42 CFR Part 2 Is Enforceable Now. The Privacy Rule Update Still Isn’t.
A gap exists right now between what healthcare organizations think changed this year and what actually changed, and it runs in both directions. One rule that took effect in February is being enforced today but is still missing from many Notices of Privacy Practices. Another set of changes everyone has been bracing for hasn’t arrived and may not arrive as described.
Meanwhile, OCR is enforcing something neither rule touches, and AI has entered clinical and administrative workflows faster than governance has followed. Here is where each of those actually stands.
What is in force: 42 CFR Part 2
The compliance date for the Part 2 final rule passed on February 16, 2026. It is enforceable now, and OCR began accepting Part 2 complaints that same week.
Three things about it catch organizations out.
It reaches further than SUD programs. Part 2 applies to any covered entity that creates, receives, or maintains substance use disorder records, not only to programs that specialize in treating SUD. A county health department, a primary care practice, or a hospital that keeps those records in a chart falls under the rule.
Your Notice of Privacy Practices has to describe it. By the February date, the NPP must explain how Part 2 records are used and disclosed, including the limits on their use in legal proceedings. If yours has not been revised, that is not a future project.
The legal-proceedings protection is stricter than most staff assume. SUD records cannot be used against a patient in a civil, criminal, administrative, or legislative proceeding without written consent or a court order issued after the patient has had notice and an opportunity to be heard. A subpoena on law firm letterhead is not a court order, and a release signed by the opposing party in a custody dispute authorizes nothing.
That last point is where the front desk meets the rule. When a request arrives with a deadline attached and a clerk copied on the letter, the correct answer is to route it to the Privacy Officer and to decline to confirm or deny whether the individual is a patient at all, because confirming the relationship is itself a disclosure.
What is not in force: the Privacy Rule coordinated care update
The long-pending modifications to the HIPAA Privacy Rule, proposed back in January 2021, have not taken effect. HHS sent the final rule to OMB in April 2026 and targeted August 2026 for final action, but as of late August, it remained in the Final Rule Stage and had not been published in the Federal Register. Agency target dates in the Unified Agenda are estimates, not commitments, and this particular rule has slipped for five years.
Until it is published and takes effect, the current Privacy Rule governs. Nothing in the proposal is enforceable today.
What is expected in it, based on the 2021 proposal:
- A minimum necessary exception for individual-level care coordination and case management
- A “good faith belief” standard replacing “professional judgment” for disclosures when a patient cannot speak for themselves
- A “serious and reasonably foreseeable threat” standard replacing “serious and imminent threat” for disclosures to avert harm
- Elimination of the requirement to obtain written acknowledgment that a patient received the Notice of Privacy Practices
- Accommodation for telecommunications relay services, and extension of the military-personnel disclosure permission to all uniformed services
One change has moved. The provisions shortening the timeframe for responding to individual access requests, along with the associated fee limits, have reportedly been separated into their own rulemaking now expected in November 2026. If you have been planning staffing around a 15-day records-request turnaround arriving with the coordinated care rule, you need to revisit that assumption.
When the rule does publish, expect the standard shape: roughly 60 days to an effective date, then a compliance period of about 180 days. Thatis about eight months of runway from publication, which sounds generous until you count the policies, the NPP revision, and the training inside it.
Also not in force: the Security Rule overhaul
The Security Rule rewrite proposed in January 2025, the one that would have made encryption and MFA explicit requirements rather than addressable, remains a proposal. HHS moved it to its long-term agenda with final action now targeted for July 2027, and it is no longer on the current agency rule list.
Nothing in it is enforceable. It is worth reading, because it signals where the agency believes the floor should be. It is not worth treating as a deadline.
What OCR is actually enforcing
Here is the part that matters more than either pending rule. OCR has not been waiting.
Under its Risk Analysis Initiative, OCR resolved 14 matters and announced four settlements in April 2026 totaling $1.165 million and covering roughly 427,000 individuals. Every one of them cited the same root failure, and it was not a missing firewall or a weak password. Each entity had failed to conduct an accurate and thorough risk analysis of its electronic protected health information, the foundational requirement at 45 CFR 164.308(a)(1)(ii)(A). Each also signed a corrective action plan, placing it under OCR monitoring for two years.
The enforcement signal is unambiguous. The obligation OCR is actively penalizing is the one in the Security Rule since 2005, and most organizations treat it as an annual formality.
Tego can address this directly via our Security Risk Analysis. Beyond the assessment, Tego can help build risk management policies, run periodic security training for your employees, and develop and test contingency plans for your organization.
Where AI collides with all of it
The risk analysis obligation covers ePHI wherever it lives. That phrasing was written before anyone could paste a client narrative into a chat window, and it has not needed updating because it already covers it.
