In this three-part series, we investigate the duties of SUD providers under Part 2 in the face of subpoenas and investigations. Part One discussed the contours of the duties in the face of a subpoena, while Part Two walked you through what happens when your employees are contacted by investigators. Part Three will guide you throughout the investigatory process.

Receiving a subpoena or learning that your program is under investigation is concerning and stressful, but there are proactive steps you can take to protect your patients, your staff, and your program while demonstrating good faith cooperation. More >

In this three-part series, we investigate the duties of SUD providers under Part 2 in the face of subpoenas and investigations. Part One discussed the contours of the duties in the face of a subpoena, while Part Two walks you through what happens when your employees are contacted by investigators.

In a Medicaid fraud investigation, it is common for investigators, whether from a state attorney general’s office, an inspector general, or another agency, to contact your employees directly. They may show up at your facility, call staff members, or request informal interviews with your employees outside the work environment. Just as it is important to train employees on HIPAA compliance, SUD program employees must also be trained on Part 2. More >

Part 2 increases protections for SUD patient records because of the stigma and legal consequences associated with substance use treatment. Protecting patient records serves an important public health interest, because weakening confidentiality discourages patient participation in treatment. Federal courts have enforced Part 2 to protect patients. The increased privacy protection for substance use treatment was originally intended to prevent prosecution of patients in active treatment programs, and it still does. While Part 2 is not a new regulation, it did undergo major changes when the 2024 Final Rule was adopted on April 16, 2024 (with a two-year implementation period). Enforcement for the updated Part 2 rules began on February 16, 2026, when the HHS Office for Civil Rights (“OCR”) launched a civil enforcement program and began accepting complaints alleging Part 2 violations and breach notification violations.

Substance use disorder (“SUD”) treatment providers face increasing scrutiny from Medicaid fraud and control units and other government agencies that regularly use subpoenas as an early investigation tool. The United States Department of Health and Human Services (“HHS”) Office of Inspector General (“OIG”) Work Plan also targets SUD providers and focuses on billing accuracy, regulatory compliance, patient monitoring, and other provider-related issues. Because SUD treatment is now provided in such a wide range of settings — including rural health clinics, physician practices, federally qualified health centers, primary care centers, behavioral health providers, hospitals, and independent treatment programs — these providers are targets for heightened oversight but are also subject to complex federal privacy laws that mandate extra protection for the private health information of SUD patients. SUD providers should actively manage these regulatory risks. Although a subpoena may feel urgent and intimidating, federal privacy law strictly limits what SUD providers may disclose, even when the request comes from law enforcement or a state agency. SUD providers must understand and comply with their privacy obligations when responding to the first-line investigative tool, the subpoena. More >

Patients are increasingly generating their own health data through wearables and apps, transforming how providers engage with them. However, much of this data falls outside HIPAA’s protections, creating legal gaps. With Kentucky’s Consumer Data Protection Act (KCDPA) taking effect in January 2026, these gaps will become even more complex for providers to navigate. More >

America’s healthcare system is often described as a patchwork: a mix of public programs, private insurance, and stopgap laws meant to catch people before they fall through the cracks. But what happens when several of those safety nets are weakened or removed all at once? More >

Leaving medical school and entering residency is a daunting transition in the career of a new physician, presenting a new set of legal rules and requirements, including employment contracts and malpractice liabilities. We recommend familiarizing yourself with your program’s relevant manuals and policies and seeking legal advice when necessary. More >

With the OIG’s May 30, 2025, announcement that they are seeking $454.4 million in funding to fight healthcare fraud, healthcare providers can expect increased governmental scrutiny despite Trump’s budget cutbacks and staff layoffs.  The OIG justifies its budget request by pointing out that for every $1 invested, there is an expected return of $11 in government recoveries and receivables, which fuels the Trump administration’s fight on fraud, waste, and abuse in health care. What this means for health care providers is intensified scrutiny and likely use of AI as a tool to evaluate big data to identify potential false claims, fraud, outliers, etc. Considering the OIG’s 90-page new General Compliance Guidance, healthcare providers’ self-policing strategies and internal audits are more important than ever as the heat turns up on alleged fraud and false claims. More >

As of January 1, 2025, medical cannabis is legal in Kentucky. Physicians and nurse practitioners who want to create access for their patients to this important treatment must become authorized to certify patients for medical cannabis and should be extremely careful to comply with confusing and complex regulatory requirements. More >

Healthcare workplace violence is a recognized hazard in the healthcare industry. The U.S. Bureau of Labor Statistics reported in 2018 that approximately 73% of all nonfatal workplace violence injuries involved healthcare workers.[1] Even then, the incidence of workplace violence is likely higher due to underreporting.[2] Combined with the increased stress, isolation for patients and providers, and continued staffing issues and burnout, workplace violence has become one of the main contributors for healthcare workers to leave the field.[3]

More >