>   About   >   Legal Defense Fund   >   Legal Issues   >   New HHS Final Rule Modifies Protections for Substance Use Disorder Records

New Rule Modifies Protections for Substance Use Disorder Records

By Jelani Hayes, JD (May 2024); Updated February 2026.
© February 2026. National Association of Social Workers. All rights reserved.

If you handle substance use disorder records, significant federal changes now require immediate review and action.

February 16, 2026, marked your compliance deadline for the most significant changes to Substance Use Disorder (SUD) record protections in decades. The U.S. Department of Health & Human Services (HHS) has fundamentally revised how social workers obtain consent, respond to subpoenas, and report breaches, and every social worker touching SUD records must understand what's changing.

In February 2024, HHS issued a Final Rule updating the Confidentiality of SUD Patient Records regulations, known as "Part 2." These modifications streamline disclosure rules while maintaining strong privacy protections, but they require concrete action from you.

Whether you work in a hospital, behavioral health facility, private practice, or community program, if you're subject to Part 2, you need to act now. This guide breaks down exactly what's changing and what you must do to comply.

Why These Changes Matter

Part 2 protects "[r]ecords of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance use disorder education, prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States"(42 U.S.C. § 290dd–2(a)).

The Final Rule modernizes these protections and brings Part 2 into alignment with key Health Insurance Portability and Accountability Act (HIPAA) privacy and enforcement measures—with critical exceptions social workers need to know.

Compliance Deadline: February 16, 2026. The Final Rule was published in the Federal Register on February 16, 2024. All individuals and entities subject to Part 2 must comply with these new requirements within two years of that date.

Who Must Comply with These Changes:

Part 2 applies to any program or activity that:

  • Provides SUD education, prevention, training, treatment, rehabilitation, or research, and
  • Is conducted, regulated, or directly/indirectly assisted by any federal department or agency

This includes social workers in:

  • Behavioral health treatment facilities
  • Hospital SUD programs
  • Community mental health centers
  • Private practices receiving federal funding
  • Care coordination roles involving SUD records

What Social Workers Must Do by February 2026

  • Review and update all SUD-related consent forms to ensure they meet new requirements
  • Train staff on new disclosure requirements and breach notification procedures
  • Update disclosure notices to include required statement and consent documentation
  • Implement HIPAA breach notification procedures if not already in place
  • Revise policies for handling subpoenas and legal proceedings involving SUD records
  • Separate SUD counseling notes from general treatment records if you maintain them

Client Consent to Disclosure

Under the Final Rule, the following changes have been made to Part 2:

  • All disclosures must include a prohibition statement:Every time SUD records are disclosed, you must include this notice: "42 CFR Part 2 prohibits unauthorized disclosure of these records." You must also attach either a copy of the consent form or provide a clear written explanation of what the consent covers.
  • A single consent may be used for all future disclosures and uses of SUD records for treatment, payment, and health care operations.
  • HIPAA-covered entities and professionals can disclose SUD records in accordance with the HIPAA Privacy Rule with one important exception: specific consent or a court order is required for disclosures pertaining to administrative or legal proceedings against the client, as described in the bullet point below.
  • When the clinical social worker is faced with a request for testimony or the client’s SUD records, they must not disclose this information without the client’s specific consent or a court order. This is not a new requirement under Part 2 but has been maintained alongside the above-mentioned changes to consent requirements.
  • SUD records may be disclosed without the client’s consent to public health professionals so long as those records are de-identified in accordance with the HIPAA Privacy Rule.
  • The clinician’s SUD counseling notes “analyzing the conversation in an SUD counseling session that the clinician voluntarily maintains separately from the rest of the patient’s SUD treatment and medical record” may not be disclosed without the client’s specific consent (U.S. Department of Health and Human Services [HHS], 2026). This protection is analogous to the protections afford to psychotherapy notes under HIPAA. However, mental health care providers, including licensed clinical social workers, can refuse to share psychotherapy notes with their clients and third parties even if the client requests or consents to the disclosure. Whether mental health care providers can refuse to share SUD counseling notes with their clients or third parties when the client requests the disclosure is unclear. Clinical social workers should consult an attorney if they are faced with such a request but do not want to share their notes. (For more information on maintaining psychotherapy notes, see the LDF Legal Issue, “Psychotherapy Notes”).
  • All disclosures made with client consent require a “copy of the consent or a clear explanation of the scope of the consent” (HHS, 2026).

