The federal privacy rule for addiction treatment records now works more like HIPAA

The short version

Records from substance use disorder treatment have their own federal privacy rule, known as 42 CFR Part 2. In February 2024, the U.S. Department of Health and Human Services (HHS) issued a final rule that brings Part 2 closer to HIPAA, the general health privacy law. The rule took effect on April 16, 2024, and programs had until February 16, 2026 to comply with most provisions.

What the law does

The final rule was published in the Federal Register on February 16, 2024, at 89 FR 12472. It carries out section 3221 of the CARES Act, which Congress passed in 2020. HHS also used the rule to make other changes that increase alignment with the HIPAA Privacy Rule.

The main changes:

• Consent. A patient can now give a single consent that covers all future uses and disclosures of their records for treatment, payment, and health care operations.
• Breach notification. Breach notification requirements from the HITECH Act, which already apply to HIPAA, now apply to breaches of Part 2 records.
• Penalties. Part 2 now uses HIPAA's civil and criminal enforcement structure.

What changes

For treatment programs, the February 16, 2026 compliance date for most provisions has passed. Programs covered by Part 2 are expected to be following those provisions now.

For patients, the biggest practical change is consent. One signed consent can let a Part 2 program share your records for those purposes with your providers, health plans, and people helping to run the program. The form must name an expiration date or event, and for these purposes "none" is allowed. You can revoke it in writing, except for anything already done in reliance on it. A HIPAA-covered provider or plan, or its business associate, that receives the records can reuse and share them again as HIPAA allows, and the form must warn you that shared records may no longer be protected by Part 2. The records still cannot be used against you in a civil, criminal, administrative, or legislative proceeding on the strength of this consent. That can make coordinated care easier. It also means records may travel further on the strength of one form. Read what you sign.

The penalty and breach changes mean that mishandling these records now carries consequences modeled on HIPAA's.

What it does not show

The rule does not set any requirements for artificial intelligence. Its summary of changes says nothing about training or running AI models on substance use treatment records. The one mention of AI we found in the notice is in a public comment warning that AI is getting better at re-identifying patients from de-identified data.

The link between this rule and AI is our framing, not the rule's. It matters because AI tools covered in this library, such as the hospital screener that reads health records, work on data that may include substance use information. Whether and how Part 2 applies to a particular AI use is a legal question for counsel.

This entry summarizes the Federal Register notice. It does not cover every provision, and it is not legal advice.

Why it matters

Under the 2024 rule, Part 2 is still a separate rule. What changed is how it works day to day, which is now closer to HIPAA.

If you are in recovery, the single consent is the part to understand. It is the point where you decide how widely your treatment records can be shared.

For programs and developers, the stronger breach and penalty rules raise the stakes on any system, AI or not, that stores or processes these records.