A substance abuse center is usually insured by a package built around the building: general liability, property, maybe workers' comp. That package answers for a visitor who slips in the lobby. It is not automatically built for the two exposures that drive the costly claims in this sector — a patient in your care, and a patient record that leaves your custody. 2026 put a hard date on the second one.
The Part 2 compliance deadline has passed — and it carries penalties now
42 CFR Part 2 is the federal rule governing confidentiality of substance use disorder (SUD) treatment records. The 2024 final rule aligned Part 2 with HIPAA's enforcement structure and set a compliance deadline of February 16, 2026 (HHS fact sheet). As one compliance advisory summarizes the amendments, HIPAA penalties now apply to Part 2 records, and the HIPAA Breach Notification Rule extends to breaches of SUD records. A records-handling error that used to be a compliance matter is now a penalty-and-notification matter.
The scope is explicit: HHS's OCR breach portal states that OCR investigates all breaches of protected health information and Part 2 records affecting 500 or more individuals. In April 2026, OCR announced settlements in four ransomware investigations — one breach affected 244,813 individuals, with exposed data including names, dates of birth and diagnosis information.
In your cyber policy, check: whether the definition of protected records names Part 2 SUD records specifically; whether breach-response costs cover the notification obligations the amended rule imposes; and whether the response panel is contracted. The gap is rarely the limit — it is whether SUD records sit inside the definition.
The abuse-and-molestation question
Ask your broker, in writing, which abuse-and-molestation endorsement is attached to your general liability form — the form number is printed on the schedule of forms in your policy — and what it says about abuse of a person in your care, custody or control. Where abuse and molestation coverage is added back by endorsement, ask what the sublimit is, and whether it reaches volunteers and contracted clinicians or only employees. Our guide to abuse and molestation coverage walks through how the carve-out works.
Care, custody, and control
A third clause overlaps both. Care, custody, and control (CCC) is described by commercial insurers as a common exclusion in general liability policies; an industry glossary puts the consequence plainly: because of it, general liability may not cover the damages. A treatment center is, definitionally, an organization that takes people into its care, custody and control — which is why professional liability exists as a separate form for claims arising from clinical services.
The pre-renewal forms check
- Pull the declarations page and schedule of forms. Find the abuse-and-molestation endorsement and note whether abuse and molestation is excluded, sublimited, or added back — and at what limit.
- Ask the CCC question in writing. What does your general liability form do when the injured person was in your care, custody or control?
- Confirm Part 2 sits inside the cyber definition. SUD records, notification costs, the response panel.
- If funding volatility forces layoffs or a restructuring, confirm employment practices liability and D&O are in place before the decision, not after — those are the forms written to answer fast board decisions about staff and service lines.
- Take the answers to a broker who works with behavioral health — see our mental health industry page — 90 days before renewal. Gaps found at renewal are priced worse than gaps found a quarter out.
FAQ
Is substance abuse center insurance different from ordinary nonprofit insurance? It sits in a higher-risk category because of the population served, the clinical exposure, and the confidentiality regime. That affects which forms are available and what the declarations page says — which is why the review is a forms check, not a price comparison.
Does 42 CFR Part 2 apply to us if we are not a certified program? Part 2 applies to federally assisted programs holding records identified as coming from a substance use disorder program. Whether your organization qualifies is a specific legal question worth getting in writing rather than assuming.