In the late 1970s, Congress passed a law to protect substance use disorder ("SUD") records.  The law’s implementing regulations were later adopted in Part 2 of Title 42 of the Code of the Federal Register, so the law is often referred to simply as “Part 2.”  Part 2’s regulations impose restrictions on the disclosure of SUD records by substance use providers that receive federal assistance.  Part 2 is a separate federal law from the Health Insurance Portability and Accountability Act of 1996, as amended, (“HIPAA”) and imposes restrictions that are more stringent than HIPAA.  Historically, the Department of Justice could impose criminal penalties for violations of Part 2.  In the 2020 CARES Act, Congress amended Part 2 so that HIPAA’s civil and criminal penalties now apply to violations of Part 2.  Yesterday, the U.S. Department of Health and Human Services announced that its Office for Civil Rights, which traditionally enforces violations of HIPAA, will now administer and enforce violations of Part 2.  As a reminder, health plans must update their HIPAA Privacy Notices as of 2/16/26 to address Part 2's privacy requirements for SUD records.

Link to the Federal Register notice 2025-16391.pdf