Programs with SUD records in behavioral health had to update consent, notice and breach policies for the revised 42 CFR Part 2 by Feb. 16, 2026.
Ask most compliance or nursing leaders what policies they have to have and you’ll get a confident answer for their own department and a shrug for everything else. That’s not a diss on anybody. Federal requirements for written policies are scattered across different regulations, vary depending on the care setting, and have review cycles that don’t line up.
Here’s a summary of requirements for three settings we work in every day: critical access hospitals, skilled nursing facilities and behavioral health programs. Each requirement is cross-referenced to the regulation or agency guidance it is derived from so you can check the source yourself. This is a starting point for a policy review, not legal advice, and your state and accreditor may add their own requirements.
If you want an example of how specific federal policy requirements can get, start here. CMS’s emergency preparedness rule applies to most all types of Medicare and Medicaid providers and it’s not just looking for a plan. It calls for written policies and procedures based on that plan, a risk assessment and a communication plan. It puts a clock on reviewing those policies and procedures.
The clock is not the same for all. Critical access hospitals must review and update its emergency preparedness policies and procedures at least every 2 years. A long-term care facility must do the same at least annually, as well as its emergency plan, communication plan and training program. Nursing homes also must conduct drills twice a year, including unannounced staff drills.
It’s a small difference, but it’s the kind of thing that trips teams up. A policy set copied from a hospital or a review calendar built around one setting can quietly throw another out of compliance.
The written policy requirement in the federal rules is among the simplest for CAHs. The services of a CAH are to be provided in accordance with written policies required by the CAH Conditions of Participation. The regulation spells out what those policies must contain:
The same section explains who writes them and how often they are revisited. Policies are developed with input from the CAH’s professional staff, including at least one physician and one PA, NP or clinical nurse specialist, if they are on staff. The group has to review them every 2 years at least and the CAH updates them as necessary.
The real question for a small team is not do those policies exist somewhere. It's if you could show a surveyor the list, the last review of the advisory group and what changed because of it.
Nursing homes don’t get a clean list like CAHs get. The long-term care requirements in 42 CFR Part 483 are written out policy by policy, so they’re easy to miss if you don’t know where to look. Some of the most important ones:
Operators with more than one building face the challenge of consistency. Every facility needs these policies, and every facility needs to be the current copy. Corporate updates that only reach some buildings are still a gap.
Of the three, behavioral health is the most difficult to generalize because the needs are different depending on what kind of program you operate. A psychiatric hospital, a community mental health center and an outpatient counseling practice are subject to different federal rules, state licensing agencies and accreditors such as CARF or The Joint Commission.
One federal requirement runs through many of them, and it’s a new one. Programs with a history of treating substance use disorders are subject to 42 CFR Part 2, which HHS substantially modified in 2024. The HHS fact sheet gave organizations until Feb. 16, 2026 to comply with the amended rule.
The changes go directly into written policy. The rule now permits one patient consent to cover future uses and disclosures for treatment, payment and health care operations; harmonizes Part 2 notice requirements with HIPAA; and introduces HIPAA-style enforcement and breach notification to Part 2 records. For most programs, that means revising consent forms, privacy notices, breach procedures and staff training.
If you haven’t updated your SUD confidentiality policies since early 2026, that’s a good place to start. What was right two years ago is not necessarily right today.
Having a list of requirements only helps if it changes what your team does next. A simple way to use this one is:
The Ntracts Policy Manager puts every policy, its review cycle and its approval history all in one place so a missed annual review is flagged before a surveyor spots it. In our Policy & Procedure Library, we have care-setting libraries for Critical Access Hospitals, Long Term Care and Behavioral Health that include manuals that are cross-referenced to CMS regulations and accreditation standards. For example, the Long Term Care Library has a dedicated Infection Prevention and Control Manual, a Long Term Care Environment of Care Manual and an Influenza Pandemic Preparedness Guide so the requirements above have a starting point. And StayAlert! tracks federal agencies and accrediting bodies daily, and emails your team when there’s a change.