HHS finalized the Confidentiality of Substance Use Disorder Patient Records regulation in the Feb. 16 Federal Register.^[1] The rule—42 C.F.R. Part 2—goes a long way towards harmonizing with HIPAA and the Health Information Technology for Economic and Clinical Health Act. Part 2 programs are now subject to the breach notification obligations of HIPAA and its civil and criminal penalties instead of the criminal penalties of the original law. It also provides for a new one-time consent form that mirrors HIPAA’s, allows redisclosure of Part 2 records, and builds a fortress around so-called SUD counseling notes.^[2] This draft authorization was developed by UofL Health in Kentucky. Contact Shelly Denham, senior vice president and chief compliance officer at UofL Health, at shelly.denham@uoflhealth.org.