Part 2, aligned: what the 2024 final rule actually changed

What the 2024 rule actually changed

The 2024 final rule pulled 42 CFR Part 2 into alignment with HIPAA on four fronts: a single patient consent can now authorize future disclosures for treatment, payment, and health care operations; civil and criminal penalties moved to HIPAA's enforcement structure; the HIPAA Breach Notification Rule now covers Part 2 records; and patients gained HIPAA-style rights to an accounting of disclosures and to request restrictions 1Ref 1U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.The four alignment changes in the 2024 final rule and the February 16, 2026 compliance date: single TPO consent, HIPAA-aligned penalties, breach notification, and new patient rights.. The compliance date was February 16, 2026, so these are live rules, not proposals 1Ref 1U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.The four alignment changes in the 2024 final rule and the February 16, 2026 compliance date: single TPO consent, HIPAA-aligned penalties, breach notification, and new patient rights..

The single-consent change is the one a practice feels first, because it rewrites the consent form and the front-desk workflow around it. The rest — penalties, breach notice, patient rights — mostly imports machinery you already run for HIPAA, so the compliance lift for a solo practice is smaller than the rule's length suggests 1Ref 1U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.The four alignment changes in the 2024 final rule and the February 16, 2026 compliance date: single TPO consent, HIPAA-aligned penalties, breach notification, and new patient rights..

Single consent, then redisclosure under HIPAA

The headline change is consent architecture. Before 2024, a Part 2 patient generally had to consent to each disclosure and name each recipient narrowly. Now one written single consent can authorize all future uses and disclosures for treatment, payment, and health care operations at once 2Ref 2Substance Abuse and Mental Health Services Administration (2024).Confidentiality of Substance Use Disorder (SUD) Patient Records.The operative text of the single-consent authorization for future TPO disclosures and the disclosure-accounting obligation as published in the final rule.. A recipient that is a HIPAA covered entity or business associate may then redisclose those records under HIPAA's rules, with limited exceptions the rule preserves 1Ref 1U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.The four alignment changes in the 2024 final rule and the February 16, 2026 compliance date: single TPO consent, HIPAA-aligned penalties, breach notification, and new patient rights..

That is a real simplification for a practice that coordinates care, but it does not lower the wall. The patient still has to sign; the consent still has to meet Part 2's content requirements; and the redisclosure freedom runs only to recipients who are themselves bound by HIPAA. What the consent form must now say changed alongside the scope — the part 2 consent picked up new elements to match this broader authorization, so a form drafted before 2026 should be re-reviewed rather than reused 1Ref 1U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.The four alignment changes in the 2024 final rule and the February 16, 2026 compliance date: single TPO consent, HIPAA-aligned penalties, breach notification, and new patient rights..

Penalties and breach notice now mirror HIPAA

Enforcement moved onto HIPAA's rails. Violations of Part 2 are now subject to the same civil monetary penalties and criminal penalties that apply to HIPAA violations, replacing Part 2's older criminal-fine scheme 1Ref 1U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.The four alignment changes in the 2024 final rule and the February 16, 2026 compliance date: single TPO consent, HIPAA-aligned penalties, breach notification, and new patient rights.. Separately, the HIPAA Breach Notification Rule now reaches Part 2 records, so a breach of SUD records triggers the same notice obligations to patients, HHS, and — above the threshold — the media 1Ref 1U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.The four alignment changes in the 2024 final rule and the February 16, 2026 compliance date: single TPO consent, HIPAA-aligned penalties, breach notification, and new patient rights..

Practically, a solo practice that already runs a HIPAA breach-response process does not need a second, parallel one for its SUD records; the single process now covers both. It also means OCR's enforcement posture, penalty tiers, and audit expectations reach Part 2 conduct, so the safeguards and documentation you keep for HIPAA carry straight over. The upside of alignment is fewer separate rulebooks to track; the flip side is that a Part 2 lapse now carries HIPAA-scale exposure 1Ref 1U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.The four alignment changes in the 2024 final rule and the February 16, 2026 compliance date: single TPO consent, HIPAA-aligned penalties, breach notification, and new patient rights..

New patient rights: accounting and restriction

Part 2 patients gained two HIPAA-style rights they did not clearly have before. They can request an accounting of disclosures made from their SUD records, and they can request restrictions on certain uses and disclosures, mirroring the individual rights already in the Privacy Rule 1Ref 1U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.The four alignment changes in the 2024 final rule and the February 16, 2026 compliance date: single TPO consent, HIPAA-aligned penalties, breach notification, and new patient rights.. The final rule also added a patient right to a copy of the program's notice of privacy practices describing Part 2's specific protections 1Ref 1U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.The four alignment changes in the 2024 final rule and the February 16, 2026 compliance date: single TPO consent, HIPAA-aligned penalties, breach notification, and new patient rights..

For a small practice the operational task is modest but real. Your notice of privacy practices has to describe these Part 2 rights, and you need a way to log disclosures so you can produce an accounting on request. Build the disclosure log into your release-of-information workflow rather than reconstructing it after a request lands — the day a patient asks, a running log turns a scramble into a lookup, and the same record answers an OCR inquiry 2Ref 2Substance Abuse and Mental Health Services Administration (2024).Confidentiality of Substance Use Disorder (SUD) Patient Records.The operative text of the single-consent authorization for future TPO disclosures and the disclosure-accounting obligation as published in the final rule..

What did not change: no record without consent or a court order

The wall is still a wall. Part 2's foundational rule survived 2024 intact: a covered program may not disclose that a person is or was a patient — or any patient-identifying SUD record — without the patient's consent or a qualifying court order 3Ref 3Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The unchanged core rule — no disclosure without consent or a qualifying court order, limits on use in legal proceedings — and the 'program' test that determines applicability.. The bar on using Part 2 records against the patient in criminal proceedings without a special court order also remains, which is why sud records in court are handled differently from an ordinary chart 3Ref 3Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The unchanged core rule — no disclosure without consent or a qualifying court order, limits on use in legal proceedings — and the 'program' test that determines applicability..

• A subpoena alone is not enough to compel Part 2 records; a Part 2-specific court order is required.
• Redisclosure by a lawful recipient does not erase the record's origin as SUD treatment information.
• The consent or a court order rule governs even when HIPAA would otherwise permit the disclosure.

The net effect is that the 2024 rule made Part 2 easier to administer without weakening its core promise to the patient. If your practice never held itself out as SUD treatment, most of this may not reach you — which is the next question to settle 3Ref 3Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The unchanged core rule — no disclosure without consent or a qualifying court order, limits on use in legal proceedings — and the 'program' test that determines applicability..

Does Part 2 even reach my private practice?

Most solo therapists are not Part 2 programs — but some are, and the test turns on how you hold out your services, not your license. Part 2 attaches to a 'program' that is federally assisted and holds itself out as providing SUD diagnosis, treatment, or referral 3Ref 3Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The unchanged core rule — no disclosure without consent or a qualifying court order, limits on use in legal proceedings — and the 'program' test that determines applicability.. A general psychotherapy practice that occasionally treats a client with a substance problem usually falls outside it; a practice advertised as addiction treatment may fall inside 3Ref 3Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The unchanged core rule — no disclosure without consent or a qualifying court order, limits on use in legal proceedings — and the 'program' test that determines applicability..

The full applicability test — part 2 and the private practice — deserves its own read, as does the part 2 consent your practice would need if it does apply. If you are unsure whether you are a program, treat the analysis as a threshold decision to make before you build your release-of-information forms, not after: the answer determines which consent language, which redisclosure limits, and which court-order rules apply to every SUD record you touch.