The short answer
42 CFR Part 2 governs the confidentiality of qualifying substance use disorder records associated with federally assisted Part 2 programs. The 2024 final rule permits one consent for future treatment, payment, and health care operations uses and disclosures, while retaining Part 2-specific protections. Persons subject to the rule had to comply with its applicable requirements by February 16, 2026; HHS says the compliance date for the new accounting-of-disclosures right will be established separately. Coverage and disclosure authority depend on the organization, record, recipient, and purpose. See the HHS final-rule fact sheet and current 42 CFR Part 2.
What is 42 CFR Part 2?
42 CFR Part 2 protects records that identify a patient as having or having had a substance use disorder and that fall within the rule’s program and federal-assistance criteria. Coverage turns on the regulatory definitions and applicability provisions, not simply on whether an organization describes itself as a behavioral-health or addiction-treatment facility. See 42 CFR 2.11 and 42 CFR 2.12.
Part 2 is not a general mental-health privacy rule. A qualifying Part 2 record may contain mental-health information, while other mental-health records may instead be governed by HIPAA, state law, or other requirements. HHS explains that Part 2’s confidentiality protections are intended in part to address fears of prosecution or discrimination that could deter people from seeking SUD treatment. See the HHS final-rule fact sheet.
How is 42 CFR Part 2 different from HIPAA?
The HIPAA Privacy Rule generally permits covered entities to use or disclose protected health information for specified treatment, payment, and health care operations purposes without an authorization, subject to the rule’s conditions and limits. See 45 CFR 164.506.
Part 2 asks a different threshold question: whether the information is a qualifying Part 2 record. For records within its scope, the 2024 rule allows one consent to cover future TPO uses and disclosures and permits specified HIPAA-regulated recipients to redisclose records under HIPAA, but it retains separate restrictions—including limits on using records or testimony in proceedings against a patient. See the HHS final-rule fact sheet.
| Question | HIPAA | 42 CFR Part 2 |
|---|---|---|
| Which information is governed? | Coverage depends on HIPAA’s definitions of protected health information, covered entity, and business associate. See 45 CFR 160.103. | Coverage depends on the definitions and applicability provisions for Part 2 programs, federal assistance, patients, and records. See 42 CFR 2.11 and 42 CFR 2.12. |
| How can TPO activity be authorized? | Specified TPO uses and disclosures are generally permitted without authorization, subject to applicable conditions and limits. See 45 CFR 164.506. | One compliant consent may cover future TPO uses and disclosures. See the HHS final-rule fact sheet. |
| What happens after disclosure? | Further use or disclosure depends on the recipient, purpose, and applicable HIPAA provisions and other law. | A HIPAA covered entity or business associate receiving records under the TPO consent may redisclose them in accordance with HIPAA, but Part 2’s proceedings restrictions remain. See the HHS final-rule fact sheet. |
| How are breaches addressed? | The HIPAA Breach Notification Rule applies when its definitions and requirements are met. | The final rule applies the HIPAA Breach Notification Rule’s requirements to breaches of Part 2 records. See the HHS final-rule fact sheet. |
| Can records be used against a patient in a proceeding? | The answer depends on the information, proceeding, legal process, and applicable law. | Part 2 restricts use of records and testimony in civil, criminal, administrative, and legislative proceedings against a patient without patient consent or a court order meeting Part 2 requirements. See the HHS final-rule fact sheet. |
| Which enforcement authorities apply? | HIPAA includes civil and criminal enforcement authorities. | The final rule applies the civil and criminal enforcement authorities used for HIPAA violations to Part 2 violations. See the HHS final-rule fact sheet. |
What changed in the 2024 final rule?
HHS announced the final rule on February 8, 2024. It was published on February 16, 2024, became effective April 16, 2024, and set February 16, 2026 as the general compliance date. Persons subject to Part 2 must now follow the applicable requirements, except where HHS has expressly deferred a compliance date. See the published final rule and HHS fact sheet.
