans must update their NPPs to reflect these changes. Even if an employer is not a “Part 2 program” itself, it must update its notice if it receives or maintains SUD records from such programs.
Required NPP updates include:
- SUD Specific Disclosures. A clear description of how the entity handles SUD records and an explanation that these records have stricter federal protection than other health information.
- Legal Protections Statement. A separate, specific statement explaining that SUD records may not be used in legal proceedings against the individual without authorization or a court order.
- Accounting of Disclosures. Updated information regarding a patient’s right to an accounting of disclosures, specifically for TPO disclosures made through an electronic health record.
- Fundraising Rights. A statement informing individuals of their right to opt out of fundraising communications involving SUD data.
Responsibility for providing the Notice of Privacy Practices (NPP) depends on the plan’s funding structure and the employer’s access to Protected Health Information (PHI). For fully insured plans, the carrier typically distributes the NPP, though employers should confirm the notice is current and properly provided to participants. For self-insured plans, the employer is responsible for maintaining and distributing the NPP.
Next Steps for Employers
To ensure compliance with the updated Part 2 and HIPAA requirements, employers should take the following proactive steps:
- Review and Update the NPP: Audit your current Notice of Privacy Practices to ensure it includes the mandatory language regarding SUD record protections and legal proceeding limitations.
- Post and Distribute the Revised Notice: Prominently post the updated NPP on your health plan’s website or Intranet (if one is maintained) by the effective date. Because of these material changes, the notice must also be individually delivered to participants, either through a mailing, during the next open enrollment period, or via email if the employee has specifically consented to electronic delivery.
- Update Internal Policies: Revise internal privacy policies and procedures to reflect the new “single consent” framework for TPO and the rules surrounding redisclosure.
- Train Workforce Members: Provide training to HR personnel and benefits administrators on the heightened sensitivity of SUD records and the specific restrictions on their use in legal contexts.
- Evaluate Vendor Agreement: Review existing agreements to ensure vendors who handle health plan data are also prepared to comply with the revised Part 2 regulations.
- Consult with Legal Counsel: Work with privacy experts or legal counsel to ensure your updated NPP and consent forms meet the specific technical requirements under the final rule.
