Substance Use Disorder Patient Records Privacy Practices Under HHS’s “Part 2” Rules

By: Phuong D. Nguyen and Michael R. Alexander

In 2024, the Department of Health and Human Services (“HHS”) issued a final rule—commonly known as “Part 2”— updating protections for the confidentiality of substance use disorder (“SUD”) patient records. Impacted by this are both “Part 2 Programs”—those who provide SUD services—as well as “lawful holders”—those providers who may receive SUD patient records.

As of February 16, 2026, persons subject to Part 2, including health care entities and providers, must comply with the final rule’s requirements to protect the confidentiality of SUD patient records. In assessing whether Part 2 applies and in what way, it is important to start with the question of whether a provider or a health care facility meets the criteria to even be considered a Part 2 Program or a lawful holder.

A Part 2 program is defined as a federally assisted program that meets the definition of a “Program” under Part 2, which includes the following:

• A person (other than a general medical facility) that holds itself out as providing, and provides, substance use disorder services
• An identified unit within a general medical facility that holds itself out as providing, and provides, substance use disorder services; or
• Medical personnel or staff whose main function is to provide substance use disorder services.

So, examples of Programs include treatment or rehabilitation programs, employee assistance programs, programs within general hospitals, school-based programs, and private practitioners who hold themselves out as providing SUD services. But emergency department personnel that refer a patient to another provider for an apparent overdose are not considered to be a Part 2 program unless the main purpose of such personnel is the provision of SUD services, or the emergency department has otherwise promoted itself as a provider of SUD services. So, a general hospital facility or physician office would likely not be a Program under Part 2 unless they hold themselves out to provide SUD services.

However, even if a facility or provider is not a Part 2 program, it may still be a “lawful holder” and subject to Part 2’s requirements. A “lawful holder” is a person who received SUD patient records pursuant to the patient’s written consent or under an applicable exception. For example, a patient’s primary care provider that receives SUD patient records from a Part 2 program is a lawful holder.

Why does this matter? One of the areas that Part 2 governs is what notices of privacy practices providers and healthcare facilities are required to give to their patients. Similar to HIPAA, Part 2 requires that Programs provide patients with notice of the Program’s specific legal duties and privacy practices under Part 2. With respect to lawful holders, Part 2 does not directly require those providers to provide a notice of privacy practices. However, because many lawful holders are also covered entities and are subject to HIPAA’s requirements, they are required to provide patients with notice with “sufficient detail to place the individual on notice of the uses and disclosures that are permitted or required by this subpart [42 CFR 164.520] and other applicable law, such as 42 CFR part 2.” 45 CFR 164.520(b)(1)(ii)(D). Hence, if a covered entity believes that it might be a lawful holder, even if it is not a Part 2 Program, it ought to consider updating its notice of privacy practices to include those requirements set forth in Part 2.

To learn more about navigating complex healthcare regulatory matters, connect with Phuong D. Nguyen. Phuong advises healthcare clients across the United States on regulatory compliance, structuring business arrangements, drafting agreements, reimbursement issues, and other regulatory matters. He is Board Certified in Health Law by the Texas Board of Legal Specialization. Reach out at (806) 345-6307 or pnguyen@bf-law.com to learn how he can support your organization with practical, experienced legal counsel.

For practical, strategic counsel on complex healthcare regulatory matters, contact Michael R. Alexander. Michael combines regulatory compliance experience with a litigation background, providing clients with practical solutions informed by both preventative compliance strategies and real-world dispute resolution experience. Michael represents pharmacies, hospitals, physicians, and other healthcare providers across the country. His practice focuses on regulatory compliance, healthcare transactions, regulatory investigations and actions, and payor disputes. To discuss how Michael can help you clients navigate regulatory challenges, enforcement actions, and business-critical compliance issues, contact him at (806) 345-6340 or malexander@bf-law.com.

This article is for informational purposes only and does not constitute legal advice or establish an attorney-client relationship. This article was prepared on a specific date, and the law may have changed since it was written. You should contact your attorney to obtain advice with respect to your specific legal issue and needs.

• Share this post: