You’ve probably heard of HIPAA. Its lesser-known cousin, 42 CFR Part 2, protects the confidentiality of substance use disorder (SUD) treatment records, and it just got a major update. The new rule was finalized in February 2024, and the deadline to comply is February 16, 2026.
For most employers, this is a “good to know” item rather than a to-do. But if you sponsor a self-funded plan, it’s worth a closer look. Here’s the plain-English version.
What is 42 CFR Part 2?
Part 2 is a federal rule that protects records created by federally assisted substance use disorder treatment programs: addiction treatment centers, certain clinics, and similar providers. The extra-strong protections exist to encourage people to get help without worrying that their treatment records will be used against them.
For years, Part 2 was stricter than HIPAA and ran on its own separate track, which made it hard to move SUD records through the health care system. The 2024 update brings Part 2 much closer to the HIPAA framework everyone already knows.
What changed
- One consent can cover future disclosures. A single patient consent can now permit future uses and disclosures for treatment, payment, and health care operations, similar to HIPAA.
- Breach notification now applies. Breaches of Part 2 records follow the same HIPAA breach notification requirements as other protected health information.
- Patients gain HIPAA-style rights. These include the right to an accounting of disclosures and the right to request restrictions on certain disclosures.
- Extra protection for SUD counseling notes. Much like psychotherapy notes under HIPAA, these generally require a separate, specific consent.
- Limits on use in legal proceedings. Part 2 records generally can’t be used against a patient in civil, criminal, or administrative proceedings without consent or a court order.
- Updated privacy notices. Entities that create or maintain Part 2 records must refresh their Notice of Privacy Practices.
Who actually has to do something?
This is the important part for employers. The rule places obligations on two groups:
- Part 2 programs – the substance use disorder treatment providers themselves; and
- HIPAA covered entities that receive or maintain Part 2 records, even if they aren’t themselves a Part 2 program.
If you sponsor a fully insured group health plan, you are generally not a Part 2 program and likely have no direct obligation here. Your insurance carrier handles the compliance work, so for you this is mostly awareness.
The wrinkle for self-funded plans
Here’s where self-funded (self-insured) employers should pay attention. A self-funded group health plan is itself a HIPAA covered entity. If your plan receives or maintains substance use disorder records – for example, while processing or reviewing claims – it could fall into that second group above.
If that sounds like your plan, a few reasonable steps:
- Review and, if needed, update your Notice of Privacy Practices before February 16, 2026.
- Confirm your consent and disclosure practices for any SUD records line up with the updated rule.
- Check in with your TPA, PBM, or other business associates, since they usually handle these records day to day.
For many self-funded plans, the practical move is a quick conversation with your TPA and benefits counsel to confirm whether your plan actually touches SUD records and whether your paperwork needs a refresh.
The bottom line
Fully insured? This is a development to be aware of, not a project. Self-funded? Take a few minutes to confirm whether the rule reaches your plan, and update your privacy notice if it does, well before the February 16, 2026 deadline.
Sources: HHS Fact Sheet: 42 CFR Part 2 Final Rule; Federal Register final rule (Feb. 16, 2024); Snell & Wilmer: Action Required by February 16, 2026.