Top of the World Ranch, an Illinois addiction treatment center, paid OCR $103,000 after OCR found evidence it failed to do an accurate and thorough risk analysis. OCR (the HHS Office for Civil Rights) announced it on February 19, 2026. That was three days after OCR began enforcing 42 CFR Part 2, the privacy rule for substance use disorder records.
On February 19, 2026, the HHS Office for Civil Rights made a quiet announcement that should have every substance abuse treatment provider in the country paying attention.
A Milan, Illinois addiction treatment center called Top of the World Ranch Treatment Center paid $103,000 to OCR. It also agreed to a corrective action plan, which is a list of required fixes. OCR will monitor that plan for two years. It started when an employee clicked the wrong email.
That’s not the scary part. The scary part is why this settlement hits differently than most.
What Happened at Top of the World Ranch
Someone at Top of the World Ranch fell for a phishing email. An outsider got into that worker's email account. The facility later concluded that the electronic health information of 1,980 patients was compromised.
The facility reported the breach in March 2023. OCR then opened an investigation. Here’s what they found: Top of the World Ranch had failed to do an accurate and thorough risk analysis.
A risk analysis is the HIPAA step where you find where your patient data lives and what could put it at risk. OCR found evidence that this one was not accurate and thorough.
That single failure (not assessing where their weak spots were, not identifying what needed protecting) turned a phishing incident into a six-figure settlement and a two-year corrective action plan.
This was OCR’s 11th enforcement action under its Risk Analysis Initiative. OCR started that effort to go after organizations that skip the risk analysis step. OCR has been extremely consistent: they will find you, they will investigate, and they will settle. The 2025 enforcement data shows risk analysis failures again and again. It is one of the most common reasons practices get fined.
The 42 CFR Part 2 Angle Changes Everything
Here’s what makes this settlement more than just another HIPAA settlement story.
Top of the World Ranch is a substance use disorder (SUD) treatment provider. On February 13, 2026, six days before this settlement was announced, OCR officially announced its civil enforcement program for 42 CFR Part 2. That program started on February 16, 2026. That was also the day providers had to start following the rule.
For those who aren’t familiar: 42 CFR Part 2 is a federal rule that has protected the privacy of substance use disorder patient records since the 1970s. It’s separate from HIPAA. It’s stricter than HIPAA. Until February 2026, it was overseen by the Substance Abuse and Mental Health Services Administration (SAMHSA), not OCR. It also had no civil enforcement program at all before then.
That changed. OCR now enforces both.
This matters enormously for behavioral health providers. The agency that aggressively pursues HIPAA breaches (the one with the Risk Analysis Initiative, the one behind a long list of settlements and fines in 2025) now also oversees your SUD patient records.
And the penalties? They match HIPAA’s. The current inflation-adjusted penalty amounts sort violations into four levels of fault. For the three lower levels, fines run from $145 to $73,011 per violation. For willful neglect that is not corrected (knowingly or carelessly ignoring the rules, then not fixing it), fines run from $73,011 to $2,190,294 per violation. The most you can be fined in one year for violations of the same requirement is $2,190,294.
What 42 CFR Part 2 Actually Requires
The 2024 rule update (published in February 2024, and required starting February 16, 2026) brought Part 2 closer to HIPAA, which sounds like simplification. In some ways it is. But compliance is still non-trivial.
The biggest practical change: patients can now give a single consent covering all future treatment, payment, and healthcare operations disclosures (each time you share the records for those reasons). Before, consents were much narrower, so practices often had to ask for new ones. That was genuinely burdensome, so this is a real improvement.
But the protections that make Part 2 strict are still fully in place:
SUD Counseling Notes Require Separate Consent
You cannot bundle a consent for counseling notes with consent for anything else. This is an absolute prohibition, not a best practice.
Disclosure Documentation Travels with the Record
When you disclose SUD records, a copy of the patient’s consent (or a clear explanation of its scope) must accompany those records. Every time.
Criminal Justice Protections Are Ironclad
A patient’s SUD records cannot be used to investigate or prosecute them without their written consent or a court order. Full stop. This applies even when law enforcement comes knocking.
Notice of Privacy Practices Must Be Updated
If you hold Part 2 records, your NPP needs an update. NPP stands for Notice of Privacy Practices, the notice that tells patients how you use their information. It must describe how Part 2 records are used and shared under the stricter Part 2 rules. It must also say these records cannot be used against the patient in court or other legal proceedings, unless the patient gives written consent or a court orders it.
The deadline to update your NPP was February 16, 2026. If you hold Part 2 records and haven’t updated it, you’re already behind. This is the kind of paperwork rule that is easy to miss, similar to the ‘addressable’ doesn’t mean ‘optional’ misunderstanding that trips up so many practices.
Who 42 CFR Part 2 Applies To
If your practice or organization qualifies as a “Part 2 Program,” you’re covered. A Part 2 program is federally assisted, and it presents itself as offering SUD diagnosis, treatment, or referral for treatment.
“Federally assisted” is broad. It includes things like taking part in Medicare, being registered with the DEA to dispense controlled substances used in SUD treatment, getting federal funds, or having tax-exempt status. Covered programs can include:
- Federally assisted substance abuse treatment programs
- Detox centers and residential treatment facilities
- Outpatient SUD counseling programs
- Methadone clinics and MAT (medication-assisted treatment) providers
- Employee assistance programs that provide SUD counseling
- Any federally assisted provider that presents itself as offering SUD diagnosis, treatment, or referral for treatment
If you’re a hospital, health system, or behavioral health network that also treats SUD patients, you may have Part 2 duties even if SUD isn’t your primary focus. In a general medical facility, the rule covers two groups. One is a unit identified as an SUD unit. The other is staff identified as having SUD diagnosis, treatment, or referral as their main job.