- Consent for future TPO activity. One compliant consent may cover future treatment, payment, and health care operations uses and disclosures. HHS final-rule fact sheet
- Redisclosure by specified recipients. HIPAA covered entities and business associates that receive records under that consent may redisclose them in accordance with HIPAA, while Part 2’s separate proceedings restrictions continue to apply. HHS final-rule fact sheet
- Patient notices, complaints, and restriction requests. The rule aligns specified Patient Notice requirements with HIPAA’s Notice of Privacy Practices framework, permits complaints directly to the HHS Secretary, and adds a right to request restrictions on certain disclosures. HHS final-rule fact sheet
- Breach notification and enforcement. The rule applies HIPAA Breach Notification Rule requirements to breaches of Part 2 records and applies the civil and criminal enforcement authorities used for HIPAA violations to Part 2 violations. HHS final-rule fact sheet
- SUD counseling notes. HHS describes these as an SUD clinician’s notes analyzing a counseling-session conversation that the clinician voluntarily keeps separate from the rest of the patient’s SUD treatment and medical record. They require separate consent and cannot be used or disclosed under a broad TPO consent. HHS final-rule fact sheet
- Proceedings and investigative requests. The rule restricts use of Part 2 records and testimony in proceedings against a patient without consent or a court order meeting Part 2 requirements. It also establishes a limited safe harbor for investigative agencies that follow specified reasonable-diligence and remedial steps. HHS final-rule fact sheet
- Segmentation. The final rule expressly states that Part 2 does not require records to be segregated or segmented. An organization may still need controls that implement its chosen policies and other applicable requirements. HHS final-rule fact sheet
- Accounting of disclosures. The rule creates an accounting right, but HHS says its compliance date will be set when the corresponding HIPAA right is revised. That item should be monitored separately from requirements subject to the February 16, 2026 date. HHS final-rule fact sheet
The final rule permits one consent for future TPO uses and disclosures while retaining Part 2-specific protections and adding or revising notice, complaint, breach, enforcement, and other requirements. Alignment of specified processes does not make Part 2 and HIPAA interchangeable. See the HHS final-rule fact sheet.
Who has to comply with Part 2?
Part 2 applicability is fact-specific. The regulation defines a Part 2 program and explains how the test applies to an individual or entity, an identified unit within a general medical facility, and personnel whose primary function meets the definition. See 42 CFR 2.11.
Federal assistance is not limited to a direct grant. The regulation’s enumerated conditions include operation by a federal department or agency, specified federal authorization or certification, federal financial support, and specified federal tax assistance. The precise condition and the connection to the program matter. See 42 CFR 2.12(b). A scope assessment should therefore map the legal entity, facilities, units, personnel, services, federal-assistance basis, and records rather than assign coverage from a facility label alone.
What does Part 2 compliance require operationally?
Turn the rule into specific, testable decisions shared among privacy, legal, clinical, health-information-management, security, and operational owners. Useful workstreams include:
- Map scope. Record which entities, facilities, units, personnel, services, and record types the organization treats as within Part 2, along with the facts supporting each decision.
- Define consent handling. Specify how staff capture the scope of a TPO consent, associate it with the relevant records, and respond when a proposed use, disclosure, or recipient falls outside that scope. The rule permits one consent for future TPO activity but still requires a compliant consent. HHS final-rule fact sheet
- Update patient-facing and complaint processes. Assign owners for the Part 2 Patient Notice, restriction requests, complaints to the program, and information about complaints to HHS. HHS final-rule fact sheet
- Handle SUD counseling notes distinctly. Decide how separately maintained notes are identified and how the separate consent required for their use or disclosure is obtained and verified. HHS final-rule fact sheet
- Route proceedings and investigative requests. Create an escalation path that distinguishes an ordinary care-related disclosure from a request to use records or testimony against a patient.
- Integrate incident response. Define how suspected exposure of Part 2 records enters the organization’s breach-assessment, notification, documentation, and escalation process.
- Track the deferred accounting requirement. HHS says the compliance date for accounting of disclosures will be established later. Assign an owner to monitor that rulemaking and plan the eventual workflow without treating February 16, 2026 as its deadline. HHS final-rule fact sheet
- Test realistic scenarios. Walk a representative record through intake, consent, treatment access, a permitted disclosure, an incident, and a legal demand. Confirm who decides, what the system displays or blocks, and what evidence is retained at each step.
An EHR can support an organization’s chosen policies and workflows, but it cannot determine whether Part 2 applies or establish that the organization complies. Sunwave’s product page describes a unified patient file, configurable clinical documentation and treatment plans, scheduling, a client portal, and medication-management workflows. Those vendor-described functions identify areas to inspect; they do not establish how a particular deployment handles Part 2. See Sunwave’s behavioral health EMR page.
In a demonstration, use your own scenarios and ask the vendor to show how the proposed configuration would identify relevant records, present and record consent scope, distinguish separately maintained SUD counseling notes, control access and disclosures, route legal demands and incidents, and produce usable audit information. Document which behavior is standard, configurable, dependent on another module or integration, or handled outside the product.
