42 C.F.R. Part 2 Civil Enforcement Is Here: What Substance Use Disorder Providers Need To Know

February 16, 2026 marks a significant milestone for substance use disorder (SUD) treatment providers across the country. The HHS Office for Civil Rights (OCR) has  announced that, effective on February 16, 2026, it will begin civil enforcement of the federal regulations protecting the confidentiality of substance use disorder patient records under 42 CFR Part 2.

We discussed the recent updates to the provisions of 42 C.F.R. Part 2 in as  post back in November 2025. Consistent with those updates, now there is updated guidance regarding the civil enforcement mechanisms to back up those protections. 

What This Means for Your Organization
If you operate a federally-assisted SUD treatment program, you are subject to civil enforcement for violations of Part 2's confidentiality requirements. OCR's enforcement toolkit mirrors what we have seen under HIPAA for years: investigations, resolution agreements, monetary settlements, corrective action plans, and civil money penalties. The penalties themselves align with those available under HIPAA, which means potential fines ranging from thousands to millions of dollars depending on the nature and severity of the violation.

OCR will now accept complaints from individuals alleging Part 2 violations and will also receive breach notifications involving SUD patient records. If you have not already updated your compliance programs to reflect these new regulations, the time to act is now.

The Bigger Picture
This enforcement program implements the SUD confidentiality provisions of Section 3221 of the  CARES Act, which Congress passed in 2020 to better align Part 2 with HIPAA, while maintaining important additional protections for SUD records. The final rule implementing these changes was published in February 2024, yet it has taken two years for OCR to get to enforcing the new rules.

The alignment with HIPAA is intended to serve dual purposes. On one hand, it should reduce some of the administrative complexity that has long plagued providers trying to navigate two separate, often contradictory privacy regimes. On the other hand, it brings the enforcement teeth that Part 2 has historically lacked.
OCR's announcement emphasized that its enforcement is ultimately aimed at encouraging patients to seek treatment by instilling confidence that their treatment records will be protected. This is consistent with Part 2's original purpose: ensuring that any stigma associated with substance use disorder should not deter individuals from obtaining the treatment they need.

Action Items for SUD Providers
There are several steps you should take immediately if you have not done so already:

• First, review your current Part 2 compliance program and ensure it reflects the updated regulatory requirements. 
• Second, update your Notice of Privacy Practices. OCR has released  model notices that you can use as templates. 
• Third, educate and train your workforce on the new enforcement landscape and ensure they understand the consequences of noncompliance. 
• Fourth, review your breach notification procedures to ensure you can appropriately notify OCR of breaches involving SUD patient records. 
• Finally, assess your business associate agreements and qualified service organization agreements to ensure they contain appropriate Part 2 provisions.

Looking Ahead
This OCR announcement ties into the broader " Great American Recovery Initiative" announced by the current administration earlier this year, signaling that SUD treatment and privacy will remain areas of enforcement focus. We expect OCR to begin investigating complaints and potential violations promptly, and anticipate that we will see enforcement actions in the coming months as OCR establishes this new initiative.
For SUD treatment providers, the message is clear: Part 2 compliance is no longer just a best practice—it is an enforcement priority with real consequences. If you have questions about how these changes affect your organization, please do not hesitate to reach out.

To view Foley Hoag's Security, Privacy and The Law Blog please click here

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.