HIPAA Notice of Privacy Practices for Addiction Treatment Centers

By NPP Generator Editorial Team  ·  Last reviewed Apr 28, 2026

Addiction treatment programs are subject to both HIPAA and 42 CFR Part 2. Under the 2024 Part 2 Final Rule, programs may now publish a single integrated HIPAA/Part 2 notice instead of maintaining two separate documents. The HHS February 2026 model incorporates this integration. This page explains when Part 2 applies, what the integrated notice must contain, and how to generate one.

Are you subject to 42 CFR Part 2?

Part 2 applies if your program is federally-assisted (receives federal funding, is authorized under federal law, is tax-exempt, or is licensed to dispense controlled substances for SUD treatment) and holds itself out as providing SUD diagnosis, treatment, or referral for treatment. Programs that satisfy both conditions are "Part 2 programs" and must comply with Part 2 confidentiality rules in addition to HIPAA.

Examples of Part 2 programs include:

• Opioid treatment programs (OTPs) / methadone clinics
• SAMHSA-certified inpatient and outpatient SUD treatment centers
• Office-based buprenorphine programs that hold themselves out as SUD-focused
• Specialized addiction treatment units within a general-medical hospital
• Hospital emergency rooms that hold themselves out as providing SUD treatment

General medical practices that occasionally treat SUD patients without holding themselves out as SUD specialists are not Part 2 programs, though they remain HIPAA covered entities. When in doubt, consult 42 CFR § 2.11 and § 2.12 or engage healthcare counsel.

How Part 2 differs from HIPAA

HIPAA permits disclosures for treatment, payment, and health care operations (TPO) without patient authorization. Part 2 does not. Under Part 2, nearly all disclosures of SUD patient records — even for treatment coordination with a referring physician — require written patient consent, with narrow exceptions (medical emergency, court order meeting Part 2 standards, research under § 2.52, audit and evaluation under § 2.53). Your integrated NPP must describe this stricter consent regime.

The 2024 Part 2 Final Rule: what changed

The 2024 Part 2 Final Rule (published February 2024, effective February 16, 2026) aligned Part 2 more closely with HIPAA while preserving the stronger consent framework. Key changes:

• Single-consent model. One written consent can now authorize all future TPO disclosures to identified recipients, similar to the HIPAA authorization framework — rather than requiring a separate consent for each disclosure.
• Integrated NPP permitted. Part 2 programs may now publish a single combined HIPAA + Part 2 notice instead of two separate documents.
• Breach notification alignment. Part 2 breach notification follows HIPAA Breach Notification Rule procedures.
• Enforcement alignment. SAMHSA and HHS OCR now enforce Part 2 violations using the HIPAA civil monetary penalty tiers.
• Patient right of access. Part 2 programs must provide patients access to their records consistent with the HIPAA right-of-access rules.

What the integrated NPP must include

A combined HIPAA + Part 2 NPP must include all standard HIPAA elements under 45 CFR § 164.520(b) (see NPP requirements 2026) plus Part 2-specific language covering:

• Notification that the program is subject to 42 CFR Part 2 and that SUD records receive additional protection
• The Part 2 consent framework — that most disclosures require written consent, including uses for TPO
• Exceptions where disclosure is permitted without consent (medical emergency, court order, research, audit, mandated child-abuse reporting)
• Patient rights specific to Part 2 (right to redact or revoke consent, right to request a list of Part 2 disclosures)
• The required prohibition-on-re-disclosure statement for any Part 2 record released
• Contact information for the program's designated Privacy Officer (may be the same person as the HIPAA Privacy Officer)

See our deeper explainer: NPP Part 2 SUD language — integrating 42 CFR Part 2 into your notice.

Distribution for Part 2 programs

• At admission: provide the NPP to each new patient at admission or first service delivery
• Website: post on the program website (required)
• Physical site: post prominently at the treatment facility
• Acknowledgment: make a good-faith effort to obtain written acknowledgment; document refusals in the patient record
• Re-distribution on material change: Part 2 programs must re-issue the NPP to active patients when it is materially revised, not only make it available to new intakes