Your redisclosure policy might be solid. Your EHR might be configured. Your staff might even be trained. But if no one owns the outcomes—you’re still exposed. In Week 6 of our 42 CFR Part 2 series, we’re not adding new checklists. We’re asking: Who’s accountable when...
Cybersecurity
The Clock Is Ticking: Why You Can’t Wait Until 2026 to Fix Part 2 Gaps
You still have time—but not as much as you think. The 42 CFR Part 2 compliance deadline is set for February 16, 2026, but here’s the truth: What you do in 2025 determines whether you’ll be compliant by then—or scrambling. This week, we’re breaking down why delay...
Redisclosure in Real Life: How to Catch the Gaps That Could Derail Your Part 2 Compliance
You’ve updated your forms. You’ve added the redisclosure notice. You’ve even started a tracking log. But here’s what most SUD programs miss: Redisclosure compliance doesn’t live in your policy binder. It lives in the real-world chaos of intake, referrals, and...
HIPAA-Level Penalties Are Coming to SUD Programs: What You Need to Know Before 2026
For decades, 42 CFR Part 2 created stricter privacy requirements for substance use disorder (SUD) records but lacked HIPAA’s robust penalty framework. That changed in February 2024, when HHS finalized updates aligning Part 2 with HIPAA. By February 16, 2026, SUD...
Redisclosure Tracking Under 42 CFR Part 2: What You Must Do by 2026
The updated 42 CFR Part 2 rule (compliance required by Feb 16, 2026) requires more than updated patient consent forms. Every disclosure of SUD-related information must include a no-redisclosure notice, and organizations must maintain auditable disclosure logs....
42 CFR Part 2’s New Consent Rules: What They Mean and How to Get Started
The 2024 update to 42 CFR Part 2 finally resolves one of the biggest friction points in substance use disorder (SUD) care: patient consent. Effective February 16, 2026, providers can use a single consent for Treatment, Payment, and Operations (TPO). That’s...
42 CFR Part 2 Is Now Aligned with HIPAA: What Changed, What’s at Stake, and What to Do First
The U.S. Department of Health and Human Services finalized updates to 42 CFR Part 2 aligning Substance Use Disorder (SUD) confidentiality requirements with HIPAA. For SUD programs and adjacent providers (pain management, HHA, DME, assisted living/SNF), this is a...
The Q4 Tighten-Up – Where Resilience Fades (And How to Stay Ahead)
It’s Q4. You’re closing the year strong. But don’t mistake momentum for security. Resilience isn’t built once and left alone. It’s tuned, tested, and reinforced—especially when things are busy. This week, we’re looking at where resilience fades fast in Q4—and how to...
What Fades, Fails, or Fractures When You Don’t Follow Through
Last week, we laid out six simple ways to keep your resilience real: → Review your drills → Update your call tree → Clean up shared access → And a few more easy wins... But here’s the hard truth: The biggest risks don’t come from what you didn’t do. They come from...