AI arrived in most healthcare organizations through four different doors, and governance was usually built for one:
- Procured. Clinical and administrative AI bought deliberately, often through clinical or revenue leadership rather than IT.
- Embedded. Features switched on inside platforms you already own, arriving through vendor release notes rather than procurement.
- Unmanaged. Consumer tools used by staff at the browser, invisible to most security telemetry.
- Agentic. Staff-built agents that take action rather than answer questions. An agent runs with the permissions of whoever built it, which makes what it can reach a permissions question before it is an AI question.
Each door is a path to PHI, each has a different owner, and each fails differently. Most organizations can describe their governance for the first door and have no inventory at all for the other three.
The failure mode is rarely dramatic. It looks like a staff member behind on fourteen client summaries opens a capable AI tool on a personal login and pastes in a full narrative, including name, address, diagnosis, and treatment history. The organization may well hold an enterprise agreement with that same vendor. The agreement doesn’t follow the employee to a personal account, which means no business associate agreement covers that conversation, no audit log, and a vendor that may retain and train on the text.
Add Part 2 to that picture. If the narrative was substance use disorder treatment, heightened protections apply on top of HIPAA, and an internal matter becomes considerably worse.
The question that reframes this as a compliance conversation
A regulator does not distinguish between a person and an agent reaching protected health information. The obligation and the evidence standard are identical.
So the practical test is the audit trail. If an agent touched PHI last month, can you produce the record? For most organizations, the honest answer is no, and that gap sits directly against the HIPAA audit controls standard at 45 CFR 164.312(b).
That framing moves AI governance out of a technology discussion and into the compliance function, where it gets funded.
What to do before either rule lands
The organizations that will absorb the Privacy Rule changes comfortably are the ones that already know what they have. Specifically:
- Confirm your NPP reflects Part 2. This is already required, and it is the fastest thing on this list to check.
- Find out whether your risk analysis is accurate and thorough, or annual and cosmetic. This is the control OCR is actively penalizing.
- Inventory the AI estate across all four doors, including agents, embedded features, and what staff are using in the browser.
- Answer the audit trail question for anything that can reach PHI.
Tego’s AI Governance Readiness Assessment covers the third and fourth items. It runs against the NIST AI Risk Management Framework’s four functions, Govern, Map, Measure, and Manage, and cross-walks every finding to the HIPAA standard it implicates, so results arrive in the language your compliance function already works in and carry directly into your annual Security Risk Analysis rather than sitting beside it as a separate program.
On the questions IT always asks first: Tego holds no standing access to your environment. Your administrator runs the collection under an identity you control, using reader-class access scoped to the engagement and removed at close. Nothing is installed or modified. What is collected is configuration metadata, meaning names, owners, permissions, sharing scope, connectors, policy settings, and usage dates, not message content, not documents, and not patient data. We stage every export inside your tenant for review or redaction before it reaches us.
Frequently asked questions
Yes. The compliance date passed on February 16, 2026, and OCR began accepting Part 2 complaints that week. Notices of Privacy Practices were required to describe how Part 2 records are used and disclosed by that same date.
Yes. It applies to any covered entity that creates, receives, or maintains substance use disorder records, which includes health departments, primary care practices, and hospitals that hold those records in a patient chart.
Not as of this writing. HHS sent it to OMB in April 2026 and targeted August 2026 for final action, but it remained in the Final Rule Stage and unpublished in the Federal Register. Unified Agenda target dates are estimates, not commitments, and until the rule publishes and takes effect, the current Privacy Rule governs.
The individual-access timeframe provisions have reportedly been moved into a separate rulemaking expected in November 2026, rather than being finalized with the coordinated care changes. Organizations that were planning staffing around a 15-day turnaround arriving this year should revisit that assumption.
No. The January 2025 proposal remains a proposal. HHS moved it to its long-term agenda with final action targeted for July 2027, and nothing in it is enforceable today.
No. The obligation and the evidence standard are the same whether a person or an agent accesses protected health information. That is why the practical question is whether you can produce an audit record of what an agent accessed, which implicates the audit controls standard at 45 CFR 164.312(b).
Completing an annual risk assessment will directly address this issue. In addition to conducting the assessment, Tego can help build risk management policies, conduct periodic security training with your employees, and develop and test any contingency plans for your organization.
Find out what your AI estate actually touches
The AI Governance Readiness Assessment maps all four doors, flags what each agent can reach, and cross-walks every finding to the HIPAA standard it implicates, so the results feed your annual Security Risk Analysis rather than sitting beside it. Three to four weeks, roughly two days of your team’s time, no standing access to your environment.
Request the AI Governance Readiness Assessment · See Tego’s security, audit, and compliance practice
This post describes regulatory status as of publication and is not legal advice. Regulatory timelines shift, so confirm current requirements with your own counsel or compliance officer.