What is 42 CFR Part 2?

Does Part 2 apply to your practice?

It depends on two tests, and both have to be met.

1. The program holds itself out as providing SUD care. That covers a person or organization that holds itself out as providing, and does provide, SUD diagnosis, treatment, or referral for treatment, including private practitioners. It also covers an identified unit inside a general medical facility, and staff there whose main job is SUD care and who are identified that way.

2. The program is federally assisted. The rule lists several ways, including being a Medicare participating provider, holding a federal registration to dispense controlled substances for SUD treatment, receiving federal financial assistance in any form, or having IRS tax-exempt status.

The rule's own example of who is not covered: emergency room staff who send an overdose patient to intensive care, unless their main job is SUD care or the emergency room promotes itself as an SUD provider. How you describe your services matters, so ask your attorney where you stand.

Even if you are not a Part 2 program, you may receive Part 2 records from one. Whoever obtains them cannot use them against the patient in legal proceedings without written consent or a court order.

How Part 2 differs from HIPAA

Part 2 programs generally cannot share information that identifies someone as having an SUD unless Part 2 permits it. With limited exceptions, such as emergency medical treatment, that takes written patient consent or a court order and subpoena.

The 2024 final rule moved several things closer to HIPAA:

• One consent for treatment, payment, and operations. A patient can sign once for all future uses and disclosures for those purposes. A HIPAA covered entity or business associate that receives the record under it can share it again as HIPAA allows, except in legal proceedings against the patient.
• Breach notification. The HIPAA Breach Notification Rule now applies to Part 2 records.
• Penalties. The same civil and criminal penalties as HIPAA.
• Patient notice. It follows the HIPAA Notice of Privacy Practices.
• Patient rights. Patients can ask for restrictions and an accounting of disclosures. The compliance date for the accounting right will be set later.

One thing has not changed. Part 2 records cannot be used to investigate or prosecute a patient without written consent or a court order.

What a consent has to include

A written consent, on paper or electronic, must include the patient's name, who may disclose the information, what is shared, who receives it, the purpose, the right to revoke in writing, an expiration date or event, the patient's signature, and the date. A single consent for treatment, payment, and operations can name recipients as "my treating providers, health plans, third-party payers, and people helping to operate this program."

Three more rules:

• Notes a counselor keeps apart from the treatment record, called SUD counseling notes, need their own separate consent
• A consent for use in a legal proceeding cannot be combined with any other consent
• No disclosure may rely on a consent that has expired, been revoked, or is missing required elements

Enforcement

HHS's Office for Civil Rights (OCR) enforces Part 2. Since February 16, 2026, anyone can file a Part 2 complaint with OCR, and remedies for a violation include a civil money penalty.

Vendors that handle Part 2 records

A company that provides services to a Part 2 program, such as billing, data processing, or lab work, becomes a qualified service organization (QSO) by signing a written agreement that it is fully bound by Part 2. A business associate of a Part 2 program that is also a HIPAA covered entity counts as a QSO for those records. Our BAA guide covers the HIPAA side.

A quick check for your clinic

1. Decide with your attorney whether you are a Part 2 program
2. Update consent forms and the patient notice to the current rule
3. Record who consented to what, and when it expires or is revoked
4. Keep any counseling notes under their own consent
5. Add Part 2 records to your breach response plan
6. Review vendor agreements
7. Train staff on what can and cannot be shared

What we do

For practices that keep SUD records, we build consent tracking and access rules into the system so records are shared only as patient consent allows. See behavioral health practices and Security and Compliance.

This guide is general information, not legal advice. Your compliance adviser can confirm what applies to your practice.