4 Things You Need to Do Right Now
The Top of the World Ranch case is instructive because the fix is not complicated. The facility didn’t pay for something exotic. They paid for skipping the fundamentals.
1. Do a Risk Analysis, For Real
This isn’t a checkbox exercise. You need to identify every place ePHI lives in your practice (including SUD records), map how it moves, identify threats and weak spots, and write down how risky each one is. If you’ve never done this, or if it’s been more than 12 months, do it now.
The proposed HIPAA Security Rule update would require you to review your risk analysis at least once a year. It was published in January 2025 and is not final yet. Under current rules, OCR already says to redo your risk analysis from time to time and update it as needed. Need a step-by-step walkthrough? The risk assessment guide covers what OCR actually looks for.
2. Update Your Notice of Privacy Practices
Your NPP needs to reflect both HIPAA and Part 2 rules. Add the Part 2 statements that 45 CFR 164.520 requires. (Section 164.520 is the HIPAA rule on what your notice must say.) The HHS Part 2 page is a good place to start. Patients need to understand what consent is required before their SUD records can be shared.
3. Train Your Staff on Phishing, Specifically
Top of the World Ranch’s breach started with one employee clicking one email. Security awareness training isn’t a one-time event. Your staff should know how to identify phishing attempts, what to do when they suspect one, and who to contact right away if they think they’ve been compromised. The UMMC ransomware case shows what an attack can look like at a larger scale. Human error is often the way in.
4. Lock Down Your Email with MFA
Email is a common entry point for healthcare data breaches, as this case shows. If you handle SUD records, turn on multi-factor authentication (MFA) for every email account. MFA means a second check beyond a password, like a code sent to your phone.
The proposed HIPAA Security Rule update would make MFA mandatory across the board. That rule is not final yet. But for behavioral health providers under Part 2 scrutiny right now, waiting is a risk you can’t afford.
The Bottom Line for SUD Treatment Providers
OCR has made this very clear: they are actively pursuing risk analysis failures. They have a specific effort for it. This case was the 11th enforcement action under that effort. And as of February 2026, they also own Part 2 enforcement.
If you run a substance abuse treatment program, a behavioral health practice, or any organization that touches SUD patient records, you now answer to OCR for both HIPAA and Part 2. OCR enforces the HIPAA Security Rule, and now it has brand-new Part 2 authority too. That gives OCR more tools and more say over your records than before.
Top of the World Ranch failed to do an accurate and thorough risk analysis. It paid $103,000 and will spend two years under a corrective action plan that OCR monitors. That’s an avoidable outcome. Don’t make the same mistake.
Key stat: The Top of the World Ranch case was OCR's 11th enforcement action under the Risk Analysis Initiative. It was a HIPAA Security Rule case. OCR now enforces both HIPAA and Part 2, so SUD treatment providers answer to the same agency for both.
Sources
- 42 CFR Part 2: Confidentiality of Substance Use Disorder Patient Records
- HHS: HIPAA and 42 CFR Part 2 Alignment
- HHS OCR Resolution Agreements
- HHS: OCR Settles HIPAA Security Rule Investigation with Top of the World Ranch Treatment Center (February 19, 2026)
- HHS: OCR Announces Civil Enforcement Program for SUD Patient Records (February 13, 2026)
- 45 CFR 164.308(a)(1): Risk Analysis Requirements
Related Reading
- HIPAA Violations and Penalties: The Complete Guide
- HIPAA Fines in 2025: Who Got Caught and Why
- How to Run a Risk Assessment That Won’t Get You Fined
- MFA Could Soon Be Required for HIPAA
- HIPAA Fines Just Went Up: The Current Penalty Amounts
- The 15 Most Common HIPAA Violations and How to Prevent Them
- The Proposed HIPAA Security Rule Changes
Need help getting your practice in line with both HIPAA and 42 CFR Part 2? One Guy Consulting offers affordable HIPAA compliance packages starting at $60 a month. Explore HIPAA compliance services or read about HIPAA for behavioral health
Frequently Asked Questions
What is 42 CFR Part 2 and how does it differ from HIPAA?
42 CFR Part 2 provides additional confidentiality protections for substance use disorder treatment records that go beyond standard HIPAA requirements. Disclosures require specific patient consent in most cases, and records cannot be shared as freely as other medical records even for treatment purposes.
Why did a substance use disorder clinic pay OCR $103,000?
It was a HIPAA Security Rule settlement, not a Part 2 case. A phishing attack let an outsider into a worker's email account. The electronic health information of 1,980 patients was compromised. OCR's investigation found evidence that Top of the World Ranch Treatment Center failed to do an accurate and thorough risk analysis. The center paid $103,000. It also agreed to a corrective action plan (a list of required fixes) that OCR will monitor for two years.
Who is subject to 42 CFR Part 2?
Part 2 applies to programs that are federally assisted and present themselves as offering substance use disorder diagnosis, treatment, or referral for treatment. Federally assisted is broad. It includes things like taking part in Medicare, being registered with the DEA to dispense controlled substances used in SUD treatment, getting federal funds, or having tax-exempt status. In a general medical facility, it covers two groups: a unit identified as an SUD unit, and staff identified as having SUD diagnosis, treatment, or referral as their main job.
Can substance abuse records be disclosed in emergencies under Part 2?
Yes, in a narrow way. In a real medical emergency, a program can share records with medical staff when it cannot get the patient's written consent first. It can share only what is needed to handle the emergency. Right after, the program must note the disclosure in the patient's record: who received it, who shared it, the date and time, and the nature of the emergency.