Regulatory Update
The 42 CFR Part 2 Compliance Landscape
The HHS final rule modernizing 42 CFR Part 2 — the federal confidentiality standard for substance use disorder (SUD) records, updated as required by Section 3221 of the CARES Act — took effect April 16, 2024, with compliance required as of February 16, 2026. It aligns SUD-record protections with HIPAA, adds breach-notification requirements, and applies civil and criminal penalties, now enforced by the HHS Office for Civil Rights (OCR).
For any county that captures individual-level outcome data on the people its programs serve, this matters directly:
- The New Standard: Once you hold SUD records, Part 2 obligations attach — consent management, accounting of disclosures, and breach notification.
- The Risk: Civil and criminal penalties for SUD data violations are now aligned with HIPAA’s enforcement authorities.
- The Essentrify Shield: Most compliance-and-reporting tools were never built for this. Our Personal Abatement Record is being engineered around Part 2 from the start.
More Information
