02/13/2026
š When Was the Last Time You Looked at Your Forms?
Healthcare laws evolve.
Regulations shift.
But forms? They often sit quietly⦠unchanged for years.
One of the most overlooked compliance risks in a medical practice is an outdated Notice of Privacy Practices (NPP).
With updated federal regulations governing substance use disorder (SUD) treatment records under 42 C.F.R. Part 2, effective February 16, 2026, now is the time to take a careful look at your privacy language.
Not because anyone did something wrong.
Because the law changed.
š§ Why This Law Exists
42 C.F.R. Part 2 was created in the 1970s to protect individuals seeking treatment for substance use disorders. At the time, stigma was severe ā people feared job loss, arrest, or discrimination if their treatment became known.
So the federal government created stronger confidentiality protections than HIPAA.
Fast forward to modern healthcare: integrated care, shared electronic records, coordinated treatment teams.
The CARES Act began aligning Part 2 more closely with HIPAA. The final harmonizing rule takes effect February 16, 2026.
Now:
⢠Patients may sign a single written consent allowing use and disclosure for treatment, payment, and healthcare operations (TPO).
⢠Once disclosed pursuant to that consent, records may be redisclosed consistent with HIPAA.
⢠Anti-discrimination protections are strengthened.
⢠Civil and criminal penalties apply for improper use.
The purpose is better care coordination ā while still protecting patient privacy.
š What This Update Does ā and Does NOT Do
āļø It updates confidentiality rules regarding the sharing of SUD treatment information when proper written consent is obtained.
ā It does NOT change prescribing laws.
ā It does NOT reduce documentation requirements.
ā It does NOT eliminate monitoring safeguards for controlled substances.
This rule addresses privacy and information sharing, not compliance with prescription regulations.
š Documentation Still Required
Practices prescribing controlled substances (including MAT medications, opioids, stimulants, benzodiazepines, etc.) must still maintain appropriate safeguards such as:
⢠Signed controlled substance agreements
⢠Documentation of checking the state Prescription Drug Monitoring Program (PDMP)
⢠Documentation of PDMP queries prior to prescribing
⢠Urine drug screening agreements and documentation of results
⢠Pill counts when clinically appropriate
⢠Treatment plans and ongoing risk assessments
⢠Documentation of medical necessity
⢠Informed consent for risks, side effects, and alternatives
⢠Tapering or discontinuation plans when indicated
Privacy compliance and prescribing compliance are two separate lanes. Both matter.
āļø Language to Add to Your Existing NPP
For practices that do not want to rewrite their entire Notice of Privacy Practices, this paragraph may be inserted under your āUses and Disclosuresā section.
Because this is new regulatory language, it should be included in bold type within your NPP to clearly inform patients of the updated protections and permissions.
Special Confidentiality Protections for Substance Use Disorder Records:
Certain records relating to substance use disorder diagnosis, treatment, or referral may be protected under federal law (42 C.F.R. Part 2). Effective February 16, 2026, federal regulations permit the use and disclosure of such records for treatment, payment, and healthcare operations with a single written patient consent. Redisclosure of these records is permitted in accordance with HIPAA unless otherwise restricted by law. Unauthorized disclosure may subject the disclosing party to civil and criminal penalties under federal law.
š Practical Takeaway
This is a good moment to:
⢠Review your Notice of Privacy Practices
⢠Update Part 2 language
⢠Confirm your redisclosure warnings
⢠Review your consent forms
⢠Ensure prescribing documentation protocols remain strong
Compliance is maintenance, not panic.
If youāre unsure whether your forms reflect the 2026 changes, now is the time to look ā not after an audit.