The regulatory landscape for substance use disorder (SUD) treatment records is changing—and the impact will extend far beyond traditional addiction treatment programs. With treatment options for SUD limited, some providers are exploring ketamine as a potential therapy due to its effects on glutamatergic neurotransmission.[i] Additionally, psychedelic-assisted therapies involving certain Schedule I substances – such as psilocybin, ibogaine, and MDMA – are currently being studied by researchers as potential treatments for SUDs.[ii] While these investigational therapies are not yet available in clinical practice and the new federal privacy rules do not apply to research records, providers should be aware of the evolving treatment landscape as these therapies move closer to potential approval and clinical use.
Most ketamine clinics offering off-label treatment for SUDs operate on a private-pay basis and do not participate in Medicare, Medicaid, or receive other forms of governmental assistance. As a result, many may not be directly subject to the new federal privacy rules under 42 CFR Part 2. However, providers who do accept federal funds (or are considering doing so), participate in Medicare billing, or have federal tax-exempt status, should carefully assess whether these new requirements apply to their practice.
If your clinic, practice, or organization uses ketamine to treat SUDs, and you participate in Medicare/Medicaid, or are supported by funds provided by any federal agency, licensed or certified by a federal agency, or benefit from federal tax-exempt status, you need to be aware of new federal privacy rules that take effect in 2026 and manage your risks accordingly.
Who Is Directly Affected by the New Federal Privacy Rules?
The new 42 CFR Part 2 Final Rule, effective February 16, 2026, applies to “federally assisted” SUD programs.[iii] This includes providers who:
- Accept Medicare or Medicaid,
- Receive federal grants or contracts,
- Are licensed or certified by a federal agency, or
- Operate under federal tax-exempt status.
If your clinic falls into any of these categories, you are required to comply with the updated privacy, consent, and notice requirements for SUD records.
Key compliance steps include:
- Updating your Notice of Privacy Practices (NPP) to reflect new SUD record rules,
- Implementing expanded patient consent and disclosure procedures,[iv]
- Ensuring staff are trained on the new requirements, and
- Preparing for enhanced enforcement and potential penalties for non-compliance.
What About Clinics That Are Not “Federally Assisted”?
If your clinic is private pay only, does not bill insurance, and receives no federal funding, you are likely not directly subject to 42 CFR Part 2. However, you are still subject to general privacy and confidentiality obligations under state law, [v] professional ethics,[vi] and potentially HIPAA[vii] (if you conduct electronic transactions or partner with covered entities).
Best practices for all clinics include:
- Maintaining clear, written privacy policies and procedures,
- Training staff on confidentiality, especially regarding SUD and mental health records,
- Being transparent with patients about how their information is used and protected, and
- Staying informed about changes in federal and state law that could impact your practice as the industry evolves.
Why Stay Informed About Part 2 and Other Federal Rules?
As insurance coverage and federal funding for psychedelic-assisted therapies expands, or as your clinic grows or changes its business model, you may become subject to these federal regulations in the future. Additionally, as new therapies like MDMA- or psilocybin-assisted treatment move closer to clinical approval, the regulatory landscape could shift rapidly.
By establishing strong privacy and compliance practices now, your clinic will be better prepared for future opportunities and regulatory changes.
Practical Steps for Ketamine Providers
- Assess Your Funding and Billing Sources:
Determine whether you currently receive any federal funds or participate in insurance programs that could trigger Part 2 applicability.
- Review and Update Your Privacy Policies:
Even if Part 2 does not apply, robust privacy practices help protect your patients and your business.
- Monitor Industry and Regulatory Developments:
Stay updated on changes to federal and state regulations, as well as insurance coverage trends for SUD and psychedelic therapies.
- Consult Legal Counsel as Needed:
Proactive legal review can help you avoid costly compliance missteps and position your clinic for growth.
Conclusion
The evolving regulatory landscape for SUD treatment records is complex, especially as new therapies and payment models emerge. Whether or not your clinic is directly affected by the new federal rules, strong privacy and compliance practices are essential for protecting your patients and your practice. If you have questions about your clinic’s obligations or want help preparing for future regulatory changes, contact us for tailored guidance.
[i] Reinhard Janssen-Aguilar et al., Role of Ketamine in the Treatment of Substance Use Disorders: A Systematic Review, 175 J. SUBSTANCE USE & ADDICTION TREATMENT 209705 (2025), https://doi.org/10.1016/j.josat.2025.209705.
[ii] Morisano, Dominique, Thomas F. Babor, Brian Rush & Doris Payer, From Research to Reality: Crafting an Image of the Current State of Psychedelic-Assisted Psychotherapies for Substance Use Disorders, 85 J. STUD. ON ALCOHOL & DRUGS 577, 577–82 (2024), https://doi.org/10.15288/jsad.24-00208. See also, Marsden J, Kelleher M, Dunbar F, Ermakova AO, Mitcheson L, Roberts C, et al. 5-Methoxy-N,N-dimethyltryptamine (5-MeO-DMT) for alcohol use disorder: An open-label, phase 2, proof-of-concept, clinical trial. Addiction. 2025. https://doi.org/10.1111/add.70260.
[iii] 42 C.F.R. § 2.12(b).
[iv] 42 C.F.R. § 2.32.
[v] A couple of examples of state privacy laws include California’s Confidentiality of Medical Information Act codified at Cal. Civ. Code §§ 56-56.16 and Texas’s Medical Records Privacy Act codified at Tex. Health & Safety Code §§ 181.001 et seq.
[vi] See AMA Code of Medical Ethics Opinion 3.2.1; APA Ethics Code Standard 4.01
[vii] 45 C.F.R. §§ 160, 164