OCR Given Authority to Administer and Enforce SUD Part 2 Regulations
The HHS’ Office for Civil Rights (OCR) has had its workload increased by Robert F. Kennedy Jr., who delegated authority to administer and enforce the Confidentiality of Substance Use Disorder Patient Records regulations under 42 CFR Part 2 (Part 2) to OCR on August 25, 2025. OCR is a small department that is already over-stretched, having not had a budget increase in two decades, despite annual requests to Congress for increased funding. OCR’s workload has increased considerably in recent years, with record numbers of complaints about potential HIPAA violations, and OCR now has to investigate more than twice the number of data breaches it was investigating in 2018. OCR has also suffered staff cuts and has had to close five of its field offices. It is unclear where OCR will find the resources to investigate Part 2 compliance issues.
The Part 2 regulations cover substance use disorder (SUD) treatment records, which are given greater protection than other types of healthcare data. The Substance Abuse and Mental Health Services Administration (SAMHSA) previously administered and enforced the Part 2 regulations. The delegation, published in the Federal Register on August 27, 2025, aligns with the 2020 Coronavirus Aid, Relief, and Economic Security (CARES) Act, which called for the HHS to align the Part 2 regulations more closely with HIPAA. In February 2024, OCR and SAMHSA published a final rule implementing changes to better align the Part 2 regulations with HIPAA, compliance with which is required by February 16, 2026.
The final rule implemented several changes, including allowing a single consent for all future uses and disclosures of SUD records for treatment, payment, and healthcare operations; HIPAA-covered entities and business associates that receive SUD records may redisclose those records in accordance with the HIPAA regulations; and disclosures of records without patient consent to public health authorities and for legislative proceeding as against patients, absent a consent order will also be permitted. The final rule also aligned the Part 2 regulations with HIPAA in areas such as breach notifications, the HIPAA Notice of Privacy Practices, and penalties for noncompliance. The restrictions on uses and disclosures of SUD records for prosecuting a patient, with or without patient consent or a court order, remain unchanged.
The delegation means OCR will be permitted to impose civil monetary penalties under Section 1176 of the Social Security Act for failures to comply with the Part 2 requirements, and OCR will be able to enter into resolution agreements, monetary settlements, and corrective action plans to address noncompliance. OCR will also be able to issue subpoenas requiring the attendance and testimony of witnesses and the production of any evidence that relates to any matter under investigation or conduct a compliance review.
