42 CFR Part 2: Protecting Substance Abuse Treatment Records (2026 Guide)

Overview

42 CFR Part 2: Protecting Substance Abuse Treatment Records (2026 Guide)

42 CFR Part 2 is a federal regulation that provides confidentiality protections for substance use disorder (SUD) treatment records that are stricter than HIPAA. Unlike HIPAA, Part 2 generally requires written patient consent before disclosing SUD records for treatment, payment, or healthcare operations. The regulation was significantly updated in 2024 to better align with HIPAA for care coordination purposes while preserving its core patient protections.

Key takeaways

• 42 CFR Part 2: Protecting Substance Abuse Treatment Records (2026 Guide) 42 CFR Part 2 is a federal regulation that provides confidentiality protections for substance use disorder (SUD) treatment records that are stricter than HIPAA.
• Unlike HIPAA, Part 2 generally requires written patient consent before disclosing SUD records for treatment, payment, or healthcare operations.
• The regulation was significantly updated in 2024 to better align with HIPAA for care coordination purposes while preserving its core patient protections.

Details

Substance abuse treatment records receive special confidentiality protections beyond HIPAA. Understanding 42 CFR Part 2 is essential for any provider treating patients with substance use disorders (SUDs).

These regulations exist because of the unique stigma associated with addiction. The fear of disclosure can prevent individuals from seeking life-saving treatment. But navigating Part 2's requirements can be challenging, especially with recent regulatory changes.

This guide provides everything behavioral health providers need to know about protecting substance abuse records in 2026.

What Is 42 CFR Part 2?

42 CFR Part 2 is the federal regulation governing confidentiality of substance use disorder patient records, administered by SAMHSA and codified in Title 42 of the Code of Federal Regulations. The key difference between Part 2 and HIPAA is that Part 2 requires written patient consent for most disclosures -- including disclosures for treatment and payment -- while HIPAA permits these disclosures without authorization. Any federally assisted program that provides SUD diagnosis, treatment, or referral must comply with Part 2.

Background and Purpose

42 CFR Part 2 ("Part 2") is a federal regulation that protects the confidentiality of substance use disorder (SUD) patient records. Originally enacted in 1975 and significantly updated in 2020 and 2024, Part 2 provides protections that are stricter than HIPAA for SUD treatment information.

The regulation recognizes that:Stigma around addiction is significantFear of disclosure deters treatment-seekingUnauthorized disclosure can lead to discrimination, job loss, child custody issues, and criminal prosecutionProtecting confidentiality promotes public health by encouraging treatment

The Substance Abuse and Mental Health Services Administration (SAMHSA) administers Part 2 regulations.

How Part 2 Differs from HIPAA

Key principle: Part 2 requires patient consent for most disclosures that HIPAA would permit without consent.

Who Must Comply with Part 2?

Covered Programs

Part 2 applies to any "program" that:Is federally assisted, ANDHolds itself out as providing, and does provide, SUD diagnosis, treatment, or referral for treatment

"Federally assisted" includes:Receives any federal funding (including Medicare/Medicaid)Has tax-exempt statusIs authorized to conduct methadone maintenance treatmentIs registered to dispense controlled substances for SUD treatmentIs assisted by IHS, Department of Veterans Affairs, or Department of Justice

Practically speaking: Most SUD treatment providers, including private practices that accept Medicaid or Medicare, are federally assisted.

What Is a "Program"?

A "program" can be:An individual practitionerA facilityA identified unit within a general medical facilityMedical personnel in a general facility whose primary function is SUD treatment

Important: General medical facilities are NOT considered Part 2 programs solely because they treat some patients with SUDs. Part 2 applies to identified SUD treatment units or practitioners holding themselves out as providing SUD treatment.

What Records Are Covered?

Part 2 protects any information that would:Identify a person as having or having had an SUD, ORCould be used to identify someone as a patient of a Part 2 program

This includes:DiagnosisTreatment recordsReferral informationAttendance recordsTest results (drug screens, labs)Even the fact that someone is a patient

Not covered:Information about SUD that was not created by or received from a Part 2 programRecords maintained by general medical providers not holding out as SUD treatment programs (though state law may still apply)

Consent Requirements

Under 42 CFR Part 2, written patient consent is required for virtually all disclosures of substance use disorder treatment records, including disclosures for treatment, payment, and healthcare operations that HIPAA would permit without authorization. A valid Part 2 consent form must contain ten specific elements, including the patient's name, the purpose of disclosure, an expiration date, and a statement that the information may not be re-disclosed.

