What changed in the February 2026 Part 2 Final Rule?

The February 2026 Final Rule made several changes: (1) Allowed Part 2 patient consent for HIPAA treatment, payment, and health care operations disclosures to be combined into a single consent form; (2) Permitted Part 2 records to be used for payment and health care operations without a separate consent when the patient has already consented to treatment disclosures; (3) Clarified the applicability to lawful electronic health information exchanges; (4) Strengthened the prohibition on use of Part 2 records in criminal proceedings even with patient consent.

Does the February 2026 Part 2 rule eliminate the difference between Part 2 and HIPAA?

No. The rule narrows the gap but does not eliminate it. Core Part 2 protections remain: the general prohibition on disclosure without patient consent to law enforcement or in most criminal proceedings, the re-disclosure prohibition, and the requirement that consents identify each specific party authorized to receive records. Part 2 remains significantly more protective than HIPAA for SUD records.

Rule Change

42 CFR Part 2 Final Rule: What Changed in February 2026

Q: What is 42 CFR Part 2?

42 CFR Part 2 is a federal regulation that protects the confidentiality of substance use disorder (SUD) patient records at federally assisted programs. It is separate from HIPAA and imposes stricter requirements on when SUD records can be shared without patient consent. Part 2 applies to programs that specialize in SUD treatment and receive any form of federal assistance, including Medicare or Medicaid reimbursement.

By ComplyCreate Editorial Team · Published Apr 24, 2026 · 8 min read

SAMHSA's February 2026 Final Rule amended 42 CFR Part 2 — the federal regulation governing confidentiality of substance use disorder (SUD) patient records. The changes move Part 2 closer to HIPAA in several important ways while preserving the heightened protections that have defined Part 2 since 1975. Here's what changed, what stayed the same, and what SUD treatment programs should do now.

Background: What Is 42 CFR Part 2?

42 CFR Part 2 (commonly called "Part 2") is a federal regulation that protects the confidentiality of records belonging to patients treated in federally assisted substance use disorder programs. Part 2 predates HIPAA by more than two decades and is significantly more restrictive.

Under traditional Part 2, patients must provide written consent for nearly every disclosure of their SUD records — including disclosures to other treating providers for routine care coordination. This requirement has long been criticized as a barrier to integrated care, particularly as behavioral health and primary care have moved toward integration.

The 2024 CARES Act directed HHS and SAMHSA to align Part 2 more closely with HIPAA. SAMHSA's 2024 Final Rule made the first major changes. The February 2026 Final Rule represents a second wave of implementation, addressing issues identified after the 2024 rule took effect.

What the February 2026 Final Rule Changed

1. Simplified Consent for TPO Disclosures

The most significant practical change: the February 2026 rule allows a Part 2 patient to provide a single consent authorizing disclosures to covered entities and business associates for HIPAA-permitted treatment, payment, and health care operations (TPO) purposes. Previously, Part 2 required consent that identified each specific recipient — making coordination across a health system cumbersome.

Under the new rule, a patient may consent to: "All members of [Name] Health System and their business associates for purposes of treatment, payment, and health care operations." This aligns Part 2 consent with the broader consent structure permitted under HIPAA for TPO purposes.

2. Payment and Operations After Treatment Consent

When a patient has consented to treatment disclosures, the February 2026 rule permits records to be used for payment and health care operations by the same covered entity without a separate consent. This eliminates a practical barrier where billing for SUD services required separate patient authorization from treatment disclosures.

3. Electronic Health Information Exchange Clarification

The rule clarified that Part 2 programs participating in lawful electronic health information exchanges (HIEs) may share records consistent with patient consent provided to the HIE. This addresses implementation challenges created by the proliferation of state HIEs and Qualified Health Information Networks (QHINs) under TEFCA.

4. Strengthened Anti-Criminalization Provision

The rule reinforced and clarified the prohibition on use of Part 2 records in criminal proceedings. Even when a patient has consented to some disclosures, Part 2 records may not be used in a criminal proceeding against the patient without a court order. The rule added explicit guidance on the scope of this protection, including in the context of grand jury proceedings.

What Did NOT Change

Despite significant public comment requesting further alignment with HIPAA, several core Part 2 protections remain unchanged:

Consent still required for most disclosures: Unlike HIPAA's broad treatment exception (which permits disclosures for treatment without patient authorization), Part 2 still requires patient consent for disclosures to providers outside the consented health system or without a blanket TPO consent in place.
Re-disclosure prohibition: Recipients of Part 2 records may not re-disclose without additional patient consent. This chain-of-consent requirement remains in place and must be noted on disclosures.
Specificity requirements: Consent forms must still identify the specific program disclosing the records, the purpose of the disclosure, and the individuals or entities authorized to receive the records (though the new rule permits broader descriptions for TPO purposes).
No law enforcement exception: Part 2 does not include HIPAA's law enforcement exceptions. SUD records cannot be disclosed to law enforcement without patient consent or a specific court order, even for investigations unrelated to SUD treatment.

Who Is Affected

The February 2026 changes affect:

Part 2 programs: Outpatient SUD counseling centers, opioid treatment programs (OTPs), residential SUD facilities, and any federally assisted program specializing in SUD treatment. These programs must update their consent forms and disclosure practices to reflect the new TPO consent option.
Health systems integrating behavioral health: Hospitals and health systems with SUD treatment programs participating in enterprise-wide consent structures must ensure their consent forms and HIE participation agreements align with Part 2 as amended.
EHR vendors serving Part 2 programs: EHRs used by Part 2 programs may need updates to support the new consent structure and TPO disclosure documentation. Verify your EHR vendor's Part 2 compliance roadmap.
General mental health practices with SUD components: Practices that provide both mental health and SUD services must carefully assess whether they qualify as Part 2 programs for their SUD treatment components.

Action Items for Part 2 Programs

Update consent forms: Revise your patient consent forms to offer the new TPO consent option. Work with legal counsel to ensure the new forms satisfy both Part 2 and state law requirements.
Audit disclosure practices: Review your current disclosure workflows to identify where separate consents for payment and operations were previously required. Update workflows to reflect the new rule.
Review HIE participation agreements: If you participate in a state HIE or QHIN, confirm that your participation agreement and consent processes align with the February 2026 clarifications.
Train workforce: Staff who handle records and consents must be trained on the changes. Update training materials and document training dates.
Update BAAs: Confirm that your BAAs with EHR vendors, billing services, and HIE partners reflect Part 2 obligations including the re-disclosure prohibition. Generate updated BAAs as needed.

Timeline

The February 2026 Final Rule was published in the Federal Register with an effective date of April 1, 2026. Compliance is required for all Part 2 programs as of that date. No compliance delay or phase-in period was granted in this rule.

What to do next