The 2024 final rule that aligned 42 CFR Part 2 with HIPAA became fully enforceable on February 16, 2026. It was issued February 8, 2024 and took effect April 16, 2024, and OCR said it would accept complaints beginning February 16, 2026. Enforcement of Part 2 now follows the HIPAA process, with penalties aligned to HIPAA's tiered civil money penalties. This checklist is a starting point for a program-level self-review, not a substitute for legal counsel.
| Date | Event |
|---|
| February 8, 2024 | Final rule issued |
| April 16, 2024 | Rule took effect |
| February 16, 2026 | Compliance date; OCR began accepting complaints |
| Done | Self-review question |
|---|
| ☐ | Does your consent form allow a single consent for all future uses and disclosures for treatment, payment and health care operations (permitted under the rule), and does it meet the required content elements? |
| ☐ | Is there a documented process for revoking consent, and do staff know how to act on a revocation promptly? |
| ☐ | Do disclosures outside the TPO consent carry the required notice that Part 2 records are protected? |
| Done | Self-review question |
|---|
| ☐ | Was your NPP updated by February 16, 2026 to describe permitted uses and disclosures of Part 2 records, the individual's rights, and the limits on use in civil, criminal, administrative or legislative proceedings? |
| ☐ | Does it say that using or disclosing Part 2 records for TPO generally requires written consent, and that redisclosed records may no longer be protected by the HIPAA Privacy Rule? |
| ☐ | If you fundraise using SUD records, does it offer a clear opt-out? |
| Done | Self-review question |
|---|
| ☐ | Part 2 records no longer have to be segregated from other records, but can you still identify them so that restrictions on proceedings and redisclosure are honored? |
| ☐ | Is there an audit trail of who accessed SUD records and when? |
| ☐ | Can you provide an accounting of disclosures and process restriction requests? |
| Done | Self-review question |
|---|
| ☐ | Does your HIPAA breach response plan explicitly cover Part 2 records? The Breach Notification Rule now applies, including notice to affected individuals and HHS. |
| ☐ | Do you have a complaint process for patients who allege Part 2 violations? |
| Done | Self-review question |
|---|
| ☐ | Have data-sharing agreements with MCOs, care coordination partners and referral sources been reviewed against the final rule? |
| ☐ | Have staff been trained on the updated rule and a defined escalation path for uncertain disclosure requests? |
Programs that have not completed a review since the rule's compliance date should treat this as a near-term priority.
Last verified against agency sources on October 30, 2026.
Working through this in your own organization?
We help care organizations turn requirements like these into workable policies, staffing plans, and survey readiness.
Request a consultation