42 CFR Part 2 Is Enforceable Now. The HIPAA Privacy Rule Update Still Isn’t.
Quick answer: The updated 42 CFR Part 2 rule for substance use disorder (SUD) records has been enforceable since February 16, 2026. The HIPAA Privacy Rule coordinated care update is still awaiting OMB review, and the HIPAA Security Rule overhaul is now targeted for July 2027. Until those rules are final, the current HIPAA rules govern, and OCR is actively enforcing them.
Updated October 2026
42 CFR Part 2 and HIPAA status at a glance
| Rule | Status (October 2026) | What it means for you |
| 42 CFR Part 2 final rule | Enforceable since February 16, 2026 | Update your NPP and SUD record handling now |
| HIPAA Privacy Rule (coordinated care) | Sent to OMB April 4, 2026. August target passed, not yet published | Current Privacy Rule still governs |
| Right of access timelines | Separate proposed rule expected November 2026 | Watch for a shorter response deadline |
| HIPAA Security Rule overhaul | Proposed January 2025. Final action targeted July 2027 | Not binding yet, but a useful roadmap |
What does 42 CFR Part 2 require now?
Part 2 protects records of substance use disorder treatment. The 2024 final rule aligned Part 2 more closely with HIPAA, and its compliance date was February 16, 2026.
- It reaches beyond SUD programs. Any covered entity that receives and holds Part 2 records must follow the rule.
- Notices must change. Your Notice of Privacy Practices has to describe Part 2 uses and disclosures.
- Complaints are open. OCR began accepting Part 2 complaints the week the compliance date passed.
When will the HIPAA Privacy Rule update take effect?
Not yet. HHS sent the coordinated care final rule to OMB on April 4, 2026, and its August 2026 target passed without publication. Once published, organizations would typically have 240 days to comply. In addition, a separate proposed rule on right-of-access response times is expected in November 2026.
Is the HIPAA Security Rule update in effect?
No. The January 2025 proposal remains a proposal, and HHS moved final action to July 2027. However, many of its proposed controls, such as asset inventories and MFA, are already good practice, so they make a sensible roadmap.
What is OCR enforcing right now?
OCR’s Risk Analysis Initiative is the clearest signal. In April 2026, OCR announced four settlements totaling $1.165 million, each citing a failure to conduct an accurate and thorough risk analysis. (Editor: figures carried over from the original post. Delete this note before publishing.)
The takeaway is simple. An incomplete or outdated risk analysis is the most common finding, and it’s fully within your control.
How does AI fit into HIPAA and 42 CFR Part 2 compliance?
AI enters healthcare organizations four ways: tools you buy, AI embedded in existing software, unmanaged tools staff use on their own, and AI agents acting on your systems. HIPAA treats an AI agent like any other user with access to PHI. As a result, if you can’t produce an audit record of what an agent accessed, you have a gap under the audit controls standard, 45 CFR 164.312(b).
What should healthcare organizations do before the new rules land?
- Confirm your NPP reflects Part 2. Update and redistribute it if needed.
- Refresh your risk analysis. Make it enterprise-wide, current and documented.
- Inventory AI use. Cover all four pathways, including tools staff adopted on their own.
- Verify audit trails. Confirm every system and agent that can reach PHI is logged.
- Start on Security Rule basics. Asset inventory, MFA and encryption will be needed either way.
Frequently asked questions
Yes. The compliance date was February 16, 2026, and OCR is accepting Part 2 complaints.
Yes, if you receive and hold Part 2 records. Many hospitals, health systems and care coordinators fall into this group.
Not as of October 2026. It has been under OMB review since April 4, 2026.
HHS currently targets final action for July 2027. Until then, the existing Security Rule applies.
No. An agent that accesses PHI carries the same access, logging and minimum-necessary obligations as a human user.
Get ahead of the next HIPAA rule
Tego helps healthcare organizations with risk analysis, policies and AI governance. Learn about our AI governance readiness assessment, or see our security, audit and compliance services. This article is not legal advice, and regulatory timelines may change.
Sources: HHS rulemaking timeframes (Davis Wright Tremaine) · Privacy Rule still pending (HIPAA Simple) · New HIPAA regulations (HIPAA Journal)
This post describes regulatory status as of publication and is not legal advice. Regulatory timelines shift, so confirm current requirements with your own counsel or compliance officer.