Countdown to Compliance: SUD Treatment Privacy Regulations Modernization

Substance use disorder (SUD) treatment providers should ensure they are prepared by February 16, 2026, to meet the upcoming compliance requirements for handling SUD treatment patient records.

What do I need to do?

If you are an SUD treatment provider, there are three things you should ensure you have ready to go:

1. Update Consent Forms and Notice Accompanying Disclosure: The changes require updates to the patient consent form and the notice to accompany disclosure of information. The Center for Excellence for Protected Health Information (PHI) has provided a sample patient consent form, as well as a resource on revising the accompanying notice to assist with those necessary updates.
2. Update Policies/Procedures: Clinicians and staff should educate patients about newer, stricter confidentiality protections to ensure they are aware of their options. SUD counseling notes must now be separated from the rest of the patient’s record and a Part 2 program may not require a patient to authorize disclosure of SUD counseling notes. Click here to learn more about updated requirements for SUD counseling notes.
3. Ensure Readiness for Enforcement: Mandatory compliance begins on February 16, 2026. Practically, this means that SAMHSA and DOJ are no longer jointly enforcing Part 2 requirements. The HHS Office for Civil Rights (OCR) will take over enforcement activities and may now enforce civil monetary penalties for failure to comply with obligations. Noncompliance, therefore, presents serious financial risks.

Why are these changes happening now?

These changes are the result of the finalization of federal rules for Part 2 programs to improve care coordination while maintaining strict patient confidentiality. A fact sheet on the major changes to the rules can be found here.

Additional Information

For additional information, click here or visit the Center for Excellence for Protected Health Information’s resource hub.