42 CFR Part 2 compliance for EMS requires agencies that may receive SUD records to update their Notice of Privacy Practices before the February 16, 2026 deadline
From our friends at PWW:
EMS 42 CFR Part 2 compliance is now a critical consideration for ambulance providers following the recent Final Rule issued by the Department of Health and Human Services (HHS).
On February 16, 2024, HHS finalized updates aligning substance use disorder (SUD) confidentiality protections more closely with HIPAA while maintaining heightened privacy safeguards.
Agencies that may receive SUD records should review their Notice of Privacy Practices well before the February 16, 2026 compliance deadline.
Why EMS 42 CFR Part 2 Compliance Matters
EMS agencies typically do not originate Part 2 records. However, agencies may receive them, particularly when transporting patients to or from facilities that specialize in substance use treatment.
For example:
-
A treatment facility may provide patient documentation to the transport crew
-
Records could accompany interfacility transfers
-
Clinical information may be shared to support continuity of care
Once received, those records carry specific federal protections.
Because of this possibility, many healthcare compliance professionals recommend that EMS agencies proactively update their Notice of Privacy Practices (NPP) to address Part 2 protections — even if SUD records are encountered infrequently.
Taking a proactive approach reduces regulatory risk and demonstrates a strong organizational commitment to patient privacy.
What the Final Rule Requires
Under the updated regulation, HIPAA-covered entities that create or receive SUD records must ensure their privacy notices accurately reflect how this information is handled.
For EMS agencies, this means reviewing and revising your Notice of Privacy Practices to clearly communicate the following:
How SUD Records May Be Used and Disclosed
Patients must be informed about when and why their SUD information may be shared, including for treatment, payment, and healthcare operations when appropriate consent exists.
Patient Rights and Organizational Responsibilities
Your notice should explain the protections surrounding these records and reinforce your agency’s obligation to safeguard sensitive information.
Potential for Redisclosure
If SUD information is disclosed appropriately, patients must understand that redisclosure may occur under certain permitted circumstances.
Restrictions on Legal Use
Part 2 records generally cannot be used in civil, criminal, administrative, or legislative proceedings against a patient without written consent or a valid court order. This remains one of the strongest privacy protections in federal healthcare regulation.
Understanding EMS 42 CFR Part 2 compliance now can help agencies avoid regulatory risk later.
Recommended Action: Update Your Notice of Privacy Practices
Even if your agency rarely interacts with SUD treatment facilities, updating your Notice of Privacy Practices is widely considered a best practice.
Agencies should consider taking the following steps well before the 2026 deadline:
-
Review your current Notice of Privacy Practices
-
Consult legal or compliance counsel if needed
-
Incorporate Part 2 language addressing SUD records
-
Educate leadership and privacy officers
-
Train staff on heightened confidentiality expectations
Early preparation helps avoid last-minute operational disruption.
Sample Language for Agencies
Although HHS has not issued official model language, healthcare counsel and compliance professionals have begun developing recommended wording that agencies may incorporate into their privacy notices.
PWW has shared sample language with clients to support compliance planning and simplify the update process.
A Broader Trend Toward Stronger Privacy Expectations
The modernization of Part 2 reflects a larger regulatory movement toward:
-
Greater patient control over health data
-
Increased transparency
-
Stronger enforcement mechanisms
-
Alignment across federal privacy frameworks
For healthcare providers — including EMS — privacy compliance is no longer just a regulatory obligation. It is a core component of organizational risk management.
How ARS Supports Clients Through Regulatory Change
At Ambulance Reimbursement Systems, we continuously monitor federal and state regulatory developments so our clients can stay focused on operations and patient care.
Our team regularly assists agencies with:
-
Billing compliance guidance
-
Documentation standards
-
Regulatory awareness
-
Operational best practices
Healthcare regulations will continue to evolve — but with the right partner, your agency does not have to navigate them alone.
You can review the official HHS fact sheet HERE
Final Thoughts
February 16, 2026 is upon us!
If your agency has questions about the Part 2 Final Rule or would like assistance reviewing compliance considerations, our team is always available to help.
Ambulance Reimbursement Systems continues to monitor regulatory changes impacting EMS 42 CFR Part 2 compliance and patient privacy standards.