RFK Jr. delegates Part 2 enforcement to OCR

HHS Secretary Robert F. Kennedy, Jr. delegated authority to administer and enforce the Confidentiality of Substance Use Disorder Patient Records regulations under 42 CFR Part 2 to the Office for Civil Rights, the department announced on Aug. 26, 2025. The delegation will enable OCR to issue enforcement actions under Part 2 regulations, which have provided special privacy protections for patients' substance use disorder, or SUD, treatment records since 1975.

Kennedy's delegation aligns with section 3221 of the 2020 Coronavirus Aid, Relief, and Economic Security (CARES) Act, which required the HHS secretary to better align aspects of the Part 2 regulations with HIPAA.

A February 2024 final rule solidified the alignment. The final rule permitted the use and disclosure of Part 2 records based on patient consent given once for all future uses and disclosures for treatment, payment and operations purposes, and permitted redisclosure of Part 2 records by HIPAA-covered entities and business associates as defined by the HIPAA Privacy Rule.

The 2024 rule, which has a compliance deadline of Feb. 16, 2026, also allowed covered entities to disclose records without patient consent to public health authorities, as long as they de-identify the records in accordance with HIPAA.

What's more, the rule modified breach notification and penalty standards under Part 2, aligning them with HIPAA violations and giving HHS enforcement authority for civil and criminal enforcement. Breaches of data covered by Part 2 will be subject to the same requirements as the HIPAA Breach Notification Rule.

A core element of Part 2 regulations has always been that SUD treatment records cannot be used to investigate or prosecute a patient without patient consent or a court order. This provision remains unchanged per the 2024 final rule.

OCR's new authority will permit it to issue subpoenas "requiring the attendance and testimony of witnesses and the production of any evidence that relates to any matter under investigation or compliance review for failure to comply with these requirements," HHS stated.

The delegation of authority to OCR will allow OCR to enter into resolution agreements, issue corrective action plans and civil money penalties, and reach monetary settlements with violating entities.

Jill McKeon has covered healthcare cybersecurity and privacy news since 2021.