42 CFR Part 2 is a federal rule protecting the confidentiality of substance use disorder treatment records held by federally assisted programs. It is stricter than HIPAA: it requires patient consent specific to each disclosure, and it applies to the program itself, not to every provider.
- Part 2 protects substance use disorder treatment records more tightly than HIPAA, and it applies to programs, not to all providers.
- Consent under Part 2 has required elements. A general HIPAA authorization does not satisfy it.
- The 2024 alignment rule brought Part 2 closer to HIPAA in several respects — including permitting a single consent for future treatment, payment and operations uses — while also extending HIPAA-style penalties.
- Most violations are not malicious. They are an export, a referral packet, or a records response that included more than the consent covered.
Part 2 exists for a reason worth stating plainly: people avoid substance use treatment when they believe the record can reach an employer, a court, a landlord, or a family member. The confidentiality is not administrative overhead layered on top of care. It is part of what makes the care possible.
That framing matters operationally, because the rule is easiest to comply with when staff understand why it is stricter, rather than experiencing it as HIPAA with extra paperwork.
Who does 42 CFR Part 2 apply to?
Part 2 applies to federally assisted programs that hold themselves out as providing, and do provide, substance use disorder diagnosis, treatment, or referral for treatment. “Federally assisted” is broad — it captures most programs, including those simply holding a DEA registration or receiving Medicaid.
Critically, it attaches to the program, not to every provider who might learn the same information. A general hospital that treats someone with a substance use disorder is usually not a Part 2 program. A treatment center is.
- You hold yourself out as providing substance use disorder diagnosis, treatment, or referral for treatment.
- You are federally assisted — a DEA registration, Medicaid participation, federal funding, or federal tax-exempt status all count.
- You provide that service directly, rather than merely learning the information incidentally as a general provider would.
If all three are true, you are a Part 2 program and everything below applies to you.
How is 42 CFR Part 2 different from HIPAA?
Both protect health information, but Part 2 is narrower in scope and stricter in what it demands. The differences that trip programs up are in consent, redisclosure, and what a court needs to compel records.
| Requirement | HIPAA | 42 CFR Part 2 |
|---|---|---|
| Applies to | All covered entities and their business associates | Federally assisted substance use disorder programs only |
| Attaches to | The information, broadly | The program, not every provider who learns it |
| Consent | A general authorization can cover broad categories of recipient | Consent must name the specific recipient and define the scope |
| Redisclosure | Permitted for treatment, payment, and operations | Prohibited without consent; a notice must travel with the record |
| Court access | A subpoena can suffice | Requires a court order meeting Part 2’s specific requirements |
What must a Part 2 consent contain?
This is the part most often got wrong, because a HIPAA authorization looks superficially similar. A Part 2 consent has to identify:
- Who is disclosing — the program name.
- Who receives it — the specific recipient, named. “Any treating provider” is not a name.
- What is disclosed — the amount and kind of information, defined narrowly enough to mean something.
- Why — the purpose of the disclosure.
- How long — an expiration date, event, or condition.
- The right to revoke, and how.
- Signature and date, by the patient or their authorised representative.
The 2024 final rule changed the shape of this in an important way: it permits a single consent covering all future uses and disclosures for treatment, payment, and health care operations, where the patient chooses that. That is a genuine simplification for care coordination — and it does not remove the requirement that the consent be specific about what it authorises. The rule took effect on April 16, 2024, and programs had to comply with its applicable requirements by February 16, 2026.
The failure mode is almost never a consent that does not exist. It is a disclosure that went beyond the consent that did.
Where do programs most often over-disclose?
The referral packet
A patient is stepping down to outpatient and a coordinator sends “the chart” to the receiving provider. The consent covered a treatment summary. What went was the whole record, including group notes naming other participants.
The records response
A payer requests documentation. The program produces everything requested, which is correct for the claim — and includes Part 2 protected material that the payer's consent did not extend to.
The integration
A health information exchange connection or an API key that pulls the full record because nobody scoped it. Consent enforcement that lives in a policy rather than in the export path will eventually be bypassed by a system that does not read policies.
The subpoena
A subpoena alone does not authorise disclosure of Part 2 records. A court order meeting the regulation's requirements is a different instrument. Staff who do not know the difference will comply with the wrong one under pressure.
What does Part 2 compliance look like operationally?
Four things, and they are all structural rather than procedural:
- Protected records are designated at the record level, so the system knows which material is subject to Part 2 rather than relying on a person remembering.
- Consent is a record with fields, not a scanned PDF in a document folder — recipient, purpose, scope, and expiry all machine-readable.
- Every export path respects scope. Referrals, audit packets, API responses, and manual downloads all filter against the active consent, because the one that does not is the one that leaks.
- Disclosures are logged. Who received what, under which consent, on what date — producible when a disclosure is later questioned.
Part 2 has changed materially in recent years and continues to be interpreted. Compliance dates, penalty structures, and the interaction with state law vary. Use this as orientation and your counsel or compliance officer for decisions.
How can you test whether your controls actually work?
Pick a patient with an active release. Ask someone on your team to produce exactly what that consent authorises — no more — and time it. If the answer involves opening the full chart and deciding by hand what to remove, the control is a person's attention, and attention fails on the busy days.
Frequently asked questions
Does 42 CFR Part 2 replace HIPAA?
No. Part 2 sits on top of HIPAA for substance use disorder treatment records held by federally assisted programs. Programs must satisfy both, and where the two differ, the stricter Part 2 requirement governs.
Does a HIPAA authorization satisfy Part 2 consent?
No. A Part 2 consent must name the specific recipient and define the amount and kind of information disclosed, along with the purpose, an expiration, the right to revoke, and a signature. A general HIPAA authorization does not include these elements.
Did the 2024 final rule weaken Part 2?
No. It aligned Part 2 more closely with HIPAA — including permitting a single consent for future treatment, payment, and health care operations — while extending HIPAA-style penalties. The consent still has to be specific about what it authorises.
Is a subpoena enough to release Part 2 records?
No. A subpoena alone does not authorise disclosure of Part 2 records. A court order that meets the regulation’s specific requirements is a different instrument, and it is the one that authorises release.