If you got into this field because you LOVE paperwork, you’ll be thrilled to learn about a new document update that may apply to you.

The law that applies to the records of substance abuse clients – 42 CFR Part 2 and sometimes just called “Part 2” – was updated in 2024, with compliance dates in February of 2026. As of 2/16/26, some clinicians must now update their Notice of Privacy Practices (NPP) to include details about substance use disorder (SUD) client records.

“Huh?” Let me back up and answer your questions.

“Who needs to give out NPPs?” All HIPAA “Covered Entities” need to give HIPAA Notice of Privacy Practices to new clients (and to post one, if they have a physical office). You are a Covered Entity if you bill insurance online (or exchange any client information online with a plan)” or if a biller or clearinghouse does this for you. If you are private pay-only and don’t send electronic claims, you generally are not considered a Covered Entity (not sure if you are a Covered Entity? Check here).

“Who needs to update their NPP?” You must update your NPP if you meet BOTH OF THE FOLLOWING criteria:

1. You are a HIPAA Covered Entity and receive federal funding, including Medicaid or Medicare, AND
2. You “hold yourself out” as treating clients with substance abuse disorders. This second criteria seems to be open to interpretation. According to the American Psychological Association, the update is only needed for substance abuse disorder specialists, and if you are in general practice treating various presenting conditions, and just happen to see SUD clients, it wouldn’t apply to you. But many online sources and two attorneys I spoke with said because of the lack of clarity of what “hold yourself out” means, the most risk-adverse path would be for all therapists who meet criteria #1 and see ANY clients (or might see any clients) with substance abuse to update the form. You may want to contact your malpractice carrier to get their reading on this law.

“So if I don’t meet those criteria?” You must also update your NPP if you receive or exchange substance abuse records from a Part 2 clinician or program.

“Why is this update necessary?” According to The Center of Excellence for Protected Health Information, “Part 2 offers strict privacy protections to treatment records in order to encourage individuals to seek and remain in treatment…. Unlike HIPAA, which often permits the sharing of certain health information without patient authorization, Part 2 generally requires patients’ written consent to disclose any patient-identifying information.”

“Anything else important in the new law?” Yes! If you meet the two requirements for a Part 2 provider under the new law, the new rules establish an OPTIONAL category of “SUD Counseling Notes.” These function like HIPAA psychotherapy notes, which are maintained separately from the rest of the client’s medical records. (More about psychotherapy notes here.)

“If I need to update my NPP, what updates must I make?” You can either give out a separate Part 2 NPP, or update your current NPP so that it addresses the law.

“Can you give me the exact sample paragraphs so I can add them to my NPP?” Well, I’m not an attorney, so you might want to consult with one (if you don’t have one, try contacting your malpractice carrier or your professional association). But according to TherapyNotes, here are the paragraphs you need to add:

“Use and Disclosure of Substance Use Disorder Records Subject to 42 CFR Part 2: If applicable, your substance use disorder (“SUD”) records are protected by federal law under 42 C.F.R. Part 2 (“Part 2”). This law provides extra confidentiality protections and requires a separate patient consent for the use and disclosure of SUD counseling notes. Each disclosure made with patient consent must include a copy of the consent or a clear explanation of the scope of the consent. It must also be accompanied by a written notice containing the language in 42 CFR Part 2.32(a). Disclosure of these records requires your explicit written consent, except in limited circumstances such as: (a) Medical Emergencies: to the extent necessary to treat you, (b) Reporting Crimes on Program Premises, (c) Child Abuse Reporting: In connection with incidents of suspected child abuse or neglect to appropriate state or local authorities, and (d) Fundraising: We will provide you with an opportunity to decline to receive any fundraising communications prior to making such communications. You may revoke this consent at any time.

Prohibitions on Use and Disclosure of Part 2 Records: SUD records received from programs subject to Part 2, or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless based on your written consent, or a court order after notice and an opportunity to be heard is provided to you or the holder of the record, as provided in Part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested SUD record is used or disclosed. If SUD records are disclosed to us or our business associates pursuant to your written consent for treatment, payment, and healthcare operations, we or our business associates may further use and disclose such health information without your written consent to the extent that the HIPAA regulations permit such uses and disclosures, consistent with the other provisions in this Notice regarding PHI.”

“Where can I get more information?” Don’t contact me with questions! This isn’t my area of expertise. Click on some of the article links, contact your malpractice carrier, professional association or attorney, or check out:

• The federal government website: Click here
• Center of Excellence for Protected Health Information: Click here and their article – Click here
• The law: 42 CFR Part 2
• The APA article – Click here

“Wasn’t there also a HIPAA update around reproductive issues?” In 2024 there was a proposed HIPAA rule related to reproductive health information. But this was struck down in 2025, so there are no new HIPAA requirements regarding reproductive issues. However, some states have stricter rules on these issues, so check your state laws and regulations and consult with a healthcare attorney.