Compliance Deadline for 42 CFR Part 2 Amendments is Looming: Preparing for Changes to Patient Rights

Healthcare organizations that provide substance use disorder (SUD) services should review their Notice of Privacy Practices and take steps to ensure compliance with new patient rights requirements before the February 16, 2026, compliance deadline for recent amendments to 42 CFR Part 2.

42 CFR Part 2 is a federal law that protects the confidentiality of patients’ substance use disorder (SUD) information. As summarized in previous Pulse Check alerts (Part 1 and Part 2), 42 CFR Part 2 underwent significant amendments in a Final Rule published on February 16, 2024, by the U.S. Department of Health and Human Services (HHS).

Summary of Key Changes: Patients Rights

Below is a summary of key changes to patient rights and takeaways to help protect your organization.

• Notice of Privacy Practices: The amendments require regulated entities to provide patients with a comprehensive Notice of Privacy Practices informing them of how their SUD information may be used or disclosed; their rights with respect to their SUD information; and how to file a complaint concerning a privacy or security violation. The notice must contain specific language in order to comply with 42 CFR Part 2.

Takeaway: You may develop a standalone Notice for your Part 2 program or update your HIPAA-compliant Notice of Privacy Practices to include the Part 2 language that is not required by HIPAA.

• New Patient Rights: The amendments provide patients with new rights related to the use of their SUD information. These rights closely mirror those patients already have under HIPAA regarding protected health information. For example, patients have a right to request an accounting of disclosures made by a regulated entity with the patient’s consent over the past three years. Patients also have a right to request restrictions on disclosures made with prior consent for treatment, payment, or healthcare operations purposes. While regulated entities are only required to agree to these requests for restrictions on disclosures in narrow circumstances, they should make reasonable efforts to comply with a request to the extent feasible.

Takeaway: Update and align your internal policies and procedures to account for the new patient rights afforded by Part 2. Train and educate key stakeholders within your workforce to ensure that these patient rights are honored.

• Complaint Process: The amendments now require regulated entities to establish a process for handling patient complaints about potential Part 2 violations. Regulated entities may not retaliate against any patient for making a complaint or otherwise exercising their rights under Part 2.

Takeaway: Make sure your Notice of Privacy Practice clearly informs patients of how to file a complaint with your organization. Adopt a written policy for handling complaints internally and be sure to remind employees of the rules against retaliation.

The Woods Rogers Pulse Check offers concise, timely insights on emerging trends and key developments in healthcare law—keeping you informed and ahead of change. Our multidisciplinary team understands the complexities of the healthcare industry and provides strategic legal guidance tailored to your needs. Whether you're facing a challenging compliance issue, a critical business transaction, a government investigation, or potential litigation, we deliver clear, coordinated solutions. With deep experience in regulatory, transactional, and litigation matters, our attorneys work collaboratively to help healthcare organizations navigate risk and move forward with confidence. 

Want the latest healthcare updates delivered directly to your inbox? Sign up for our Health Law mailing list.