Office for Civil Rights Announces Civil Enforcement Program for Confidentiality of Substance Use Disorder Patient Records

Landmark Enforcement Program for Substance Use Disorder Records Begins February 16, 2026

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) today announced a new program to implement and enforce statutory and regulatory requirements that protect the confidentiality of substance use disorder (SUD) patient records.  This program marks the first time civil enforcement mechanisms will be available to protect the confidentiality of SUD patient records by covered SUD programs.

“At President Trump’s direction, HHS is aggressively enforcing federal safeguards to protect substance use disorder patient records as part of the Great American Recovery Initiative,” said HHS Secretary Robert F. Kennedy, Jr.  “Americans seeking treatment for substance use disorder deserve comprehensive care without sacrificing their privacy or legal protections.”

The new program executes the SUD confidentiality provisions of section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act and its implementing regulation at 42 CFR part 2 (“Part 2”).  Beginning February 16, 2026, entities and persons subject to the regulation protecting the confidentiality of SUD patient records must comply with all applicable requirements.  The penalties for noncompliance align with the penalties available under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules.  OCR investigations conducted under the new program may be resolved through a range of civil enforcement mechanisms.  These include OCR entering into resolution agreements, securing monetary settlements, obtaining commitments for corrective action, or imposing civil money penalties for the failure to comply.

“OCR’s civil enforcement program will instill confidence in patients and encourage them to seek SUD treatment from covered SUD providers.  At the same time, compliance with the updated Part 2 regulation will improve care coordination and reduce administrative burdens,” said Paula M. Stannard, Director of the HHS Office for Civil Rights.  “OCR is uniquely positioned to enforce patient rights and the regulated community's obligations given our extensive experience administering compliance and enforcement programs for health information privacy, security, and breach notification under HIPAA.”

Beginning February 16, 2026, OCR will begin accepting:

• Complaints alleging violations of the regulation that protect the confidentiality of SUD patient records.
• Notification of breaches of SUD patient records.

OCR has also developed a model patient notice and updated its model HIPAA Notices of Privacy Practices for regulated entities to use in providing notice to patients on how federal law protects the confidentiality of SUD patient records.  Please visit OCR’s Part 2 webpage at www.hhs.gov/hipaa/part-2/index.html for more information and resources.

The announcement supports the national policy objectives of President Trump’s Executive Order 14379, Addressing Addiction Through the Great American Recovery Initiative.  Today’s announcement also complements HHS’ recent efforts to address substance use disorder and mental health issues through treatment, recovery, and self-sufficiency.  Section 3221 of the CARES Act aligns federal privacy standards for SUD records more closely with standards under HIPAA and the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009.  In February 2024, HHS published a final rule modifying the regulation at 42 CFR part 2 to implement the confidentiality provisions of section 3221 of the CARES Act.  This rule increases coordination among providers treating patients for SUDs; strengthens confidentiality protections through civil enforcement; aligns certain Part 2 requirements with the HIPAA Privacy and Breach Notification Rules; and enhances integration of behavioral health information with other medical records to improve patient health outcomes.

If you believe that your or another person’s health information privacy or civil rights have been violated, you can file a complaint with OCR.