Part 2 is a federal confidentiality rule that applies specifically to substance use disorder treatment records and is stricter than HIPAA in important ways, including tight limits on disclosures and even on acknowledging that someone is a patient. The 2024 final rule aligned Part 2 more closely with HIPAA, allowing a single patient consent to cover future uses for treatment, payment, and operations. It also extended HIPAA-style breach notification requirements to Part 2 programs and strengthened patient rights around accounting of disclosures. Programs must comply by February 16, 2026, which means updated Notices of Privacy Practices, revised consent forms in the EHR, and audit trails that can prove compliance. Medical IT Company translates those requirements into concrete system configurations, access controls, and logging across your entire technology stack.