Starting February 16, 2026, the consent process at intake will fundamentally change. The new “Single Consent” for Treatment, Payment, and Operations replaces the stack of separate authorization forms you’ve been managing for years. This is the mechanism that allows the emergency room physician to see your patient’s medication list when seconds matter.
Under the old rules, every time a patient changed insurance, saw a new specialist, or moved to a different provider, you handed them another consent form. The CARES Act fixed this by aligning 42 CFR Part 2 with HIPAA privacy rules, creating a single durable consent for treatment, payment, and healthcare operations (HHS, 2024).
One patient signature now authorizes sharing their substance use disorder records with treating providers, health plans, and billing operations. The consent stays valid until the patient revokes it in writing. You’re not asking patients to give up privacy. You’re asking them to give their care team the information needed to keep them safe.
The consent language emphasizes patient control, care coordination, and legal protection. Patients can revoke consent anytime. This helps prevent dangerous drug interactions if they end up in an emergency room. This consent does not authorize release of records for legal proceedings or criminal investigations (SAMHSA, 2024).
The Conversation That Determines Compliance
You’ll have two critical conversations every day starting in February 2026. The first happens during intake when you explain the new Single Consent. The second happens when a patient wants to revoke that authorization.
Based on our work with behavioral health intake teams, here’s language that communicates control, safety, and coordination effectively: “We’re using a new privacy form that aligns with federal standards. This Single Consent allows us to share your treatment information with your other healthcare providers and your insurance company. This ensures your care is coordinated, your medications are safe, and your bills get processed. You sign once, and it covers all future sharing for medical treatment and payment. You can cancel this consent anytime in writing, and we’ll stop sharing immediately.”
The revocation conversation is where compliance gets tested. When a patient says “I don’t want my records shared anymore,” your response in the next 60 seconds determines whether your organization is compliant or liable. You provide the revocation form immediately. Once they sign, you update the electronic health record system right then, not at the end of your shift. The system flags that patient’s records as restricted and sends notification to any connected Health Information Exchanges or insurance companies receiving data. If your EHR doesn’t automate these notifications yet, your IT team needs to build this workflow now (February 2026).
The regulatory standard is “known revocation.” Your organization can’t make disclosures once it knows consent has been revoked (HHS Final Rule, 2024). If a patient tells you they’re revoking but you write a note and forget to update the system, automated data feeds might keep sending records. The gap between what the patient said and what the system knows is where liability lives.
The Exception That Could Save a Life
Not everything in the patient’s file gets treated the same way. Progress notes and SUD Counseling Notes are legally different categories.
Progress notes are the official clinical record. They document the session date and time, modalities used, diagnosis, symptoms, prognosis, and treatment plan. These notes are covered by the Single Consent and get shared with other providers when appropriate for treatment coordination.
SUD Counseling Notes are the therapist’s personal notes documenting the analysis and impressions from a counseling session. They’re kept voluntarily and maintained separately from the rest of the file. They require a separate, specific written consent for any disclosure (SAMHSA, 2024).
If a clinician documents a suicide risk assessment in a note labeled “SUD Counseling Note,” that critical information stays sequestered. It won’t reach the emergency room or the psychiatrist who needs to see it. Where clinicians write something determines who can see it, and that decision could save a life or endanger one.
Your Role in Making This Work
The forms change in February 2026, but the principle stays the same. Your patients trust you with their most vulnerable moments. The new Single Consent gives them better care coordination without forcing them to give up control. Your job is to explain that clearly, process their decisions accurately, and make sure the system reflects what they actually chose.
You’re not just collecting signatures. You’re operating the mechanism that determines whether integrated care works or fails. You explain that sharing medication information with the emergency room protects patients from dangerous prescriptions. You process revocation requests fast enough that the organization stays compliant. You help patients understand the difference between progress notes and counseling notes so they can make informed choices.
The intake desk is where the 2026 regulatory transition becomes real or becomes theater. Leadership can draft policies and IT can update systems, but you’re the person who sits with patients and makes this work in practice.
Let Xpio Health help translate 2026 regulatory requirements into practical intake workflows, staff training materials, and electronic health record configuration that actually works at the front desk.
#BehavioralHealth #FrontlineStaff #PatientPrivacy #Part2Compliance #PeopleFirst #XpioHealth
References
- Department of Health and Human Services. Confidentiality of Substance Use Disorder Patient Records: Final Rule. Federal Register. 2024. https://www.federalregister.gov/public-inspection/2024-02544/confidentiality-of-substance-use-disorder-patient-records
- Substance Abuse and Mental Health Services Administration. Part 2 Confidentiality Regulations: Frequently Asked Questions. SAMHSA. 2024. https://www.samhsa.gov/about-us/who-we-are/laws-regulations/confidentiality-regulations-faqs