The December 2025 issue of Greenberg Traurig’s quarterly Behavioral Health Law Ledger explores several developments in behavioral health law, including Colorado’s new insurance utilization review requirements for behavioral health services taking effect Jan. 1, 2026, and HHS’s delegation of 42 CFR Part 2 enforcement to OCR ahead of the compliance deadline of Feb. 16, 2026.
New Colorado Insurance Utilization Review Requirements for Behavioral Health Services Take Effect Jan. 1, 2026
House Bill 25-1002 takes effect Jan. 1, 2026, seeking to bring down the level of claims denials for behavioral health services by requiring insurance companies to cover medically necessary mental health and substance use disorder (SUD) treatment and apply nationally accepted standards in making coverage and utilization review decisions about such services. The law also prohibits health benefit plans from limiting benefits or coverage for chronic behavioral health disorders to short-term symptom reduction at any level of care placement.
Although behavioral health parity has been on the books for nearly 20 years, insurers have been permitted to apply their own unique company standards around coverage determinations for such services. HB 25-1002, which amends Colorado Revised Statutes 10-16-104 (addressing mandatory coverage provisions), seeks to impose a universal set of coverage rules similar to that which is in place for physical health care service coverage determinations.
Specifically, the law requires insurers to follow utilization review criteria consistent with generally accepted standards of behavioral, mental health, and SUD care for all coverage determinations. A group of nationally recognized non-profit behavioral healthcare associations developed these criteria. The law also requires insurers to provide a detailed explanation for any coverage denials they issue.
Implementing regulations from the Colorado Division of Insurance remain forthcoming.
Providers and HHS-OCR Preparing for 42 CFR Part 2 Compliance Date
In August 2025, the U.S. Department of Health and Human Services (HHS) formally delegated the authority from Secretary Robert F. Kennedy, Jr., to the Office for Civil Rights (OCR) to administer and enforce the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR Part 2 (Part 2), which provide heightened protection and confidentiality rights to patients’ SUD treatment records.
Recall that in February 2024, HHS published a final rule overhauling much of the Part 2 regulations pursuant to Section 3221 the Coronavirus Aid, Relief, and Economic Security (CARES) Act, which sought to increase provider care coordination and better align Part 2 with the permissive allowances for data sharing amongst healthcare providers under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) in an effort to better integrate behavioral healthcare information with other medical records to improve patient outcomes. Specifically, the final rule allows individuals to file complaints alleging Part 2 violations, mandates breach notification and reporting of Part 2 records akin to HIPAA’s breach notification obligations imposed on covered entities, and implements HHs’ civil enforcement authority, including the potential to impose civil monetary penalties for Part 2 violations.
The compliance date of the final rule is Feb. 16, 2026. This means that providers of SUD services should be underway in their Part 2 compliance program revisions to ensure they have policies and procedures in place by the compliance deadline, as OCR may formally begin enforcement activity as of the compliance date.