Emergency Medical Services agencies increasingly operate at the intersection of multiple federal privacy frameworks, and recent updates aligning the HIPAA Notice of Privacy Practices (NPP) requirements with the federal confidentiality protections for substance use disorder (SUD) records under 42 CFR Part 2 have created understandable uncertainty. Many ambulance services do not view themselves as traditional behavioral health providers, yet they may still encounter or receive protected SUD information during routine patient care and transport. This guidance is intended to clarify how the updated regulations apply to EMS organizations, explain when an agency becomes responsible for protecting Part 2 information, and outline practical steps agencies can take now to reduce compliance risk before the February 16, 2026, effective date.

History

March 27, 2020: Section 3221(i) of the CARES Act required HHS to modify the NPP provisions of the HIPAA Privacy Rule to align with the “Part 2” program. A Part 2 program is a federally assisted individual or entity (including a unit within a larger organization) that holds itself out as providing, and actually provides, substance use disorder (SUD) diagnosis, treatment, or referral for treatment. This meant modifying things for any covered entity that is either a Part 2 program or a covered entity that receives Part 2 records from a Part 2 program. Prior to this, there were effectively separate patient notice requirements: one under Part 2 and one under the HIPAA Privacy Rule. The goal was to align things to effectively make these separate “notice” requirements more consistent (and perhaps even require only one such notice - especially for Part 2 providers).

February 16, 2024: Final Rule (89 FR 12472) concerning “Part 2” implemented the law cited above into regulation and aligns the Part 2 rules with NPP requirements, with an effective date of 2/16/26. This so-called “Part 2” relates to SUD, and the underlying law (42 USC 290dd-2) protects the confidentiality of the records of such SUD patients. Confidentiality was an important aspect of the SUD program because concerns of discrimination or fear of prosecution (related to past substance use) could deter people from seeking SUD-related treatment.

April 26, 2024: Final Rule (89 FR 33064) modified the Privacy Rule to clarify certain disclosures based on an administrative process (such as releasing PHI to law enforcement only “where required by law”) and address the Part 2 / SUD patient notice requirements. The patient notice requirements revised 42 CFR 164.520 concerning the Notice of Privacy Practices (“NPP”) by requiring any covered entity that creates or receives Part 2 / SUD records to disclose to the patient the existence of such records and a commitment to keep such information confidential and to only release such information for certain proper reasons. It wouldn’t matter whether SUD records were received by the state, a SUD provider, or someone else. Once someone receives SUD records, they need to meet the requirements and obligations related to such records (including adding pertinent information to the NPP). Normally, a rule change would be effective within about 180 days of publication, but since the Part 2 / SUD rule would not be effective until 2026, the NPP changes (which specifically incorporate Part 2 / SUD) were delayed until 2026 as well.

January 30, 2026: Updated Fact Sheet released by HHS to help explain the interplay between Part 2 / SUD and the NPP requirements. This fact sheet suggests that any covered entity that maintains or receives SUD records must include certain disclosure language about the use of such records, patient rights, and certain limitations and restrictions concerning the use of such SUD information. This fact sheet raised alarms concerning the extent SUD records impact EMS and whether ambulance services need to update their NPPs (by 2/16/26) as a result.

What Ambulance Services Need to Do

Although receipt (and maintenance) of any Part 2 / SUD record might be rare at your ambulance service,(and there is already some overlap between Privacy requirements and the confidentiality requirements related to Part 2 / SUD), making minor adjustments to the NPP now can prevent headaches later. This is a case of “it’s better to have it and not need it than to need it and not have it.”

The first thing to consider is what constitutes an SUD record. Unfortunately, it’s broad, but there is a helpful exception. As defined under 42 CFR 2.11, SUD records mean “any information, created by, received, or acquired by a part 2 program relating to a patient (e.g., diagnosis, treatment, and referral for treatment information, billing information, emails, voice mails, and texts), and including patient identifying information.” The definition further explains that information shared orally by a Part 2 provider to a non-Part 2 provider (such as an ambulance service) offered for treatment purposes and with patient consent does not become a “record” for purposes of this definition (even if the non-Part 2 provider later reduces such information to writing).

The second thing to consider is your internal policies and procedures, existing contracts, and service area. If you already service a Part 2 provider, treat SUD patients, and receive SUD records, then there’s an immediate need to make changes to your NPP. If you are unaware of what a Part 2 / SUD provider is and are not sure whether any of your patients are SUD patients, then some additional research is warranted. If you treat SUD patients but never receive or maintain any SUD records, taking steps to further ensure that you continue to not receive SUD records might be helpful.

