OCR launches civil enforcement of 42 CFR Part 2
On February 13, 2026, ahead of the February 16, 2026 compliance date of the 2024 Part 2 final rule, HHS's Office for Civil Rights announced its civil enforcement program for the confidentiality of substance use disorder patient records. Part 2 breaches now follow HIPAA's breach notification requirements.
What changed. The 2024 final rule aligning 42 CFR Part 2 with HIPAA required compliance by February 16, 2026. OCR announced on February 13, 2026 that it will enforce Part 2 using HIPAA-style civil enforcement, replacing the old criminal-only penalties.
Who it affects. Federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment or referral — and organizations that receive their records. Notices of Privacy Practices were updated for the same compliance date.
What we updated. A new guide, 42 CFR Part 2: substance use disorder records and HIPAA, and links from the notice and breach notification pages.