When Is Consent Required?

Under Part 2, written consent is generally required to disclose SUD treatment records for:Treatment (with exceptions for emergencies and care coordination)PaymentHealthcare operationsResearch (without explicit consent requirements in some cases)Any other purpose

This is more restrictive than HIPAA, which permits disclosure for treatment, payment, and healthcare operations without patient authorization.

Valid Consent Elements

A valid Part 2 consent must include:Name of patientName or general designation of program(s) making disclosureName or title of recipient(s) to whom disclosure is madePurpose of the disclosureHow much and what kind of information will be disclosedPatient's signature (electronic signatures are acceptable)Date of signatureStatement that consent is subject to revocation at any time except to extent disclosure has already occurredExpiration date, event, or conditionStatement that information may be re-disclosed only as permitted by Part 2

Sample Consent Language

Required statement about re-disclosure:

"This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR Part 2). The federal rules prohibit you from making any further disclosure of information in this record that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose (see 42 CFR Part 2.31). The federal rules restrict any use of the information to investigate or prosecute with regard to a crime any patient with a substance use disorder, except as provided at 42 CFR Part 2.12(c)(5) and 2.65."

Consent for Treatment, Payment, Healthcare Operations (TPO)

2024 Rule Changes: The 2024 final rule significantly aligned Part 2 with HIPAA for Treatment, Payment, and Healthcare Operations (TPO). Patients may now sign a single consent that permits disclosure for all TPO purposes without needing to re-consent for each episode of care.

Single consent provisions:Patient can provide a single written consent for all future TPO disclosuresConsent remains valid until revokedMust clearly state it covers all future disclosures for TPOCan be combined with HIPAA authorization

This is a major change that simplifies compliance for integrated care.

Consent for Care Coordination

The 2024 rule created new provisions for care coordination:Disclosure to treating providers for care coordination is permitted with general TPO consentApplies to all entities involved in the patient's careFacilitates integrated treatment for co-occurring conditions

Permitted Disclosures Without Consent

Medical Emergencies

Part 2 programs may disclose information without consent when:A medical emergency existsThe patient is unable to consentDisclosure is necessary to treat the emergency

Requirements:Disclose only information necessary for emergency treatmentDocument the emergency in the recordWithin 72 hours, seek written consent or document efforts

Audit and Evaluation

Disclosure is permitted for audit and evaluation activities by:Federal, state, or local government agenciesPrivate persons/entities qualified to conduct auditsContracted auditors for program oversight

The auditor must agree in writing to:Maintain confidentialityNot re-discloseDestroy information upon completion

Research

Part 2 permits disclosure for research without patient consent if:The research is conducted by a qualified personIRB or Privacy Board approvesPersonal identifying information is not removed from the program

Researchers must:Protect patient identityNot re-discloseFollow scientific research standards

Court Orders

Disclosure may be made pursuant to a Part 2 court order, which has specific requirements beyond a standard subpoena:

Court order requirements:Application must use fictitious nameShow good cause (public interest outweighs harm)Limit disclosure to essential informationLimit disclosure to essential recipients

A regular subpoena is NOT sufficient for Part 2 records. You may not disclose solely based on a subpoena without a qualifying court order.

Reports of Child Abuse/Neglect

Part 2 permits disclosure to appropriate authorities when:Program personnel have reasonable cause to believe child abuse/neglect has occurredDisclosure is required by state mandatory reporting law

However: The restriction on re-disclosure still applies. The report should not contain more information than necessary.

For more on mandatory reporting, see our mandatory reporting guide.

Crimes on Program Premises or Against Program Personnel

Part 2 programs may disclose limited information when:A crime is committed on program premises, ORA crime is committed against program personnel

Disclosure limited to:Circumstances of the incidentPatient statusName, address, last known location of suspect

Qualified Service Organization Agreements (QSOAs)

Programs may disclose to Qualified Service Organizations (QSOs) that provide services to the program:LabsBilling servicesData processingProfessional services

QSOA requirements:Written agreementPromise not to re-discloseAgreement to resist unauthorized disclosureSimilar to HIPAA Business Associate Agreements

The Re-Disclosure Prohibition

What Is Re-Disclosure?

One of Part 2's most important protections is the prohibition on re-disclosure. When a recipient receives Part 2 information, they cannot disclose it to others without:The patient's written consent, ORA specific Part 2 exception

This protection "follows" the information, creating a chain of confidentiality.

