What happened
On September 29, 2026, the HHS Office for Civil Rights issued a press release titled “HHS Office for Civil Rights Clarifies Privacy Rules for State Medicaid Programs.” The release says it clarifies when 42 CFR Part 2 allows a state Medicaid agency to use a Medicaid applicant’s or beneficiary’s substance use disorder records to verify an exclusion from the community engagement requirement. It says the guidance helps agencies use information they already have while still protecting those records.
The release says Part 2 generally applies to any federally assisted program that provides substance use disorder diagnosis or treatment, called a Part 2 program, and that some Part 2 requirements also apply to people and organizations that receive Part 2 records from such a program, naming Medicaid as one example. It does not describe any new obligations for providers. The release links a PDF that appears to be an FAQ, which we have not read.
What we have not verified
We have not read the linked PDF, so we are not describing its contents beyond what the press release states.
Analysis: This guidance is narrow. Most ABA clinics do not diagnose or treat substance use disorders and are not Part 2 programs, so for them nothing changes. The question worth a minute is whether any part of the organization, such as an affiliated entity or a service line, does hold itself out as providing substance use disorder treatment, because Part 2 rules then sit on top of HIPAA for those records. The release also shows that OCR is still issuing guidance on how records can move to and from Medicaid, which is a payer many ABA clinics bill. This is reporting, not legal advice.
Compliance you can actually show.
WiseUpHIPAA is built for ABA clinics. It works out what applies to you, holds your decisions and the evidence behind them, and shows you honestly where you stand, including the parts that are not done yet.