HHS OCR Launches Civil Enforcement Program for Substance Use Disorder Confidentiality Rules Under 42 C.F.R. Part 2, by Abbye Alexander, Esq., Christopher Tellner, Esq., and Henry Norwood, Esq., 3-27-26

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) recently announced the launch of a new civil enforcement program dedicated to enforcing the confidentiality requirements applicable to substance use disorder (SUD) patient records under 42 C.F.R. Part 2 (“Part 2”). This marks a major shift in the federal enforcement landscape governing SUD treatment records.

OCR’s civil enforcement authority officially took effect on February 16, 2026—the effective date by which “lawful holders” of SUD patient‑identifying information (including many SUD treatment programs, payers, and related entities) were required to comply with the 2024 Final Rule implementing Section 3221 of the CARES Act. The 2024 Final Rule updates Part 2 itself and brings Part 2 protections into closer alignment with HIPAA’s Privacy, Security, Breach Notification, and Enforcement Rules. It also applies HIPAA‑style enforcement mechanisms (45 CFR Part 160, subparts C, D, and E) to Part 2‑related violations, allowing for more consistent application of federal patient‑privacy requirements across many types of health information.

Key Change: Expansion of Civil Enforcement Authority

With these developments, OCR now has authority to investigate potential violations, require corrective action plans, negotiate resolution agreements, and impose civil monetary penalties for noncompliance with Part 2. Historically, Part 2 enforcement was largely criminal and typically involved referrals to the Department of Justice, with comparatively limited and less centralized administrative enforcement. The CARES Act reforms significantly expand and formalize OCR’s role by applying HIPAA-style civil enforcement mechanisms to Part 2.

OCR will now receive and investigate complaints and breach notifications involving Part 2-protected information through its existing HIPAA enforcement processes, making enforcement more consistent and accessible. As a result, providers should expect a more proactive and structured enforcement approach, consistent with OCR’s established oversight model under HIPAA.

Entities subject to Part 2 should therefore anticipate heightened scrutiny and increased compliance expectations, including:

• Expanded investigative authority: OCR may initiate compliance reviews in response to potential violations or systemic issues.
• Corrective action plans: Entities found noncompliant may be required to implement specific remedial measures and submit ongoing compliance reports.
• Civil monetary penalties: Financial penalties now apply to Part 2 violations, drawing on the same HIPAA‑style enforcement mechanisms previously unavailable for Part 2.

Next Steps for Providers and Health Plans

Organizations that are lawful holders of SUD patient‑identifying information should reassess their privacy, consent, and disclosure procedures to ensure compliance with the 2024 Final Rule and prepare for possible OCR inquiries or audits. Recommended immediate actions include:

• Reviewing and updating policies on SUD record handling, disclosures, and redisclosures to reflect the new consent and disclosure rules.
• Confirming that workforce training covers the integration of Part 2 and HIPAA requirements, including updated consent, redisclosure, and exception‑based disclosure provisions.
• Evaluating technical safeguards and breach response plans to ensure Part 2‑compliant incident handling and notification timelines.
• Documenting compliance efforts to demonstrate good‑faith adherence in the event of an OCR investigation.

This announcement confirms what many in the compliance community anticipated—Part 2 is no longer primarily enforced through a complaint‑driven, criminal framework. Instead, it has entered a new era of active civil enforcement that places renewed emphasis on accountability and patient confidentiality within SUD treatment programs and related health systems.

Authors: Abbye Alexander and Christopher Tellner, Co-Chairs of the Health Care/Managed Care Practice Group and Of Counsel Henry Norwood