The short answer
42 CFR Part 2 is a federal confidentiality rule for records created by qualifying federally assisted programs, units, or personnel that provide substance use disorder diagnosis, treatment, or referral. The 2024 final rule had a February 16, 2026 compliance date and permits a single consent for future treatment, payment, and health care operations, while retaining Part 2-specific protections and exceptions. Applicability and disclosure authority are fact-specific; use the regulation and current HHS guidance with qualified counsel.
What is 42 CFR Part 2?
42 CFR Part 2 is a federal regulation protecting the confidentiality of specified substance use disorder (SUD) records. Its policy purpose includes reducing privacy-related deterrents to seeking SUD treatment. The exact coverage and disclosure rules come from the regulation, not from a facility’s label or this summary.
It applies to qualifying Part 2 programs and specified records. Federal assistance, program status, identified units or personnel, record origin, recipient status, and exceptions can all matter. HIPAA may also apply, but the interaction must be analyzed for the specific organization and disclosure.
How is 42 CFR Part 2 different from HIPAA?
HIPAA lets covered entities share protected health information for treatment, payment, and health care operations (TPO) without separate patient authorization. That is the engine of everyday care coordination. Part 2 historically did the opposite: almost every disclosure of an SUD record — including for treatment — required the patient’s written consent, and that consent had to name specific recipients. It also carried a strict redisclosure prohibition: whoever received the record generally could not pass it along.
| HIPAA | 42 CFR Part 2 | |
|---|---|---|
| What it covers | PHI held by covered entities and business associates, subject to definitions and exceptions | Qualifying records created by Part 2 programs, subject to definitions and exceptions |
| Treatment/payment/operations | Often permitted without authorization under HIPAA, subject to the rule | A compliant consent may authorize future TPO uses and disclosures under the 2024 rule |
| Redisclosure | Governed by HIPAA and other applicable law | Depends on the consent, recipient, record, purpose, and current Part 2 rule |
| Breach notification | Required | Now extended to Part 2 programs |
| Use in legal proceedings | Broader | Restricted without consent or a court order |
| Penalties | Civil and criminal | Now aligned with HIPAA penalties |
What changed in the 2024 final rule?
On February 8, 2024, the HHS Office for Civil Rights and SAMHSA issued a final rule modernizing Part 2 and aligning much of it with HIPAA. The rule took effect April 16, 2024, with compliance required by February 16, 2026 — so it now governs day-to-day operations. The headline changes:
- Single consent for TPO. A patient may provide one consent for future treatment, payment, and health care operations uses and disclosures when the regulatory requirements are met.
- Redisclosure by recipients. HIPAA covered entities and business associates that receive records under that consent may redisclose them in line with HIPAA.
- Patient Notice aligned with HIPAA. The Part 2 patient notice requirements now mirror the HIPAA Notice of Privacy Practices.
- Breach notification. HIPAA’s breach notification obligations now extend to Part 2 programs for breaches of unsecured records.
- SUD counseling notes. A new category — a clinician’s notes analyzing a counseling session, kept separate from the rest of the record — gets heightened protection, analogous to HIPAA psychotherapy notes, and cannot be released on a broad TPO consent.
- Legal proceedings and a safe harbor. The rule limits use of records in legal actions without consent or a court order, and creates a limited safe harbor for investigative agencies that first check whether a provider is a Part 2 program.
The through-line: Part 2 is easier to operate under than it used to be, but it is not the same as HIPAA. Single consent reduces friction; it does not eliminate the special status of SUD records.
Who has to comply with Part 2?
Part 2 applicability is fact-specific. The regulation covers qualifying federally assisted programs, or identified units or personnel, that provide SUD diagnosis, treatment, or referral for treatment. “Federal assistance” can take several forms beyond a direct grant. Organizations should use the regulatory definitions and current HHS guidance with qualified counsel rather than inferring coverage from a facility label alone.
What does Part 2 compliance require operationally?
An organization and qualified counsel may need to evaluate workstreams such as:
- Determine program and record scope and update consent and Patient Notice materials where required
- Train workforce members on permitted uses, disclosures, prohibitions, exceptions, and escalation
- Align breach notification procedures with the current rule where applicable
- Apply the specific consent requirements for SUD counseling notes
- Configure access, disclosure, consent, notice, audit, complaint, and retention workflows to the approved legal interpretation
An EHR can support the policies and workflows an organization determines it needs, but software does not decide whether Part 2 applies or make a program compliant. When evaluating Sunwave Health’s behavioral health EMR, ask the team to demonstrate the consent, access, disclosure, and audit workflows relevant to your counsel-approved requirements. Do not assume that a product category or marketing description establishes legal compliance.
Frequently asked questions
Is 42 CFR Part 2 still stricter than HIPAA after the 2024 rule?
Yes. The rule aligned consent, redisclosure, breach notification, and penalties with HIPAA, but SUD records still get heightened protection — including limits on use in legal proceedings and a special category of protected counseling notes.
Does Part 2 apply to mental health records?
Part 2 is not a general mental-health privacy law. It protects qualifying SUD records, which may contain mental-health information. Other records may be governed by HIPAA, state law, or other rules depending on the entity, record, and relationship.
What is the penalty for violating Part 2?
Under the 2024 rule, enforcement and penalties are aligned with HIPAA’s civil and criminal penalty structure, replacing Part 2’s older criminal-fine approach.
When did the new Part 2 rule take effect?
The final rule was issued February 8, 2024 and effective April 16, 2024, with compliance required by February 16, 2026 — so it is now in force.
Sources
This article is educational and describes software capabilities and general industry practices; it is not legal, clinical, financial, or billing advice. Requirements vary by organization, payer, program, and jurisdiction. Sunwave Health is a behavioral health software platform. Schedule a demo.