Written Notice Required

Every disclosure must include a written statement prohibiting re-disclosure:

"This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR Part 2). The federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2."

Impact on Care Coordination

The re-disclosure prohibition has historically created barriers to integrated care. The 2024 rule changes address this by:Permitting broader TPO consentAllowing re-disclosure among treating providers with consentApplying HIPAA's accounting and access requirements

Prohibition on Use in Legal Proceedings

General Rule

Part 2 information cannot be used in any civil, criminal, administrative, or legislative proceedings against a patient unless:The patient consents, ORA proper Part 2 court order is issued, ORThe information is obtained independently of the Part 2 program

Court Order Process

To obtain Part 2 records for legal proceedings:Application to court using fictitious patient nameGood cause hearing (may be ex parte)Court must find:Disclosure is necessary for nonfrivolous purposeNo other way to obtain informationPublic interest outweighs harm to patientOrder must limit scope and recipientsProtective measures must be imposed

Criminal Proceedings Limitations

Law enforcement faces significant restrictions:Cannot subpoena Part 2 recordsCannot use Part 2 records to investigate or prosecute patientsLimited exception for crimes on premises/against personnelMust obtain proper court order

Patient Crimes Exception

If a patient commits a crime against the program or on program premises, limited information may be disclosed to law enforcement (circumstances, patient status, name/address).

2024 Rule Changes: What's New

The 2024 Final Rule represents the most significant update to 42 CFR Part 2 since its original enactment, introducing a single-consent model for treatment, payment, and healthcare operations (TPO) that eliminates the need for separate consent forms per provider or per episode of care. The rule also aligns Part 2 breach notification with HIPAA requirements and adds new antidiscrimination protections for patients with SUD histories.

The 2024 Final Rule made significant changes to align Part 2 more closely with HIPAA.

Key ChangesSingle Consent for TPOPatients can sign one consent for all TPO disclosuresEliminates need for consent per provider/per episodeConsent valid until revokedHIPAA Alignment for BreachesPart 2 breach notification now follows HIPAA rulesApplies to unsecured Part 2 dataSame timelines and procedures as HIPAAPatient RightsRight to access (matching HIPAA)Right to accounting of disclosuresRight to request restrictionsCare CoordinationSimplified disclosure for coordinated careApplies to all treating providersReduces barriers to integrated treatmentAntidiscrimination ProtectionsCannot discriminate based on SUD recordsCannot deny treatment based on Part 2 historyApplies to all recipients of Part 2 information

Implementation Timeline

Most provisions took effect in 2024-2025. Providers should:[ ] Update consent forms[ ] Revise policies and procedures[ ] Train staff on changes[ ] Review QSOA agreements[ ] Implement breach notification procedures

Compliance Checklist

Program Identification[ ] Determine if you are a Part 2 program[ ] Identify all SUD treatment activities[ ] Determine which records are covered

Policies and Procedures[ ] Develop Part 2-specific policies[ ] Create consent forms meeting Part 2 requirements[ ] Develop procedures for consent tracking[ ] Create re-disclosure notice language[ ] Establish QSOA procedures[ ] Develop emergency disclosure procedures[ ] Create court order response procedures

Staff Training[ ] Train all staff on Part 2 requirements[ ] Distinguish Part 2 from HIPAA[ ] Train on consent requirements[ ] Train on emergency exceptions[ ] Train on responding to legal requests

Documentation[ ] Maintain consent forms[ ] Document all disclosures[ ] Document emergency disclosures[ ] Track consent expirations/revocations[ ] Maintain QSOA agreements

Integration with HIPAA[ ] Harmonize consent processes[ ] Implement unified breach notification[ ] Provide required patient rights[ ] Coordinate training programs

Special Situations

Special situations under 42 CFR Part 2 require careful handling because the default rule -- obtain written consent before any disclosure -- admits only narrow exceptions. The most common special situations affecting behavioral health practices are co-occurring mental health and SUD treatment, integrated care settings, telehealth delivery, and minor patients. Each requires specific procedural safeguards beyond standard HIPAA compliance.

Co-Occurring Mental Health and SUD

When treating co-occurring conditions:Mental health records follow HIPAASUD records follow Part 2Must segregate or apply Part 2 to entire recordMany programs apply Part 2 to all behavioral health records for simplicity

For mental health documentation requirements, see our documentation guide.

