The U.S. Department of Health and Human Services (“HHS”) recently delegated authority to the HHS Office for Civil Rights (“OCR”) to enforce new privacy rules governing substance use disorder treatment records, which are set to take effect in early 2026. In a Statement of Delegation of Authority, HHS assigned OCR the responsibility of enforcing the regulations set forth in 42 C.F.R. Part 2 (“Part 2 Regulations”), which govern the privacy and confidentiality of substance use disorder treatment (“SUD”) records (“Part 2 records”). Disclosure of Part 2 records without patient consent to public health authorities is permitted, provided the records are deidentified in accordance with HIPAA’s requirements. The requirements set forth in the HIPAA Breach Notification Rule apply to breaches of Part 2 records.