HHS Delegates Authority to OCR for Enforcement of Substance Use Disorder Patient Records Regulations

Strategic Insights -

The US Department of Health and Human Services (HHS) has delegated authority to the Office for Civil Rights (OCR) to administer and enforce the "Confidentiality of Substance Use Disorder Patient Records" (SUD) regulations, protecting the privacy of patients' SUD treatment records. This delegation comes after HHS modified the Part 2 Regulations in 2024 to implement Section 3221 of the CARES Act, aligning the Part 2 Regulations with HIPAA requirements. The amended regulations grant the public the ability to file complaints alleging violations and impose civil monetary penalties for non-compliance. OCR can now take on additional regulatory enforcement activity, including imposing penalties, entering into resolution agreements, and issuing subpoenas. The modified Part 2 Regulations apply to non-HIPAA-regulated entities and HIPAA-regulated entities providing substance use disorder services.

Key Takeaways:

  • The HHS has delegated authority to OCR to administer and enforce the SUD patient records regulations, effective August 27, 2025.
  • The amended Part 2 Regulations grant the public the ability to file complaints alleging violations and impose civil monetary penalties for non-compliance.
  • OCR can impose civil monetary penalties up to the same extent as HIPAA-regulated entities subject to penalties for HIPAA violations.
  • Non-HIPAA-regulated entities and HIPAA-regulated entities providing substance use disorder services must comply with the amended Part 2 Regulations by February 16, 2026.
  • Business associate agreements and qualified service organization contracts must include provisions addressing compliance with the Part 2 Regulations and HIPAA.
  • Part 2 programs must update their consent and authorization forms, policies, and procedures, as well as implement or amend their notice of privacy practices and breach response policies.
  • Compliance with the HIPAA Security Rule, including security risk analyses, is essential for Part 2 Programs and lawful holders that are also HIPAA-regulated entities in protecting Part 2 records from cyberattacks.

Statistics:

  • By February 16, 2026, non-HIPAA-regulated entities and HIPAA-regulated entities providing substance use disorder services must comply with the amended Part 2 Regulations.
  • The amended Part 2 Regulations grant the public the ability to file complaints alleging violations, effective August 27, 2025.
  • HHS has delegated authority to OCR to administer and enforce the SUD patient records regulations.

Sources:

  • US Department of Health and Human Services (HHS)
  • Federal Register
  • Holland & Knight (client alert)
  • Section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act
  • Health Insurance Portability and Accountability Act of 1996 (HIPAA)
  • Health Information Technology for Economic and Clinical Health (HITECH) Act
  • Substance Abuse and Mental Health Services Administration (SAMHSA)