Integrated Care Settings

In integrated care environments:Primary care providers receiving Part 2 information cannot re-discloseEHRs must handle Part 2 "segmentation" or obtain consentCare coordination consent simplifies information sharing

Minors

For minor patients:State law determines consent capacity for treatmentMinor who consents to treatment may consent to disclosureParent/guardian access may be restrictedConsider state-specific minor consent laws

Telehealth

Part 2 applies equally to telehealth services:Consent requirements unchangedDocument modality in recordsEnsure platform security meets requirementsInclude telehealth in consent explanations

See our California telehealth laws guide for state requirements.

Deceased Patients

Part 2 protections survive patient death:Records remain protectedExecutor/administrator may consentLimited disclosures for cause of death

Penalties for Violations

Criminal Penalties

Part 2 violations can result in:First offense: Fine up to $500Subsequent offenses: Fine up to $5,000

These may seem minor compared to HIPAA, but:Criminal record consequencesProfessional licensing implicationsCivil liability exposure

Civil Liability

Patients may bring civil suits for:Actual damagesEmotional distressPunitive damages (in some cases)

Professional ConsequencesLicense disciplineLoss of federal fundingProgram decertificationExclusion from federal healthcare programs

Common Compliance MistakesTreating Part 2 Like HIPAA

Problem: Assuming TPO disclosures need no consent.

Solution: Always verify consent for Part 2 records, even with the 2024 changes. Ensure consent covers the intended disclosure.Responding to Standard Subpoenas

Problem: Producing Part 2 records in response to attorney subpoena.

Solution: Part 2 requires a specific court order process. Consult legal counsel before any disclosure.Missing Re-Disclosure Notice

Problem: Disclosing without required written notice.

Solution: Include re-disclosure prohibition statement with EVERY disclosure.Inadequate Consent Forms

Problem: Using HIPAA authorizations that don't meet Part 2 requirements.

Solution: Create Part 2-compliant consent forms with all required elements.Failing to Segment Records

Problem: Disclosing entire medical record including SUD information.

Solution: Segregate Part 2 records or apply Part 2 consent requirements to all disclosures.Improper Emergency Disclosures

Problem: Claiming emergency for non-emergency situations.

Solution: Document genuine medical emergencies; seek consent within 72 hours.

Frequently Asked Questions

Does Part 2 apply to all addiction treatment?

Part 2 applies to "federally assisted" programs. If you receive any federal funding (including Medicare/Medicaid), have tax-exempt status, or are registered to prescribe MAT, you're likely covered.

Can I share SUD information in an integrated EHR?

Yes, but carefully. You need proper consent, and the EHR must either segment Part 2 data or apply Part 2 protections to the entire record. Many providers use the single TPO consent option.

What if a patient revokes consent?

Revocation prevents future disclosures. It does not apply retroactively to disclosures already made in reliance on the consent.

How do I handle a subpoena for SUD records?

Do not produce records based solely on a subpoena. Notify your attorney. A proper Part 2 court order is required, which involves a specific application and hearing process.

Can parents access their minor child's SUD treatment records?

State law determines minor consent capacity. If the minor consented to treatment, the minor generally controls disclosure. Consult state law and consider family dynamics carefully.

Do the 2024 changes mean Part 2 is now the same as HIPAA?

No. Part 2 remains more restrictive in several areas, particularly regarding law enforcement access and the re-disclosure prohibition. The changes primarily simplify consent for TPO purposes.

What about medications for opioid use disorder (MOUD) prescribed in primary care?

If a primary care provider is DEA-registered to prescribe buprenorphine and holds themselves out as providing SUD treatment, Part 2 may apply to that aspect of their practice. The determination is fact-specific.

Ease Health's EHR platform supports Part 2 compliance with consent tracking, record segmentation, and compliant disclosure workflows. Schedule a demo to see how we help SUD treatment providers maintain confidentiality.

Related Glossary Terms42 CFR Part 2 — Federal confidentiality rules for SUD recordsHIPAA — How Part 2 protections compare to and exceed HIPAASubstance Use Disorder — The conditions Part 2 was designed to protectEHR — EHR consent segmentation for Part 2 compliance

Related GuidesBest EHR for Addiction Treatment — EHR systems with native Part 2 compliance

Next steps

• Review the key takeaways and adapt them to your practice workflow.
• Use the details section as a checklist when you implement or troubleshoot.
• Share this with your billing or admin team to align on process and terminology.