42 CFR Part 2 in 2026: How Behavioral Health Operators Should Handle SUD Records After the 2024 Amendments

42 CFR Part 2 — the federal regulation governing the confidentiality of substance use disorder patient records — was substantially amended in early 2024, with full operator compliance required by February 2026. The revisions align Part 2 more closely with HIPAA, expand certain uses and disclosures, and change how behavioral health programs must handle consents, redisclosures, breach notifications, and audit responses. For SUD programs and integrated behavioral health operators, the compliance implications are significant — and enforcement scrutiny has increased in parallel.

At Circa Behavioral, our compliance team works with behavioral health operators nationally on Part 2 program design, staff training, and survey preparation. This guide summarizes what the 2024 amendments changed, where operators most commonly fall short, and the concrete workflow updates programs should have in place now.

What Changed in the 2024 Part 2 Rule

The Substance Abuse and Mental Health Services Administration (SAMHSA) published the final rule amending 42 CFR Part 2 on February 16, 2024, with a compliance date of February 16, 2026. The SAMHSA final rule materially changed several longstanding requirements:

• Single patient consent for TPO. Patients can now provide a single written consent authorizing use and disclosure of Part 2 records for all future treatment, payment, and health care operations (TPO), rather than needing to re-consent for each disclosure.
• Redisclosure permitted for TPO. Recipients who receive Part 2 records under a TPO consent may now redisclose those records for their own TPO purposes without additional patient consent — with certain restrictions.
• Breach notification alignment. Part 2 breach notification requirements now mirror HIPAA’s Breach Notification Rule at 45 CFR Part 164 Subpart D — including individual notification, HHS reporting, and media notification thresholds.
• Enforcement structure. HHS now has civil and criminal enforcement authority under Part 2 comparable to HIPAA enforcement under the HITECH Act, including tiered civil monetary penalties.
• Patient rights expanded. Patients receive new rights including a right to an accounting of disclosures, a right to request restrictions, and a right to file complaints with HHS.
• Prohibition on use in legal proceedings. Part 2 records still cannot be used in criminal, civil, administrative, or legislative proceedings against the patient without specific patient consent or a qualifying court order.

The HHS Office for Civil Rights guidance reinforces that Part 2 protections continue to layer on top of HIPAA — Part 2 does not replace HIPAA, and any conflict is resolved in favor of the more protective standard.

Where Behavioral Health Operators Most Commonly Fall Short

In our fractional compliance and audit-preparation engagements, we consistently see the same Part 2 documentation gaps at behavioral health programs:

• Outdated consent forms. Programs are still using pre-2024 consent language that does not authorize the broader TPO uses now permitted, forcing repeat consents for every payer submission.
• No documented Part 2 program designation. The program has not formally documented whether it qualifies as a “Part 2 program” — a threshold determination that governs everything downstream.
• Redisclosure notices missing or non-compliant. Records shared with downstream providers lack the required redisclosure notice.
• Business associate agreements not updated. BAAs with billing companies, EHR vendors, and third-party auditors do not address Part 2 obligations.
• Breach response playbook still HIPAA-only. The program has a HIPAA breach playbook but has not updated it to address the newly aligned Part 2 breach notification requirements.
• Court order and subpoena workflows untested. Staff do not know how to respond when a subpoena arrives — and Part 2 requires a specific qualifying court order, not a standard subpoena, before disclosure is permitted.

What Your Consent and Notice Forms Should Look Like in 2026

The single most impactful documentation update most operators need is a rewritten patient consent that leverages the new TPO framework. A compliant post-2024 consent should:

• Clearly identify the specific SUD program disclosing the records
• Authorize disclosure for all future TPO purposes, with the patient’s explicit acknowledgment that TPO includes payment and health care operations
• Include the required notice regarding the prohibition on use of records in legal proceedings against the patient without further consent
• Specify the duration of the consent and provide clear revocation procedures
• Include patient signature and date fields with staff attestation

Redisclosure notices should be attached to every outbound Part 2 record and should track the language SAMHSA provided in its 2024 final rule preamble. Programs that use EHR-generated release documents should confirm the vendor has updated its templates. See our related guides on EHR selection with a compliance-first lens and the PHI breach response timeline.

Aligning Part 2 With Your Accreditation Readiness

Both CARF and The Joint Commission surveyors now routinely ask to see Part 2 documentation during behavioral health surveys — consents, redisclosure notices, staff training records, and breach response protocols. Programs preparing for accreditation should treat Part 2 compliance as a survey-day tracer topic, not just an OCR filing exercise.

For surveyor-facing preparation, review our operator playbooks on CARF survey preparation, mock Joint Commission surveys, and building a Joint Commission tracer-ready chart.

Prepare Your Program for 2026 Part 2 Enforcement

The February 2026 compliance date has arrived, and HHS enforcement of the aligned Part 2 framework is now active. Programs that have not updated consents, redisclosure notices, BAAs, and breach response procedures should treat remediation as a near-term operational priority, not a quarterly project.

Circa Behavioral offers fractional compliance officer engagements, one-time Part 2 audits, and staff training packages for behavioral health operators nationally. Call 888-458-6619 to speak with a compliance consultant, or schedule a fractional compliance consultation online.