ASP Insight / Audit & Enforcement
The two-year runway is over. As of February 16, 2026, the HHS Office for Civil Rights accepts complaints alleging violations of 42 CFR Part 2, the substance use disorder confidentiality rule, and can pursue HIPAA-style civil penalties. The same rule that armed OCR also unblocked your billing office: one signed patient consent now covers all future treatment, payment, and operations disclosures of SUD records. If your consent forms, BAAs, and release-of-information workflows still speak pre-2026 language, both your revenue cycle and your enforcement exposure are out of date.
How we got here
Two years, four dates, one new enforcement reality
SAMHSA and HHS publish the final rule, Confidentiality of Substance Use Disorder Patient Records, at 89 FR 12472, aligning Part 2 with HIPAA on consent, penalties, and breach notification.
The rule takes effect. Programs get a compliance window to rework consents, agreements, and workflows.
OCR announces the Part 2 Civil Enforcement Program, confirming it will handle Part 2 complaints the way it handles HIPAA complaints (hhs.gov).
Compliance date arrives. OCR begins accepting SUD confidentiality complaints, and civil penalty authority applies to Part 2 violations.
The assigned visual: consent flow, before and after
The disclosure flow that changed for billing operations
Under legacy Part 2, every disclosure of an SUD record generally needed its own consent. For a billing operation, that meant a consent touchpoint for the claim, another for the appeal, another for the payer audit. The aligned rule replaces that loop with a single consent covering all future TPO disclosures.
REPEAT FOR EVERY DISCLOSURE. CLAIMS STALL WHEN CONSENT LAPSES.
The consent is not a blank check. Patients can revoke it, SUD records still carry heightened protection against use in proceedings against the patient, and every downstream holder inherits obligations. But for revenue cycle purposes, the standing consent removes the single largest structural drag on SUD claims workflows.
The other flow that went live
What happens when someone files a complaint
Before this rule, Part 2 enforcement ran through criminal referral, which in practice meant near-zero enforcement. Moving Part 2 into OCR's civil complaint machinery changes the probability math. OCR already runs this exact process at scale for HIPAA, and complainants do not need a lawyer, just a web form.
The 2026-era paperwork
Four document sets that need the new language
Consent forms
Retire disclosure-by-disclosure consents. Adopt the single TPO consent permitted by 89 FR 12472, capture it at intake, store it where billing staff can verify it, and build a revocation workflow that actually stops disclosures.
BAAs and QSO agreements
Vendors touching SUD records, billing companies included, need agreement language reflecting Part 2 obligations in the aligned rule, because civil exposure now reaches the whole chain of custody.
Release-of-information workflows
ROI staff need to distinguish TPO requests covered by the standing consent from requests that still require specific authorization, and to apply the continuing restrictions on use of records against the patient.
Breach response
Breach notification duties now attach to SUD records. Your incident runbook, notification letters, and reporting timelines must treat a Part 2 record breach as a notifiable event, not a quiet internal fix.
Operator checklist
What audit and compliance leads should verify this quarter
- Pull a sample of active SUD patient files and confirm a valid 2026-era single consent is on record before any claim or record release goes out.
- Inventory every vendor and billing partner that receives SUD records and confirm agreements carry the aligned Part 2 obligations.
- Rewire the claims and appeals workflow to check consent status once, at the record level, instead of gating each disclosure.
- Add SUD records to the breach notification runbook, with the same detection, assessment, and notification discipline used for HIPAA PHI.
- Train billing and AR teams on what the standing consent covers, what revocation means mid-claim, and when to escalate a payer records request.
- Name an owner for OCR inquiries and keep a dated compliance file, because documented good-faith work is what shortens an investigation.
SAMHSA/HHS final rule, Confidentiality of Substance Use Disorder Patient Records, 89 FR 12472 (February 16, 2024), effective April 16, 2024, compliance date February 16, 2026. HHS Office for Civil Rights, announcement of the Part 2 Civil Enforcement Program, February 13, 2026 (hhs.gov).
Turn the single-consent model into cash flow, not exposure
ASP-RCM Solutions runs behavioral health and SUD revenue cycles where consent status, record release, and claims workflows have to move together. We build the intake-to-appeal pipeline around the 2026 consent model, keep the audit file OCR-ready, and make sure a confidentiality rule never becomes the reason a clean claim sits unpaid.
Talk to our Audit & Enforcement teamRelated reading
The map that changes: CJR goes from selected markets to the whole country
The FY 2027 IPPS final rule (CMS-1849-F) expands TEAM spinal fusion episodes and makes CJR mandatory nationwid
Read →Field noteTwo urology leaks hide in plain sight: cystoscopy bundling and buy-and-bill units.
The two biggest urology revenue leaks explained: cystoscopy-with-biopsy bundling under NCCI PTP edits (CPT 520
Read →Case studyBill S9083 or bill per visit? The answer lives in the contract, not the chart.
How a multi-site urgent care network maps every payer contract to one billing method, global S9083 for capitat
Read →InsightA dated timeline of what DWC actually did this year
California's DWC adopted Medicare RVU26B and RVU26C into the OMFS within months of each other. Why annual fee
Read →