The 42 CFR Part 2 SUD Deadline Was February 16: Is Your NPP Ready?

By NPP Generator Research Team  ·  Published Apr 27, 2026  ·  Last reviewed Apr 27, 2026  ·  7 min read

Why Part 2 Programs Faced a Double Deadline

Federal regulation under 42 CFR Part 2 protects records of patients in federally-assisted substance use disorder (SUD) treatment, diagnosis, or referral programs. These protections are separate from and stricter than HIPAA: redisclosure of Part 2 records generally requires patient consent, with very narrow exceptions for medical emergencies, audits, and court orders. Until the 2024 Part 2 Final Rule, a covered entity that was both a HIPAA covered entity and a Part 2 program had to maintain two separate notices — a HIPAA NPP and a Part 2-specific notice — covering the same patient interactions.

The 2024 Part 2 Final Rule (effective February 16, 2026) accomplished two things relevant to NPP compliance:

1. **Integration permitted.** A covered entity that is also a Part 2 program may now publish a single integrated notice covering both HIPAA and Part 2 patient rights and disclosure rules.

2. **Updated Part 2 redisclosure rules.** The Final Rule modernized Part 2's consent requirements for redisclosure, alignment with HIPAA where appropriate while maintaining stricter Part 2-specific protections for SUD records.

For combined entities, the February 16, 2026 deadline meant adopting both the HHS revised HIPAA NPP model and the Part 2-integrated structure simultaneously. For Part 2-only programs (programs that aren't HIPAA covered entities — rare today), the deadline meant adopting the Part 2 Final Rule's notice updates.

Who Counts as a "Part 2 Program"

42 CFR Part 2 covers federally-assisted SUD treatment, diagnosis, or referral programs. "Federally assisted" includes programs receiving federal funding (SAMHSA grants, federal CMS reimbursement), federally licensed (DEA-registered methadone clinics), or operated by a federal entity. The relevant question is operational: does the program hold itself out as providing SUD diagnosis, treatment, or referral, and does it receive any form of federal assistance?

Common Part 2 programs:

- Outpatient SUD treatment centers - Residential SUD treatment facilities (rehabs) - Methadone and opioid treatment programs (OTPs) - Detox programs - SUD-focused mental health practices - Hospital SUD treatment units (separately identifiable)

A general medical practice that occasionally treats SUD as part of broader primary care typically isn't a Part 2 program — Part 2 applies to programs holding themselves out as SUD-focused. The line is operational, not patient-by-patient.

A practice that's unsure of its status should review its provider type, its federal funding sources, and whether it operates a separately identifiable SUD program. For ambiguity, the safer default is to treat the practice as Part 2-covered for the SUD aspects of its services.

Combined HIPAA + Part 2 Entities: The Integrated Notice Path

Most practices that are both HIPAA covered entities and Part 2 programs benefit from the integrated notice option introduced by the 2024 Final Rule. The integrated notice:

- Covers HIPAA Privacy Rule rights and obligations (the standard NPP content under § 164.520(b)) - Adds Part 2-specific language: redisclosure restrictions for SUD records, the patient consent requirement for non-emergency disclosures, and the limited exceptions - Uses a single contact point (typically the practice's Privacy Officer) for both HIPAA and Part 2 inquiries - Operates under a single distribution mechanism (intake at first service, website posting, physical posting)

This is operationally simpler than maintaining two notices. NPP Generator's "Combined HIPAA + Part 2" entity-type option produces an integrated notice using the HHS February 2026 model with Part 2 language integrated.

The integrated notice doesn't change the substantive Part 2 protections. Patient consent is still required for redisclosure of SUD records (with narrow exceptions); the integrated notice describes that requirement in patient-facing language. The substantive Part 2 obligations live separately in the practice's operational policies.

Part 2-Only Programs

A small number of Part 2 programs are not HIPAA covered entities (e.g., a privately funded SUD program with no Medicare/Medicaid reimbursement and no other HIPAA-covered functions). These programs still need a Part 2-specific notice covering Part 2's patient rights and disclosure rules — but they don't need a HIPAA NPP separately.

For Part 2-only programs, the February 2026 deadline meant updating to the Part 2 Final Rule's revised notice content. NPP Generator's "Part 2 program" entity-type option produces a Part 2-focused notice without the HIPAA-specific content. Most modern SUD programs are HIPAA covered entities (because they bill Medicaid, accept commercial insurance, or are part of larger health systems), so the combined-entity path is by far the more common scenario.

SAMHSA Enforcement vs. OCR Enforcement

Part 2 violations are enforced by SAMHSA, not by HHS OCR. This matters because the enforcement frameworks operate independently:

**OCR enforcement** of HIPAA Privacy Rule violations (including NPP non-compliance under § 164.520) follows the tiered CMP structure under § 160.404. See OCR penalties for missing the February 2026 NPP deadline.

**SAMHSA enforcement** of Part 2 violations follows a separate process. Part 2 violations can result in civil penalties under SAMHSA's authority and, in cases involving criminal conduct (unauthorized disclosure of Part 2 records), criminal penalties. The SAMHSA enforcement record is less voluminous than OCR's but is real.

For combined HIPAA + Part 2 entities, an integrated NPP with both HIPAA and Part 2 language can be reviewed under both regimes. A non-compliant integrated notice could be reviewed by OCR for HIPAA Privacy Rule violations and by SAMHSA for Part 2 notice violations. Practices in this category should treat the deadline catch-up with extra urgency.

Part 2 Consent for Redisclosure: Separate from NPP Distribution

One distinction that's easy to miss: the NPP distribution requirement and the Part 2 consent requirement are separate obligations.

**NPP distribution.** The NPP is provided to patients at first service delivery, posted on the website, and posted at physical sites. It's a one-way disclosure of the practice's privacy practices to the patient.

**Part 2 consent.** When a Part 2 program wants to disclose SUD records to anyone outside the program (including subsequent treating providers, insurance companies for billing, and family members), it generally needs the patient's written consent. This is a separate document, executed at the time of disclosure, not bundled into the NPP.

The integrated NPP describes the Part 2 consent requirement (so patients know it exists), but the NPP itself is not the consent document. Practices catching up on Part 2 compliance need to address both: the integrated notice updated and properly distributed, and the operational consent forms used at the time of disclosure.

For broader context on the Part 2 Final Rule's changes, see NPP Part 2 SUD language guide. ComplyCreate's 2026 HIPAA changes roundup covers the broader regulatory context including the Part 2 Final Rule.

Part 2 programs face a higher-stakes catch-up because Part 2 violations carry SAMHSA's separate enforcement layer on top of OCR's HIPAA enforcement. The integrated notice path under the 2024 Final Rule simplifies the document structure; the operational obligations remain. NPP Generator's combined-entity flow produces the integrated notice in 5 minutes; the Part 2 consent forms and operational policies are separate work that lives in your compliance manual.