Now is also the time to rethink general data intake practices since you may receive protected information from other healthcare providers (face sheet, information packet, PMH, medication list, PCS form etc.) and to the extent such information is needed for your continued care of the patient and whether you need (or want) to be responsible for knowing and maintaining such information once it’s in your possession. That is, consider how much information your organization really needs to perform the ambulance transport and the HIPAA Privacy Rule notion of “minimum necessary.”

Action Plan

An ambulance service that receives SUD records has two obligations: 1) maintain the confidentiality of those records (and only release when allowed under Part 2 rules), and 2) make changes to the NPP to specifically incorporate Part 2 requirements. First, if you do receive any SUD records you, as an ambulance service, become subject to “redisclosure” requirements, and have a duty to maintain the confidentiality of such SID records (the same way you have a duty to maintain the confidentiality of PHI received and maintained about any patient that you treat). It is important to remember that simply notifying the patient of the potential for redisclosure and that records can only be released in certain situations will not insulate the ambulance service from liability in the event SUD records are improperly released or disclosed. As always, minimum necessary disclosures must occur, and SUD records must never be released if they are not required to be released.

Second, only if you are absolutely sure that you do not treat any patients or receive patient records under Part 2 / SUD (and never will), you likely do not need to change your NPP. However, if you either know that you do treat Part 2 / SUD patients (and receive/maintain SUD records) or anticipate treating Part 2 / SUD patients in the future (and receive/maintain SUD records), then you should modify your NPP to ensure that all of the requirements outlined in the April 2024 final rule are included. Sample language to insert into your NPP is as follows: 

“Notice to Part 2 / Substance Use Disorder (SUD) Patients: Consistent with amendments to 45 CFR 164.520, this paragraph applies to any patients for whom we receive and/or maintain any SUD records about you from a Part 2 provider governed by 42 USC 290dd-2. Disclosures of health information are specifically subject to and limited by any applicable stricter laws (including 42 CFR Part 2). We will only use your SUD records consistent with treatment, payment, and healthcare operations, and will grant you the same rights concerning your records as described in this NPP. Additionally, if we receive SUD records about you from a Part 2 provider subject to certain limitations, we will honor such limitations and restrictions. Please note that your SUD records may be subject to redisclosure, but only where permitted by HIPAA and/or Part 2. However, your SUD treatment records received by us from programs subject to Part 2 shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless: you provide written consent, or disclosure is required by a court order (which must be accompanied by a subpoena or other legal requirement compelling disclosure). Finally, federal rules provide patients protections with respect to internal fundraising efforts we may conduct, we will provide you with a clear and conspicuous opportunity to allow you to opt-out of any fundraising communications from us.”

Penalty for Non-Compliance

According to 42 CFR 400 et. seq., 42 USC 1320d-5 and 42 U.S.C. 1320d–6, penalties for HIPAA-related violations can range from $100 to $50,000 per violation, with a cap on penalties accrued for identical violations ranging from $25,000 to almost $2 million. Penalties for inappropriate releases of patient information are well documented. However, neither the law nor the regulations describe any specific penalty associated with the failure to include all applicable and appropriate language in the NPP. Fortunately, the failure to offer an NPP and/or omitting NPP language has historically not been a concern to OCR. The more serious and common HIPAA violations include: snooping, failure to perform a Security Risk Analysis, failure to provide patients with their own records, lack of appropriate BAAs, insufficient PHI access controls, failure to safeguard PHI on mobile devices, not meeting Breach Notification deadlines, impermissible disclosure of PHI, and improper disposal of PHI. Nonetheless, to avoid penalties for non-compliance and to protect yourself in the event you do receive Part 2 / SUD records, consider your service model and adjust your NPP today if required.

Remember, since this involves the NPP (which is required of “covered entities”) if your ambulance service is not a covered entity, then this does not impact you. Also remember that if you are a Part 2 provider directly (e.g., a MIH service that meets the Part 2 provider definition, then certain Part 2 notice requirements also apply (see 42 CFR 2.22, which largely mirror the NPP requirements under HIPAA’s privacy rule).

This means that if a Part 2 provider shares information about a patient to an ambulance service verbally and that information becomes part of the ambulance service’s written PCR, it is not deemed a Part 2 record.