A Major Privacy Change Has Arrived for Healthcare Organizations — Are You Prepared?
Healthcare privacy rules are undergoing one of the most significant changes in decades. On February 16, 2026, federal regulators began enforcing new rules that align 42 CFR Part 2, which governs the confidentiality of substance use disorder (SUD) treatment records, within the HIPAA Privacy framework.
For healthcare organizations, especially small and mid-sized providers, this change presents both opportunities and challenges. The new framework aims to enhance care coordination while safeguarding sensitive behavioral health information. However, many organizations may find it difficult to understand how these rules apply to daily operations.
To help healthcare teams prepare, North Country Communications recently hosted a webinar explaining the implications of the new rule and what organizations should do now that enforcement has begun.
In the session, we walk through:
- Why Congress moved to update Part 2 through the CARES Act
- How the 2024 Final Rule changes key workflows like consent requirements and data sharing
- What the alignment with HIPAA means for privacy programs and compliance teams
- Practical steps organizations should follow to update policies, workflows, and training.
One of the most significant changes is the introduction of a single-patient consent model, which allows SUD treatment information to be shared for treatment, payment, and healthcare operations once a patient provides authorization. This marks a major shift from the previous rule, which required new consent for nearly every disclosure.
While the new rule simplifies some compliance requirements, it also introduces new enforcement measures and breach notification requirements similar to those under HIPAA. In short, organizations that manage SUD records must ensure their privacy programs are prepared.
Our webinar emphasizes the practical aspects of implementing these changes—from updating consent forms and privacy notices to training staff to spot Part 2-protected information across systems and workflows.
If your organization offers behavioral health services, manages integrated care, or encounters SUD-related data in patient records, this regulatory development is one you cannot afford to ignore.
Watch the full webinar to learn what your organization should be doing now that the new rules are in effect.