42 CFR Part 2 Breach Notification and Patient Complaints: The Enforcement File Behavioral Health Operators Need

For most of its history, 42 CFR Part 2 had an odd enforcement profile: strict confidentiality rules, criminal-only penalties, and very little day-to-day enforcement. The 2024 final rule changed that. Since the compliance date of February 16, 2026, substance use disorder (SUD) programs covered by Part 2 have been expected to handle breach notification, patient complaints and penalty exposure on essentially the same footing as HIPAA. Most programs we work with updated their consent forms for the new rule. Far fewer rebuilt the machinery that sits behind a breach or a complaint, and that machinery is what an investigator asks to see first.

This post covers what changed, where programs get caught, and the file you should be able to hand over the same day someone asks. It is operational guidance, not legal advice. Confirm specifics against the regulation and with your counsel.

What the 2024 Part 2 Final Rule Changed for Enforcement

HHS published the final rule in February 2024 and gave programs two years to comply. The HHS fact sheet on the Part 2 final rule summarizes the changes, SAMHSA maintains a final rule overview, and the full text is in the current 42 CFR Part 2 on eCFR. Three enforcement changes matter most to operators:

• Breach notification now reaches Part 2 records: the rule applies the HIPAA breach notification requirements to breaches of records protected by Part 2.
• Penalties now mirror HIPAA: the old criminal-only structure was replaced with the civil and criminal penalties that apply under HIPAA, which creates a realistic path to monetary penalties for ordinary compliance failures.
• Patients can complain, and programs cannot retaliate: programs must have a process to receive complaints about Part 2 compliance, patients may also file complaints with HHS, and a program may not retaliate or require a patient to waive the right to complain as a condition of treatment.

Here is the part most worth committing to memory. Under 42 CFR Part 2 as amended in 2024, a breach of unsecured Part 2 records triggers the same notification clocks as a HIPAA breach: affected patients must be notified without unreasonable delay and no later than 60 calendar days after the breach is discovered, breaches affecting 500 or more people must also be reported to HHS within that same window, and smaller breaches are logged and reported to HHS within 60 days after the end of the calendar year. Part 2 programs have been required to comply since February 16, 2026.

Where the Breach Clock Actually Starts

The single most common timing error we see is starting the clock on the wrong day. Under the HIPAA breach rule, which now governs Part 2 breaches, a breach is treated as discovered on the first day it is known, or by exercising reasonable diligence would have been known, to any workforce member other than the person who committed it. The clock does not start when the compliance officer hears about it. It starts when the intake coordinator realizes the fax went to the wrong number, or when the therapist notices the group email went out with every recipient visible.

In practice, that means a program that learns about an incident from a staff member two weeks after it happened has already used two weeks of its 60 days. Programs that route incident reports through a clinical supervisor first, and only later to compliance, lose time on every incident without noticing.

The second error is skipping the risk assessment. An impermissible use or disclosure is presumed to be a breach unless the program demonstrates a low probability that the information was compromised, based on a documented assessment of four factors: the nature and extent of the information involved, who received it, whether it was actually acquired or viewed, and how far the risk was mitigated. For SUD records, the first factor almost always weighs heavily. A diagnosis of opioid use disorder in the wrong hands is not a low-sensitivity disclosure, and an assessment that treats it like a misdirected appointment reminder will not hold up.

Why Part 2 Breaches Get Missed

When we review incident logs at Part 2 programs, the misses tend to come from the same four mechanisms:

• Part 2 status is invisible in the EHR: when SUD records sit in the same system as general mental health records with no flag, staff assessing an incident do not know which rules apply.
• Incident reports go to clinical leadership, not compliance: privacy events get handled as performance issues, and nobody opens a breach assessment.
• Vendors do not know what they hold: billing, EHR and answering-service vendors with access to Part 2 records often have contracts that never mention Part 2, so their own incident reporting is slow or vague.
• No-notify decisions are not written down: the program reasonably concluded an incident was low risk, but the four-factor assessment exists only in someone’s memory, and the burden of proof sits with the program.

The Complaint Process HHS Now Expects

The complaint requirement looks small and is easy to skip. It should not be. An investigator responding to a patient complaint will usually ask what happened when the patient complained to the program first. If there is no written process, no designated person and no log, the program has nothing to show.

A workable complaint process has a written policy naming who receives Part 2 complaints, a log recording the date received, the issue, the response and the date closed, and language confirming the patient will not face retaliation. Check your intake packet as well. We still find admission agreements with broad “release and waiver” language that, read literally, asks patients to give up rights the rule says they cannot be required to waive.

Check your patient notice too. Older Part 2 notices typically told patients that violations were a crime and could be reported to the United States Attorney. A notice still carrying that language after February 16, 2026 is an easy signal to an investigator that the program has not implemented the new rule, even if everything else is in order.

The Enforcement File: What to Pull Together This Week

If HHS opened an inquiry tomorrow, these are the documents you would want in one folder. Pull them now and note every gap:

1. Current patient notice and Notice of Privacy Practices: the version in use, with the date it was adopted and evidence it replaced the pre-rule version by February 16, 2026.
2. Breach response policy: one that names Part 2 records explicitly, defines discovery the way the rule does, and states the 60-day outer limit.
3. Four-factor risk assessments: a completed, signed assessment for every privacy incident in the last 12 months, including incidents where you decided not to notify.
4. Small-breach log: every breach affecting fewer than 500 individuals during 2026, ready for the annual HHS submission. Sixty days after December 31, 2026 falls on March 1, 2027. Put that date in the compliance calendar today.
5. Complaint policy and log: including any complaint received since February 16, 2026 and how it was resolved.
6. Vendor inventory: every vendor with access to Part 2 records, the agreement in place (a qualified service organization agreement, a business associate agreement or both), and the incident notification terms in each contract.
7. Workforce training records: proof that staff were trained on the revised rule, with dates and attendee lists.

The HHS breach notification guidance describes the notice content and the reporting portal, and applies to Part 2 breaches through the new rule.

An Inconvenient Truth About “Low-Risk” Incidents

The incidents that cause the most trouble are rarely dramatic. They are misdirected faxes to a payer, discharge paperwork handed to the wrong family member, and a staff member reading a chart they had no reason to open. Each one feels too minor to escalate, which is exactly why they end up undocumented. A program that logs and assesses ten minor incidents a year is in a far stronger position than one that reports zero, because zero is not believable to anyone who has worked in a treatment setting.

If your program has not yet logged a single privacy incident since the rule took effect, treat that as a finding in itself. It usually means incidents are being handled informally, not that none occurred.

Getting the File Ready

Part 2 enforcement is now a HIPAA-style exercise, and HIPAA-style exercises reward documentation over intentions. If you want a second set of eyes on your breach and complaint file, our behavioral health compliance services team reviews Part 2 programs against the revised rule, and our fractional compliance officer service can own the incident log and annual HHS submission for you. Our HIPAA compliance checklist is a useful starting point for the HIPAA side of the same file.

Call us at (888) 458-6619 to talk through your current setup, or if an incident is already in front of you and the 60-day clock is running, call (888) 458-6619 today.