Substance Use Disorder (SUD) Requirements as of February 16, 2026

As of February 16, 2026, medical practices must comply with updated federal privacy requirements related to substance use disorder (SUD) patient records.

If your practice treats pain management patients, prescribes controlled substances, or documents substance use history, this update likely applies to you.

What Changed?

In February 2024, the U.S. Department of Health and Human Services issued a Final Rule aligning the HIPAA Privacy Rule with 42 CFR Part 2, which governs confidentiality of substance use disorder records.

The rule required practices to update their Notice of Privacy Practices (NPP) by February 16, 2026.

That deadline is now here.

What Your Notice of Privacy Practices Must Include

Under revised 45 CFR §164.520, practices must include:

• A description of prohibited uses and disclosures related to SUD records
• A description of when written attestation is required before disclosure
• A statement warning patients that disclosed PHI may be redisclosed
• A statement that SUD records generally require court order or legal authority for disclosure

If this language is not reflected in your NPP, your privacy notice may not align with current federal requirements.

Why This Matters Now

Outdated privacy policies can create exposure during:

• OCR audits
• Payer credentialing reviews
• Compliance investigations
• Legal disputes involving PHI

Practices in pain management, orthopedics, behavioral health, primary care, and ASCs should confirm their policies are current.

What To Do If You’re Unsure

If your privacy policies have not been reviewed in the past 1–2 years, now is the time to verify compliance.

At Peregrine Healthcare, we help practices align operations, documentation, and compliance safeguards to reduce regulatory and payer risk.

 877-463-1110
 info@peregrinehealthcare.com

Protect your revenue. Protect your practice.