WASHINGTON – The U.S. Department of Health and Human Services has launched a new federal program designed to crack down on the illegal release of confidential records related to substance use disorder treatment.
The initiative gives HHS’ Office for Civil Rights the authority to investigate violations of federal confidentiality rules known as 42 CFR Part 2 and to impose civil monetary penalties when organizations fail to comply. The agency has also created a new online portal for reporting breaches and filing complaints.
Beginning Feb. 16, 2026, the Office for Civil Rights will begin accepting complaints alleging violations of regulations protecting the confidentiality of substance use disorder patient records, as well as formal notifications of data breaches involving those records.
“Americans seeking treatment for substance use disorder deserve comprehensive care without sacrificing their privacy or legal protections,” HHS Secretary Robert F. Kennedy Jr. said in a statement.
The “Part 2” rules apply to federally assisted programs that provide substance use disorder diagnosis, treatment or referrals. The requirements also extend to other entities that receive those records, including healthcare providers, qualified service organizations, HIPAA-covered entities and business associates, as well as intermediaries and investigative agencies.
In 2024, HHS finalized rule changes aligning Part 2 more closely with HIPAA and the HITECH Act. The goal was to improve care coordination for patients with substance use and behavioral health conditions while maintaining strong privacy protections.
Historically, Part 2 imposed stricter consent requirements than HIPAA for the use and disclosure of treatment records. Under the updated framework, the public can now file complaints directly with the Office for Civil Rights, and Part 2 programs are required to report breaches.
Still, some privacy experts question whether the enforcement office has the resources to take on the expanded role.
“For years OCR has been seeking additional budget and staffing,” privacy attorney Adam Greene told bankinfosecurity.com. “Instead, they have been decimated by recent staffing cuts. Between these cuts, the addition of Part 2 and an agency focus on other Trump administration priorities, I expect that OCR investigations will take significantly longer to resolve over the coming years.”
“OCR does not have the staff or funding to expand its expertise to SUD operations,” added privacy attorney David Holtzman, a former senior advisor at HHS OCR.
