Summary
Aligns Part 2 confidentiality requirements more closely with HIPAA/HITECH pursuant to the CARES Act, allowing a single consent for future treatment, payment and health care operations uses and disclosures, and harmonizing breach-notification and enforcement provisions. The rule protects records in legal proceedings; HHS stated that CARES Act antidiscrimination provisions would be implemented in a separate rulemaking.
Healthcare Implications
AI analytics and decision support using covered SUD records must follow applicable Part 2 consent, redisclosure and legal-proceeding restrictions. Under 42 CFR 2.12(d)(2)(i)(C), a Part 2 program, covered entity or business associate receiving records under a single consent for treatment, payment and health care operations is not required to segregate or segment those records. Compliance with the 2024 final rule was required by February 16, 2026.