What changed on February 16, 2026
The final rule on the confidentiality of substance use disorder patient records was published in the Federal Register on February 16, 2024, took effect on April 16, 2024, and set February 16, 2026 as the date by which programs must comply. It replaces separate consents for payment and certain health care operations with a single consent for all future uses and disclosures for treatment, payment and health care operations, valid until the patient revokes it in writing.
On February 13, 2026, the HHS Office for Civil Rights announced a civil enforcement program for Part 2. From February 16, 2026, it accepts complaints and breach notifications, and its investigations can end in resolution agreements, monetary settlements, corrective action or civil money penalties.
What a Part 2 consent must contain
Under 42 CFR 2.31, a written consent includes: the patient’s name; who may make the use or disclosure; a specific description of the information; the recipients; the purpose of each use or disclosure; the right to revoke the consent in writing, and how; an expiration date or event; the patient’s signature; and the date it is signed.
For a single consent covering treatment, payment and health care operations, the rule accepts a recipient described as “my treating providers, health plans, third-party payers, and people helping to operate this program”, a purpose described as “for treatment, payment, and health care operations”, and an expiration such as “end of the treatment” or “none”. That consent must also state that the records may be redisclosed by the recipient and no longer protected by Part 2, and the consequences to the patient of refusing to sign.
SUD counseling notes need their own consent
Under 42 CFR 2.31(b), a use or disclosure of SUD counseling notes needs its own written consent, which may only be combined with another consent for SUD counseling notes, and treatment cannot be conditioned on it. If your program uses one, keep it as a separate form.
How we build your Part 2 consent
We rebuild the consent your program already uses, in your wording: we do not write it for you. Clients read it on a phone or a tablet and sign with a finger, the date of signature is recorded automatically, and the revocation instructions stay on the page they sign.
The signed PDF is filed in your practice’s Google Drive, and Yanforms signs a Business Associate Agreement with your practice, free of charge. Have the content of your consent checked against the rule by your counsel.