NPP Part 2 SUD Language: Integrating 42 CFR Part 2 into Your Notice

How and when to integrate 42 CFR Part 2 substance use disorder record language into your HIPAA Notice of Privacy Practices under the HHS February 2026 model.

By NPP Generator Research Team  ·  Published Feb 22, 2026  ·  Last reviewed Apr 28, 2026  ·  3 min read

What Part 2 adds on top of HIPAA

42 CFR Part 2 is a separate federal confidentiality framework for substance use disorder records, originally enacted in 1975 and significantly revised in 2024. Where HIPAA sometimes permits disclosures without patient consent (for example, to other treating providers for treatment coordination), Part 2 generally requires written patient consent — even for disclosures HIPAA would allow. It is more restrictive.

Who is subject to Part 2

Part 2 applies to "federally-assisted programs" that "hold themselves out as providing, and provide, SUD diagnosis, treatment, or referral for treatment." Three components:

• Federally assisted: receiving any federal funding, Medicare/Medicaid reimbursement, SAMHSA grants, IRS tax-exempt status, or other federal benefit. Almost every practice qualifies.
• Program: an individual or entity, or identifiable unit within a general medical facility, that provides SUD-related services.
• Holds itself out: the practice advertises or otherwise represents itself as providing SUD services. General primary-care practices that occasionally screen for SUD without specializing are not Part 2.

The 2024 Final Rule: combined notice permitted

Before 2024, entities subject to both HIPAA and Part 2 had to maintain two separate notices. The 2024 Final Rule (effective for compliance Feb 16, 2026) permits a single integrated Notice of Privacy Practices that covers both frameworks. This is the core rationale for the HHS February 2026 model revisions.

Required Part 2 content in the combined NPP

• Written-consent requirement. State that SUD records disclosures generally require written patient consent meeting Part 2s specific form requirements.
• Redisclosure prohibition. State that recipients of Part 2 records may not re-disclose them except as permitted by the original consent or federal law.
• Court-order protection. State that Part 2 records may not be used in criminal proceedings against the patient without a special court order meeting § 2.64 or § 2.65 standards.
• Breach notification for Part 2. The 2024 rule extends HIPAA-like breach notification to Part 2 records.

Practical example

A licensed SUD treatment program in California treats a patient with opioid use disorder. The patients primary-care doctor asks for the treatment records to coordinate medication. Under HIPAA alone, the SUD program could share (treatment purpose). Under Part 2, the program needs written patient consent specifying the primary-care recipient before sharing — even for the same treatment-coordination purpose.

First-time question? See if your practice actually needs an NPP: Does my practice need a Notice of Privacy Practices? →