Update Business Associate Agreements to Comply with New Substance Use Disorder Record Rules
By Kim Stanger
As of February 16, 2026, the new rules governing the confidentiality of substance use disorder (SUD) records will be enforced. If they have not done so, federally assisted SUD programs (Part 2 Programs) who are covered entities under HIPAA will need to update their business associate agreements (BAAs) to ensure compliance with the new rules.
SUD Confidentiality Obligations. The new Part 2 rules generally prohibit Part 2 Programs from disclosing SUD information without the patient’s written consent. However, the rules contain an exception that allows Part 2 Programs to disclose SUD information to a qualified service organization (QSO) without the patient’s consent so long as the Part 2 Program has an agreement with the QSO that requires the QSO to comply with Part 2.
Qualified Service Organizations. QSOs are essentially entities that would be business associates under HIPAA. Specifically, Part 2 defines QSOs as
a person [or entity] who:
(1) Provides services to a part 2 program, such as data processing, bill collecting, dosage preparation, laboratory analyses, or legal, accounting, population health management, medical staffing, or other professional services, or services to prevent or treat child abuse or neglect, including training on nutrition and child care and individual and group therapy, and
…
(3) Qualified service organization includes a person who meets the definition of business associate in 45 CFR 160.103, paragraphs (1), (2), and (3), for a part 2 program that is also a covered entity, with respect to the use and disclosure of protected health information that also constitutes a “record” as defined by this section.
(42 CFR 2.11).
QSO Agreements. Part 2 only allows disclosures to an entity as a QSO if the entity
Has entered into a written agreement with a part 2 program under which that person:
(i) Acknowledges that in receiving, storing, processing, or otherwise dealing with any patient records from the part 2 program, it is fully bound by the regulations in this part; and
(ii) If necessary, will resist in judicial proceedings any efforts to obtain access to patient identifying information related to substance use disorder diagnosis, treatment, or referral for treatment except as permitted by the regulations in this part.
(42 CFR 2.11). Thus, Part 2 Programs who are otherwise covered entities under HIPAA should ensure their BAAs contain these additional terms to satisfy the Part 2 exception for QSOs.
Other Terms. Part 2 is more restrictive than HIPAA: it limits some uses or disclosures of SUD records that HIPAA might otherwise allow. Part 2 Programs should review their existing BAAs with business associates/QSOs that received SUD records to ensure that they do not allow the business associate/QSO to use or disclose SUD records for purposes not allowed by Part 2.