Note: this requirement aligns with NASW Code of Ethics 1.07, which pertains to client privacy, but is more stringent than the HIPAA Privacy Rule’s subpoena policy, which requires notifying the client of the request but does not require a court order. (For more information on subpoenas, generally, see the LDF Legal Issue, “Responding to Subpoenas.”)

Like psychotherapy notes, SUD counseling notes exclude “medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date” (Confidentiality of Substance Use Disorder (SUD), Patient Records, 2024). Although different legal provisions govern each, there is no practical distinction between SUD notes and psychotherapy notes other than that the former pertains to SUD counseling.

Part 2 Alignment With HIPAA

The Final Rule also aligns several Part 2 provisions with parallel HIPAA provisions. These HIPAA provisions include the:

  • Breach Notification Rule - Part 2 programs must now follow HIPAA's breach notification requirements. If there is an unauthorized disclosure of SUD records:
    • Notify affected individuals without unreasonable delay (and no later than 60 days)
    • Notify the HHS Secretary
    • In cases affecting 500+ individuals, notify prominent media outlets
    • Maintain documentation of all breaches
  • Notice of Privacy Practices
  • Enforcement Rule - Penalties for Part 2 violations now align with HIPAA penalties, ranging from $100 to over $70,000 per violation, with potential criminal penalties for knowing violations.

Take Action Now

  • Consult with your organization's compliance officer or legal counsel
  • Update your forms and procedures in accordance with the February 16, 2026, deadline
  • Document your compliance efforts

This brief summary does not include other changes to Part 2 that may be relevant to some social workers. For more information, see the resources below:

Read the HHS Fact Sheet here.

Read the Final Rule in its entirety here.

Read the Part 2 statute here.

References and Resources

Confidentiality of substance use disorder (SUD) patient records, 89 Fed. Reg. 12472 (Feb. 16, 2024). https://www.federalregister.gov/d/2024-02544

42 U.S.C. § 290dd–2. https://www.law.cornell.edu/uscode/text/42/290dd-2

U.S. Department of Health and Human Services. (2013). Breach notification rule. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html

U.S. Department of Health and Human Services. (2026). Fact sheet: 42 CFR Part 2 final rule. https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html

U.S. Department of Health and Human Services. (2025). Guidance regarding methods for de-identification of protected health information in accordance with the Health Insurance Portability and Accountability Act (HIPAA) privacy rule. https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html

U.S. Department of Health and Human Services. (2026). Notice of privacy practices for protected health information. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/privacy-practices-for-protected-health-information/index.html

U.S. Department of Health and Human Services. (2020). The HIPAA enforcement rule. https://www.hhs.gov/hipaa/for-professionals/special-topics/enforcement-rule/index.html

U.S. Department of Health and Human Services. (2024). The HIPAA privacy rule. https://www.hhs.gov/hipaa/for-professionals/privacy/index.html

The information contained in this website is provided as a service to NASW members and the social work community for educational and information purposes only and does not constitute legal advice. LDF provides timely information, but makes no claims, promises or guarantees about the accuracy, completeness, or adequacy of the information contained in or linked to in the article. Transmission of the information is not intended to create, and receipt does not constitute, a lawyer-client relationship between NASW, LDF, or the author(s) and you. NASW members and online readers should not act based on the information provided in the LDF Web site. Laws and court interpretations change frequently. Legal advice must be tailored to the specific facts and circumstances of a particular case. Nothing reported herein should be used as a substitute for the advice of competent counsel.