The federal government’s recent finalization of the 42 CFR Part 2 final rule is a game-changing moment for the behavioral health field. Announced at the start of the month, this long-anticipated update is aimed at reconciling the historically strict privacy protections around addiction treatment data with the broader health data-sharing framework established under HIPAA. For decades, 42 CFR Part 2 has been praised for protecting patients but criticized for hampering innovation and care coordination. The 42 CFR Part 2 final rule attempts to modernize these regulations—bringing them closer in line with HIPAA—while maintaining critical patient protections.
Initially created in the mid-1970s, 42 CFR Part 2 was designed to shield patients with substance use disorders (SUDs) from the legal, social, and economic consequences of seeking treatment. The rule limited how and when providers could share addiction treatment records, requiring patient consent for virtually every instance of disclosure or redisclosure. While well-intentioned, these restrictions became increasingly incompatible with today’s integrated, data-driven approach to health care. The 42 CFR Part 2 final rule eliminates many of these roadblocks, making it easier for providers to share records for treatment, payment, and health care operations (TPO) using just a single patient consent. This change is expected to dramatically improve coordination between primary care, mental health, and addiction treatment providers.
However, with increased access comes increased responsibility. Under the 42 CFR Part 2 final rule, behavioral health providers now face a heightened compliance burden. Previously, enforcement of 42 CFR Part 2 was minimal—some experts suggest it was “hardly, if ever” enforced. That’s no longer the case. The federal government has now aligned enforcement with HIPAA, meaning providers that violate these new regulations could face the same civil and criminal penalties seen in the broader health care industry. The compliance deadline is April 16, 2026, giving behavioral health organizations a two-year window to prepare. Experts expect some leniency during the early implementation phase, but long-term compliance will be mandatory and closely monitored.
New Opportunities for Care Coordination and Integration
The changes brought by the 42 CFR Part 2 final rule reflect years of advocacy from across the behavioral health landscape. For many, this rule is not just about privacy—it’s about being able to fully participate in modern health care systems. The previous regulations under Part 2 often required the segregation of addiction treatment records from the rest of a patient’s medical file. This created technical and administrative burdens that made it nearly impossible for behavioral health providers to contribute to, or benefit from, integrated care systems like accountable care organizations (ACOs) and value-based care models. The 42 CFR Part 2 final rule removes the requirement to segment these records, allowing for the creation of unified patient records and smoother data exchange.
According to legal experts, while providers still need to ensure that records governed by Part 2 are identifiable and treated with heightened sensitivity, the elimination of record segmentation is a major win. It simplifies the administrative workload and enables providers to use shared electronic health records (EHRs) more efficiently. This can improve outcomes by giving providers a more comprehensive view of a patient’s medical and behavioral health history.
Rebecca Frigy Romine, a shareholder in the health care department at Polsinelli, noted that while some information management mandates still apply to Part 2 records, the benefits for care coordination will likely outweigh the investment in operational and technology resources. These changes open the door for SUD treatment providers to become more fully integrated into mainstream health care networks, improving patient care while reducing redundancy and miscommunication between providers.
Balancing Privacy with Access: The Trade-Offs
Despite the promise of improved care coordination, the 42 CFR Part 2 final rule has its critics. Patient advocacy groups like the Legal Action Center have voiced concerns that the updates weaken the very protections 42 CFR Part 2 was created to enforce. One major issue is that the new rule does not include the anti-discrimination protections mandated by the CARES Act, which Congress passed in 2020. This omission, according to advocates, leaves patients vulnerable to misuse of their data, especially in legal or employment contexts.
Additionally, the rule offers limited remedies if a breach occurs. Patients do not have a private right of action, and there is no clear path for suppressing improperly disclosed records. Jacqueline Seitz, Deputy Director of Health Privacy at the Legal Action Center, emphasized that while more sensitive data will now be in more places, the mechanisms to protect patients remain limited. Critics worry that this could discourage individuals from seeking treatment due to fears their information might be used against them.
Grady from Nixon Peabody highlighted the importance of balance—stressing that the expanded ability to share records must come with increased diligence in protecting them. Behavioral health providers are now held to the same enforcement standards as those under HIPAA, meaning penalties can be severe. As she put it, “When a law has more teeth, you’re going to have more compliance.”
What the Final Rule Includes
At the heart of the 42 CFR Part 2 final rule are several major changes:
- Single Consent for TPO: Patients can now consent once to allow the disclosure and limited redisclosure of their records for treatment, payment, and operations. This is a stark contrast to the prior model, which required consent for each disclosure.
- SUD Counseling Notes: A new type of record, similar to HIPAA’s psychotherapy notes, has been defined and must be treated with special sensitivity.
- Additional Patient Rights:
- Patients can request that providers withhold disclosures to payers if the services were paid for out-of-pocket.
- Disclosure and redisclosure must be auditable for up to three years following consent.
- Patients can request not to be solicited for fundraising purposes.
While the new rule still prohibits using addiction treatment records in legal or legislative proceedings without explicit patient consent or a court order, it does not go so far as to guarantee patients easy access to their own records. HHS stated that broader access to records falls outside the scope of this rulemaking, though entities also governed by HIPAA will still need to comply with HIPAA’s access provisions.
Preparing for Compliance
With the April 2026 compliance deadline on the horizon, behavioral health providers should start preparing now. This means investing in training, updating policies and procedures, and ensuring their technology vendors understand and can accommodate the new requirements. EHR systems will need to support the management of Part 2 records under these updated guidelines, and staff must be trained on what the 42 CFR Part 2 final rule means for their day-to-day operations.
The shift to align 42 CFR Part 2 with HIPAA is an important step toward greater integration, but it’s not without its risks. Providers will need to find a careful balance between seizing the opportunities for enhanced care and managing the responsibilities that come with handling sensitive addiction treatment records. Done right, the 42 CFR Part 2 final rule can lead to more comprehensive, compassionate, and coordinated care for individuals with substance use disorders.
But as with any regulatory overhaul, success will depend on implementation. Behavioral health organizations must treat this not as a compliance checkbox but as a chance to evolve how they deliver care. And most importantly, they must keep patient trust at the center of every decision. Because even as data sharing becomes easier, the potential consequences of misuse remain as serious as ever.
