Elizabeth Barry Heddleston

Under recent amendments, regulated entities that violate 42 CFR Part 2 – the federal law protecting the confidentiality of patients’ substance use disorder (SUD) information – now face expanded civil and criminal penalties, along with other enhancements to the enforcement process. Regulated entities should be prepared for increased legal exposure as federal regulators gain new enforcement authority.

Healthcare organizations that provide substance use disorder (SUD) services should review their Notice of Privacy Practices and take steps to ensure compliance with new patient rights requirements before the February 16, 2026, compliance deadline for recent amendments to 42 CFR Part 2. 42 CFR Part 2 is a federal law that protects the confidentiality of patients’ substance use disorder (SUD) information.

October 22, 2025 To embed, copy and paste the code into your website or blog: Entities regulated by the Health Insurance Portability and Accountability Act continue to face uncertainty regarding the fate of the HIPAA Privacy Rule to Support Reproductive Health Care Privacy, following a decision from the U.S. District Court for the Northern District of Texas that struck down most of the reproductive health rule in Purl v. U.S. Department of Health and Human Services on June 18.