Addiction Treatment Software: ASAM, MAT, and 42 CFR Part 2 in 2026

The February 16, 2026 deadline for 42 CFR Part 2 compliance has already passed. Per HHS’s February 2026 announcement, the Office for Civil Rights can now fine a treatment center the way it fines a hospital for a HIPAA breach, up to $2.1 million, not the flat $500 penalty Part 2 used to carry for its entire history. I’ve watched three different compliance regimes tighten in healthcare over 25 years. This one moved faster than most, and the software most SUD treatment centers are running wasn’t built for it.

What Addiction Treatment Software Actually Has to Handle

Four things, and most vendor pages cover maybe two of them well. ASAM criteria for placing a patient at the right level of care. Medication-assisted treatment management, specifically the e-prescribing rules around buprenorphine and methadone. Group therapy documentation, which almost no generic EHR handles correctly. And 42 CFR Part 2, the confidentiality rule that makes substance use disorder records harder to share than a standard medical chart, even after the 2024 changes.

Get any one of the four wrong and the failure shows up in a different place. Get ASAM placement wrong and a patient lands in the wrong level of care, which is both a clinical problem and, increasingly, a payer denial waiting to happen, since utilization review teams check placement logic against the current criteria. Get MAT e-prescribing wrong and you’re either blocking a physician from using flexibility the DEA explicitly granted, or worse, letting a prescription go out without the PDMP check the rule requires. Get group documentation wrong and clinicians build workarounds, and workarounds are what an auditor finds first. Get Part 2 wrong and you’re the treatment center OCR’s new civil enforcement program was built to reach. None of these are software features in the usual sense. They’re the operating logic the rest of the system has to sit on top of.

The Compliance Deadline That Already Passed

Here’s the part almost every competing guide either skips or buries in a compliance checklist. HHS finalized the new Part 2 rule on February 8, 2024. It took effect April 16, 2024. And the actual compliance deadline for treatment providers landed February 16, 2026, the same week OCR announced it was standing up a formal Civil Enforcement Program.

That last detail matters more than the date itself. For the entire history of Part 2, violations went through criminal referral, rarely used, rarely enforced. As of February 16, 2026, OCR can now open a civil investigation the same way it does for a HIPAA breach. Resolution agreements. Corrective action plans. Monetary settlements. And the penalty structure moved from a flat $500 to $5,000 fine to the same tiered range HIPAA uses, $141 to $2.1 million depending on the violation.

I haven’t found a confirmed enforcement action under the new civil regime yet. It’s been a few months. I’d be skeptical of anyone claiming otherwise this early, and skeptical of anyone telling you it won’t happen. The mechanism is live. The penalty exposure is real.

What’s changed underneath all of it is technical, and this is the part that actually determines whether your software is compliant or just looks compliant. Under the old rule, every time SUD treatment information moved to a new party, treatment, payment, or operations, a separate patient consent was required for that specific disclosure. Under the 2024 rule, a single consent can now cover all future TPO disclosures, which sounds simpler and mostly is, except it shifts the compliance burden from “did we get consent for this specific disclosure” to “does our system correctly track what a given consent actually authorizes, for how long, and to whom.” That’s a data model question, not a paperwork question. The second change matters just as much: once a HIPAA-covered entity receives Part 2 data under a valid consent, it can now redisclose that data under standard HIPAA rules rather than Part 2’s stricter redisclosure restrictions. A hospital system that receives your patient’s SUD record can now pass it along more freely than before, which means your original disclosure has to be logged precisely enough to survive being asked, months later, exactly what was shared, with whom, and under which consent. If your software still treats every Part 2 disclosure as a one-off manual event, tracked in a note field rather than a structured consent record, you built for the old rule, and the redisclosure chain the new rule creates is the kind of thing an OCR investigation would likely ask to see.

ASAM’s 4th Edition Changed Level-of-Care Placement, Has Your Software Caught Up?

ASAM released its 4th Edition criteria in October 2023, the first major restructure in a decade. Six clinical dimensions stayed in place, but the level-of-care logic changed. Level 0.5 got renamed to Early Intervention and Secondary Prevention. A new Level 1.0, Long-Term Remission Monitoring, was added for patients who’ve stabilized but still need structured follow-up. And Level 4, medically managed inpatient care, is now reserved specifically for acute-care general hospitals, not a catch-all top tier.

None of that is decorative. If your intake software still routes placement decisions through the old six-level structure, your clinical team is translating manually every time, and that’s the kind of workflow gap an audit tends to catch. A handful of vendor pages mention ASAM as a keyword. Almost none walk through what changed in 2023 or what it means for how placement gets documented.

