New Federal Rules for Addiction Treatment Records Just Took Effect. Here's What Patients in New York Should Know.
A landmark federal privacy rule for substance use disorder records became enforceable on February 16, 2026. It changes how addiction treatment records can be shared — and gives patients new rights.
For years, one of the most stubborn obstacles to treating addiction wasn't a shortage of clinics or medications — it was paperwork. Specifically, it was a federal rule so strict that a doctor treating someone for a broken arm often couldn't share that patient's addiction treatment records with the emergency room, even when it mattered for their care. As of this week, that dynamic has officially changed.
On February 16, 2026, the federal government began actively enforcing a landmark update to 42 CFR Part 2, the regulation that has governed the confidentiality of substance use disorder (SUD) patient records since the 1970s. The update, which was finalized in February 2024 but required nearly two years of implementation work from providers, reshapes how addiction treatment records can be shared, stored, and protected — and for the first time, gives patients real legal tools to enforce those protections.
"Americans seeking treatment for substance use disorder deserve comprehensive care without sacrificing their privacy or legal protections," HHS Secretary Robert F. Kennedy Jr. said in announcing the enforcement program. The initiative is framed as part of the administration's broader Great American Recovery Initiative.
Why Addiction Records Were Treated Differently — and Why It Created Problems
The original Part 2 rule, passed in the 1970s when addiction was widely criminalized and heavily stigmatized, gave SUD records a level of protection that went far beyond standard HIPAA. Under the old framework, every single disclosure of addiction treatment records required a separate, written patient consent — no exceptions for routine care coordination, no sharing between the treating physician and the patient's other providers without going through an elaborate process each time.
The intent was good. People seeking help for addiction feared — often with good reason — that their records could end up in court, cost them a job, or be used by law enforcement. Those fears didn't disappear when the old rule was in place; in fact, research consistently showed that the complexity and stigma surrounding SUD records discouraged people from seeking treatment at all.
But the old rule also created an operational nightmare for healthcare providers. A hospital treating a patient for an overdose couldn't easily access that patient's medication-assisted treatment records from their outpatient clinic. An addiction medicine specialist couldn't coordinate with a primary care physician without extra paperwork. The protections designed to encourage treatment often ended up fragmenting it instead.
What the February 16 Update Actually Changes
The new rule threads a difficult needle: it makes SUD records easier to share for legitimate healthcare purposes while strengthening the protections that matter most — specifically, using those records in legal proceedings.
Under the updated regulation, a single patient consent can now authorize all future uses of SUD records for treatment, payment, and routine healthcare operations. That means a patient who signs one consent form at an addiction treatment program can have their records shared with other providers involved in their care — their primary doctor, a hospital, a specialist — without needing to sign a new form every time. This brings Part 2 more in line with how HIPAA already works for other medical records.
At the same time, the rule keeps firm prohibitions on using SUD records in civil, criminal, administrative, or legislative proceedings against a patient without either explicit patient consent or a court order. This is the protection that matters most to people in recovery, and it remains intact. Records that were shared for care purposes cannot then be handed to prosecutors or used in a divorce proceeding or an employment dispute without the patient's knowledge.
There are also changes to records security. The HIPAA Breach Notification Rule now applies to Part 2 records — meaning any unauthorized disclosure of addiction treatment records must now be reported to HHS and to affected patients, the same way a hospital data breach would be. Providers must establish formal complaint programs. And patients now have the right to request an accounting of who has received their records.
New Rights for Patients in New York
For patients, the practical changes are meaningful. Under the updated rule:
Patients can request restrictions on certain disclosures, including the right to limit how their SUD records are used even within HIPAA's usual permissions. They also now have the right to opt out of fundraising communications from covered entities — a protection that didn't previously extend to Part 2 records.
Most significantly, patients can now file complaints directly with the HHS Office for Civil Rights if they believe their SUD records were shared without proper authorization. OCR launched its civil enforcement program alongside the compliance deadline, meaning it will actively investigate violations. Penalties can be substantial, matching the civil monetary penalties available under HIPAA — up to millions of dollars for egregious violations.
In New York, this matters because the state has an extensive network of OASAS-licensed addiction treatment programs, outpatient clinics, and harm reduction services — all of which are now subject to the updated requirements and the possibility of federal investigation if they fail to comply.
What This Means for Care Coordination in New York
The practical benefit that providers and policy analysts are watching most closely is care coordination. New York has invested heavily in integrating addiction treatment into the broader healthcare system — through programs like the OASAS Hub and Spoke model and the state's Medication for Addiction Treatment and Electronic Referrals (MATTERS) network.
Under the old rules, that integration was often blocked by Part 2's consent requirements. A patient enrolled in a buprenorphine program couldn't easily have their records shared with a primary care doctor within the same health system without going through extra steps. The new rule removes much of that friction.
That doesn't mean privacy concerns are gone. Some patient advocates have raised questions about whether simplifying the consent process makes it easier for records to flow to places patients might not intend. The new rule's authors at HHS argue that the remaining protections — especially the prohibition on disclosure in legal proceedings — are the ones that matter most, and that improved care coordination will ultimately help more people get and stay in treatment.
The tension is real, and patients are right to ask questions when signing any consent form at an addiction treatment provider. The key question is always: who specifically will be able to see this information, and for what purposes?
What to Do If You Think Your Rights Were Violated
If you believe your substance use disorder treatment records were shared without your consent or used in a way that violates your rights, you can file a complaint with the HHS Office for Civil Rights. OCR began accepting Part 2 complaints on February 16, 2026.
Complaints can be filed online at hhs.gov/ocr, by mail, or by fax. There is no fee to file a complaint, and OCR has anti-retaliation protections in place for people who report violations. You can also contact the New York State Department of Health or OASAS with concerns specific to state-licensed programs.
For more information on your rights under the updated Part 2 regulations, visit the HHS Part 2 resource page.
Written by
MTNYC Editorial TeamThe MTNYC Editorial Team is a group of healthcare writers, researchers, and addiction specialists dedicated to providing accurate, compassionate, and evidence-based information about addiction treatment and recovery resources in New York State.
