SUD Records and Medicaid Work Requirements: What Part 2 Programs Should Know

On September 29, 2026, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) issued guidance clarifying when state Medicaid agencies may use substance use disorder (SUD) patient records protected under 42 CFR part 2 (Part 2) to verify whether an individual is excluded from Medicaid’s community engagement requirement (the Requirement), often referred to as work requirements. The guidance addresses the intersection of Part 2’s confidentiality protections and states’ obligation to use available, reliable information to verify compliance with or exclusion from the Requirement, which conditions Medicaid eligibility on participating in certain approved activities, without requiring applicants and beneficiaries to submit additional information where possible. Certain individuals diagnosed with SUD, including those who meet the criteria for being medically frail or otherwise having special medical needs¹ and those participating in certain SUD treatment programs, are excluded from the Requirement.

Background

Under Part 2, “[r]ecords of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to SUD education, prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States” are protected from disclosure unless the patient consents. These SUD record protections apply to any program directly or indirectly assisted by the government, including residential and outpatient treatment programs and some digital health programs. Part 2 protections are meant to help address concerns that discrimination and fear of prosecution deter people from obtaining treatment for SUD. Exceptions to SUD record protections include scientific research, government audits and evaluations, vital statistics reporting, qualified service organization agreements, disclosures to public health authorities, and disclosure for treatment, payment, and healthcare operations (TPO) after the subject individual has consented to such disclosure.

As of June 1, 2026, under the Requirement, Medicaid recipients must meet an 80-hour-per-month work requirement as a condition of eligibility. This particular requirement was created by the Working Families Tax Cut Legislation and implemented by a 2026 rulemaking. The requirement generally applies to nonpregnant adults between the ages of 19 and 64 who are enrolled in or eligible for Medicaid and are not entitled to or enrolled in Medicare. Recipients will be required to demonstrate 80 hours per month of qualifying activities (such as employment, participation in certain work programs, or community service) or be enrolled in an educational program at least half time. States must implement this updated requirement by January 1, 2027.

Two Consent Pathways for Verifying an Exclusion

Existing consent for treatment, payment, and healthcare operations. A state Medicaid agency may use SUD records to verify an exclusion when the use is consistent with a written patient consent previously obtained by a Part 2 program for all future treatment, payment, and healthcare operations (TPO) uses and disclosures. For example, where a program discloses SUD records to an agency to submit a claim under a qualifying TPO consent, the agency may later use those SUD records to verify an exclusion without obtaining additional patient consent. OCR explains that exclusion determinations may involve both payment and healthcare operations activities.

The Part 2 program must include a copy of the consent or a clear explanation of its scope with the disclosed SUD records, as well as the required statement that Part 2 prohibits unauthorized use or disclosure under 42 CFR § 2.32.

Consent obtained by the Medicaid agency. Alternatively, an agency may obtain written patient consent to use SUD records it already holds specifically to determine whether an exclusion applies or for all future TPO uses and disclosures. This pathway may be relevant where the agency originally received SUD records under a narrower consent, such as one limited to payment. Consent obtained by the agency must satisfy 42 CFR § 2.31(a), including the requirements concerning revocation and an expiration date or event.

Continuing confidentiality protections. Part 2 protections continue to apply to SUD records used under either pathway. OCR emphasizes the restrictions on using or disclosing SUD records to initiate or substantiate criminal charges, conduct a criminal investigation, or use the SUD records in civil, criminal, administrative, or legislative proceedings against a patient. A separate patient consent is required for use or disclosure in an investigation or proceeding against the patient under 42 CFR § 2.31(d). These protections also apply when a patient obtains the SUD records and discloses them directly to a recipient.

Part 2 programs should consider reviewing their patient consent forms and disclosure procedures to assess whether existing TPO consents support Medicaid agencies’ use of SUD records to verify exclusions from the Requirement. Providers should also confirm that disclosures include the required consent documentation and Part 2 notice, train staff on continuing restrictions on use and disclosure, and coordinate with state Medicaid agencies to address situations in which additional patient consent may be needed. These steps can help eligible patients maintain Medicaid coverage while preserving the confidentiality protections central to SUD treatment.

***

The Goodwin Healthcare team will continue to monitor these developments and their potential impact on healthcare providers and other industry participants. For more information on the issues discussed in this alert, please contact the authors, reach out to our Healthcare Regulatory and Compliance group, or contact the Goodwin lawyer with whom you typically consult.

Explore more coverage of emerging topics of interest to the healthcare industry on our Health Headlines page.