What the 2025-2026 DEA Telehealth Rules Actually Allow for MAT

This is the thread I haven’t seen a single competitor page connect properly. The DEA and HHS finalized the rule making buprenorphine telemedicine prescribing permanent, not just extended, effective December 31, 2025, after an earlier February 2025 effective date got postponed for further review. A practitioner can initiate and prescribe up to a six-month supply via audio-only or audio-visual telehealth, without an in-person exam, as long as they check the state prescription drug monitoring program every time and document that check.

Separately, the broader COVID-era flexibility covering Schedule II through V controlled substances got extended a fourth time, now running through December 31, 2026. Methadone treatment can be initiated via audio-visual telehealth without an in-person exam when clinically appropriate. Take-home dosing discretion expanded across methadone, buprenorphine, and naltrexone.

Every one of those rules has a documentation and PDMP-check requirement baked into it. If your EPCS workflow doesn’t force that check and log it at the point of prescribing, you’re relying on staff memory for something regulators specifically built as a technical control.

Group Therapy Documentation Is Where Generic EHRs Fall Apart

Individual session notes are a solved problem. Group therapy isn’t, and it’s the piece nearly every addiction treatment center runs into within the first month of using an off-the-shelf system.

Here’s the actual shape of it. One group session, six to twelve participants, one hour on the calendar. The clinician runs one session, but the documentation isn’t one note. It’s a shared group note covering what happened in the room, the topic, the modality, who facilitated, plus an individual note for every single participant covering how that specific person responded, engaged, or disclosed something clinically relevant. Each of those individual notes ties to its own billing line, because payers reimburse per patient per session, not per group. And every participant needs an attendance record independent of the clinical note, because attendance itself is often a program-completion or court-referral requirement separate from the clinical content.

A system built around one-to-one therapy handles none of that natively. What happens instead, in practice, is a clinician writes one note, copies it eleven times with minor edits, or keeps attendance on a separate spreadsheet that never reconciles cleanly with the EHR. Both of those are workarounds, and workarounds are exactly what an auditor finds first, especially in a Part 2 environment where the question isn’t just “was this documented” but “was consent and disclosure handled correctly for every individual record inside a shared group event.” A system that treats the group note and the individual note as genuinely separate objects, linked but distinct, is the difference between documentation that holds up and documentation that becomes eleven near-identical liabilities.

Why the Software Already on the Market Still Misses This

Earlier I said almost none of the pages ranking for this topic connect ASAM, MAT, and Part 2 properly. Let me correct that, because it isn’t fair. I looked at what’s actually ranking, six vendor pages, read directly rather than summarized, and two of them go genuinely deep, real credit where it’s due: both run long-form buyer’s guides in the 2,500 to 3,500-word range and cover ASAM, MAT, group documentation, and Part 2 with real specificity.

The other four don’t. Three are short landing pages, 400 to 1,000 words, built to convert rather than educate, and they skip ASAM criteria and 42 CFR Part 2 entirely. One of them mentions group therapy notes; the other two don’t mention group documentation at all. And the largest, most recognizable name in the group, the vendor most treatment centers have actually heard of, skips explicit ASAM alignment and detailed Part 2 coverage on its own addiction-specific page, leaning on a generic HIPAA mention and a passing reference to MAT and office-based opioid treatment without touching EPCS specifics.

That gap is the opportunity and the risk at the same time. It’s an opportunity because a system built around the actual 2024-2026 regulatory reality, not a five-year-old compliance checklist, is genuinely differentiated in a market where even the biggest name is thin on this exact ground. It’s a risk because a meaningful share of centers evaluating software right now are comparing vendors on price and feature lists, not on whether the underlying compliance logic reflects what changed in the last two years. A marketing page that’s thin on ASAM and Part 2 doesn’t prove the product is thin too, but it’s a reasonable place to start asking pointed questions during a demo.

The Funding Moment Behind This

On July 6, 2026, SAMHSA announced more than $281 million in funding opportunities across 15 grant programs tied to addiction, overdose, and mental illness, including $68.2 million specifically for Medication-Assisted Treatment grants under the Prescription Drug and Opioid Addiction program. For a treatment center weighing a technology investment against everything else competing for budget, that’s real capital moving into the sector at the same moment the compliance bar moved. Grant-funded expansion and a compliance-driven software refresh tend to land on the same executive’s desk in the same budget cycle. Worth planning them together instead of separately.