This article covers what an Oregon program should have in place now and how the state rules sit on top of the federal ones. It is general information, not legal advice. Have your privacy counsel review your final documents.
What happened and who enforces it
HHS published the final rule in the Federal Register on February 16, 2024. It implemented section 3221 of the CARES Act, which directed HHS to align parts of Part 2 with HIPAA. According to the HHS Part 2 overview, the rule has been effective since April 16, 2024, and compliance was required by February 16, 2026.
On August 25, 2025, the HHS Secretary delegated authority to administer and enforce Part 2 to the Office for Civil Rights, the same office that enforces HIPAA. HHS also states that beginning February 16, 2026, anyone can file a Part 2 complaint with OCR. OCR can investigate complaints and run compliance reviews, and when it finds a violation it can impose a civil money penalty under the HIPAA Enforcement Rule.
Part 2 applies to federally assisted programs that diagnose or treat SUD or refer patients for treatment. Participating in Medicare and holding a DEA registration to dispense controlled substances for SUD treatment are two of the triggers listed in 42 CFR 2.12(b), and federal funding can also qualify a program. Settle whether you qualify first, since everything below depends on it.
1. Replace your patient notice
The old Part 2 summary of federal confidentiality law no longer meets the standard. Under 42 CFR 2.22, a Part 2 program must give each patient a plain-language notice of its legal duties and privacy practices, structured much like a HIPAA Notice of Privacy Practices. The regulation spells out a required header and required content, including:
- The purposes for which the program may use or disclose records without written consent, with enough detail to put the patient on notice.
- A statement that the patient may give a single consent for all future uses and disclosures for treatment, payment, and health care operations.
- The patient's rights, including the right to request restrictions and the right to a paper or electronic copy of the notice.
- A statement that the patient may complain to the program and to the HHS Secretary, and will not be retaliated against for doing so.
- A contact person or office with a phone number and email address, plus an effective date.
The rule also says that when other law is more stringent, the notice must describe the more stringent standard. For Oregon programs, that means the notice cannot simply copy federal language without checking state law.
HHS has published model notices, including a Part 2 Patient Notice, revised in February 2026. If your program is also a HIPAA covered entity, HHS allows one combined notice that meets both sets of requirements. HHS also states that the notice must be posted prominently on any website you maintain that provides information about your services.
Covered entities that are not Part 2 programs are affected too. HHS says that as of February 16, 2026, HIPAA covered providers and health plans must include information about Part 2 records in their HIPAA notice. A June 2025 federal court decision in Texas vacated parts of a separate 2024 HIPAA rule on reproductive health care, but HHS has stated that the remaining NPP changes, including the Part 2 language, remain in effect. The primary care groups and hospitals you exchange records with have their own notice updates to make if they create or maintain Part 2 records.
2. Rebuild your consent forms
42 CFR 2.31 is the section most programs look at first. The headline change is the single consent for treatment, payment, and health care operations, often called a TPO consent. The recipient may be described as "my treating providers, health plans, third-party payers, and people helping to operate this program" or similar language. The expiration may be "end of the treatment" or "none."
The rule attaches conditions to that convenience. A TPO consent must state that records disclosed under it may be redisclosed by the recipient and no longer protected by Part 2, and it must state the consequences to the patient of refusing to sign. When the recipient is a HIPAA covered entity or business associate, the consent must also say that the record may be redisclosed as HIPAA permits, except for use in proceedings against the patient.
Three other consent rules deserve a close read:
- SUD counseling notes: The rule creates a new category, similar to psychotherapy notes under HIPAA. Disclosing them generally requires a separate consent that can be combined only with another consent for counseling notes. You cannot condition treatment on that consent.
- Legal proceedings: Consent to use records in a civil, criminal, administrative, or legislative proceeding cannot be combined with consent for any other purpose.
- What goes out with each disclosure: Under 42 CFR 2.32, every disclosure made with consent must carry one of the required notice statements and either a copy of the consent or a clear explanation of its scope. Check that your EHR release workflow and your billing staff's payer correspondence both do this.
3. Stand up a complaint process
42 CFR 2.4 requires a Part 2 program to provide a process to receive complaints about its compliance. The program may not retaliate against a patient for filing a complaint and may not require a patient to waive the right to complain as a condition of treatment or enrollment. In practice, assign the job to a named privacy officer with a written intake and logging procedure, and make sure the contact information matches what appears in your notice.
4. Write down your security and breach procedures
42 CFR 2.16 requires formal written policies covering paper and electronic records, including how records are stored and how they are destroyed. Paragraph (b) applies the HIPAA breach notification provisions to breaches of unsecured Part 2 records. HHS notes that a breach requires notice to affected individuals and to the Secretary, and some breaches also require media notice. If your incident response plan was written only for HIPAA, add Part 2 records to its scope and confirm who makes the call on notification.
5. Honor the new patient rights
Under 42 CFR 2.26, patients may ask the program to restrict TPO uses and disclosures, even after signing a TPO consent. The program generally does not have to agree. It must agree, however, when the patient asks that records not go to a health plan for payment or operations and the patient or someone other than the plan has paid for the service in full, unless the disclosure is otherwise required by law. Front desk and billing staff need a way to flag those accounts so claims are not submitted.
The rule also adds a right to an accounting of disclosures. According to the HHS fact sheet, the compliance date for that piece will be set when HHS revises the parallel right in the HIPAA Privacy Rule, so it is not yet enforceable. Your notice still has to describe it.
What did not change
HHS added an express statement that programs are not required to segregate or segment Part 2 records. The core protection also stays: SUD records cannot be used to investigate or prosecute a patient without written consent or a court order that meets Part 2 requirements.
The Oregon layer
Oregon's outpatient behavioral health rules already point to Part 2. OAR 309-019-0115 lists confidentiality and the right to consent to disclosure, in accordance with ORS 179.505 and 42 CFR Part 2, among individual rights. OAR 309-019-0135 requires the provider to obtain an authorization for the release of any confidential information about an individual being considered for or receiving services. Because these are licensing rules, a federal update that leaves your state forms out of sync with your new consents is a problem in its own right.
A practical order of work:
- Confirm in writing whether your program is a Part 2 program and whether it is also a HIPAA covered entity.
- Adopt a Part 2 notice or combined notice, built from the HHS model and checked against Oregon law.
- Replace old consent forms with a compliant TPO consent, and keep counseling note and legal proceeding consents on their own forms.
- Update release templates so each disclosure carries the required statement and consent scope.
- Adopt a complaint procedure and add Part 2 records to your breach plan.
- Train every staff member who handles records or releases, and keep documentation of the training.
If you want a second set of eyes on how your notice and consent forms line up with OAR chapter 309, Saint Health Group works with Oregon SUD and behavioral health programs on this kind of compliance review alongside licensing and payer work.
Easton Hallock is Managing Partner of Saint Health Group, which helps behavioral health and addiction treatment providers with licensing, accreditation, credentialing, and revenue cycle operations.
