Feb. 16 Deadline Nears for SUD Provider Compliance With Final Rule on 42 CFR Part 2: Notice of Privacy Practices

In April 2024, the U.S. Department of Health and Human Services (HHS) issued a final rule on 42 CFR Part 2 that modified the Notice of Privacy Practices (NPP) requirements related to the confidentiality of substance use disorder (SUD) treatment records to align with other HHS regulations.

The new NPP requirements apply to any HIPAA covered entity that creates or maintains protected health information (PHI) that is also a record of SUD treatment provided by a Part 2 program. In addition to ensuring compliance with the protections of Part 2, such entities must update their NPP no later than February 16, 2026, to comply with the updated rules.



The National Council for Mental Wellbeing is developing a list of resources to help providers make the necessary changes to their NPP to comply with the final rule. As soon as it is complete, RCPA will distribute it.

In the meantime, there are several resources online that help to explain the change and compliance with it, including this Patient Notice Template from the Center of Excellence for Protected Health Information, which provides a framework that Part 2 programs may adapt to reflect their particular policies and practices. It reflects the 2024 Final Rule’s amendments to Section 2.22 of 42 CFR Part 2.