42 CFR Part 2 and HIPAA: what the final rule changed, and what it means for the people doing the work

Part 2 is a separate federal rule, not a stricter reading of HIPAA

The confidentiality of substance use disorder patient records is governed by its own statute, 42 U.S.C. 290dd-2, and its own regulation at 42 CFR Part 2. The rule exists because people avoid treatment when they believe a record of that treatment can follow them into a courtroom, a custody dispute, a job application, or a prosecution. HHS states the purpose plainly on its own Part 2 page: fear of discrimination or legal trouble can deter people from seeking care.

That history matters when you read the 2024 changes, because the direction of travel is not simply deregulation. Some provisions loosened, particularly around consent and care coordination. Others tightened, particularly around use of records against a patient in legal proceedings. And the enforcement side moved from a criminal-only backstop that was almost never used to the full HIPAA civil enforcement machinery, which is used constantly.

Who is actually covered

The single most common mistake in Part 2 discussions is assuming it covers all behavioral health. It does not. Part 2 reaches a part 2 program, which HHS describes as any federally assisted program that provides SUD diagnosis, treatment, or referral for treatment. Federal assistance is defined broadly in section 2.12 and includes far more than direct grant funding, which is why programs that think of themselves as privately funded often still fall inside the rule.

The rule also follows the records outward. Section 2.11 defines a lawful holder as a person bound by Part 2 because they received records under a section 2.31 consent with an accompanying notice of disclosure, or under one of the statutory exceptions. HHS lists other health care providers, qualified service organizations, HIPAA covered entities and business associates, intermediaries, and investigative agencies among those who can be bound. An intermediary is defined separately as a person other than a part 2 program, covered entity, or business associate that receives records under a general designation in a consent for distribution to member participants, which is the definition that captures many health information exchanges and care-coordination networks.

A general mental health practice with no SUD program, no federal assistance, and no receipt of Part 2 records is governed by HIPAA and state law, not by Part 2. A primary care clinic that receives a patient's SUD records from a Part 2 program under consent is in a different position, because it is now handling records that carry restrictions HIPAA alone would not impose.

What the CARES Act set in motion

Section 3221 of the Coronavirus Aid, Relief, and Economic Security Act directed HHS to align parts of the SUD confidentiality regime with HIPAA and HITECH. SAMHSA published the resulting final rule in the Federal Register on February 16, 2024. The rule took effect on April 16, 2024, and HHS set the compliance date two years out. Its own fact sheet states that persons subject to the regulation must comply with the applicable requirements of the final rule by February 16, 2026.

Two years is a long runway, and a lot of programs used it the way organizations usually use long runways. The deadline arrived anyway, and it arrived with teeth attached.

Consent: one signature can now carry treatment, payment, and operations

Under the old rule, a Part 2 program generally needed a consent that named the specific recipient and described the specific disclosure. That model was workable for a standalone clinic and close to unworkable inside an integrated delivery system. Section 2.31 now permits a single written consent covering all future uses and disclosures for treatment, payment, and health care operations, and it allows the recipient description to be written as a class, using language such as my treating providers, health plans, third-party payers, and people helping to operate this program.

The elements themselves still have to be right. The consent must include the patient's name, the identification of the persons or class of persons authorized to make the use or disclosure, a description of the information that identifies it in a specific and meaningful fashion, a description of each purpose, notice of the right to revoke in writing, an expiration date or expiration event, the patient's signature, and the date of signature, along with the required statements about redisclosure and about the consequences of refusing to sign. A consent form drafted before 2024 will usually fail this list in more than one place, which is why the form itself is the first document to pull in any Part 2 review.

There are two firm exceptions to bundling. A consent for the use or disclosure of SUD counseling notes may only be combined with another consent for SUD counseling notes. And a consent for use or disclosure in a civil, criminal, administrative, or legislative proceeding may not be combined with consent for anything else. Both exceptions exist for the same reason: those are the disclosures most likely to harm the patient, so the rule refuses to let them ride along inside a routine intake signature.

Redisclosure, and the line that does not move

Once a HIPAA covered entity or business associate receives Part 2 records under a treatment, payment, and operations consent, it may redisclose those records as HIPAA permits. HHS puts it directly: that entity can share the record again without consent in all the ways that HIPAA allows, except for using the information in legal proceedings against the patient.

That exception is the most important sentence in the entire alignment project. The practical effect is that Part 2 records can now flow through ordinary healthcare operations, but they carry a permanent restriction with them. Any organization that receives them needs a way to know that a given record came from a Part 2 source, because the restriction attaches to the information rather than to the original holder. Segmentation stopped being a universal requirement and started being an operational necessity in a narrower place: knowing which records you cannot hand to a subpoena without a court order.

SUD counseling notes

Section 2.11 defines SUD counseling notes as notes recorded in any medium by a Part 2 program provider who is a SUD or mental health professional, documenting or analyzing the contents of conversation during a private, group, joint, or family SUD counseling session, and separated from the rest of the patient's SUD and medical record. The definition excludes medication prescription and monitoring, session start and stop times, modalities and frequencies of treatment, results of clinical tests, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress to date.

Anyone who has worked with the HIPAA psychotherapy notes definition will recognize the structure, including the trap inside it. The protection depends on the separation. Notes that live inside the general record do not qualify, no matter how sensitive their content. If a program wants this protection, the workflow and the chart have to be built to keep those notes apart, and clinical staff have to understand which of their documentation lands on which side of the line.

The patient notice under section 2.22

The old requirement to give patients a written summary of federal confidentiality law has been replaced with something much closer to a HIPAA notice of privacy practices. Section 2.22 requires each Part 2 program to inform the patient that federal law protects the confidentiality of substance use disorder patient records, at the time of admission or, if the patient lacks capacity at admission, as soon afterward as capacity is attained.

The notice has a required content list: a header identifying it as the program's notice of privacy practices, a description of uses and disclosures permitted without written consent in sufficient detail, the types of disclosures that require written consent with at least one example, patient rights including access, requesting restrictions, and obtaining an accounting, a statement that records cannot be disclosed in legal proceedings without specific written consent or a court order, the program's duties regarding privacy and breach notification, complaint procedures with an assurance of non-retaliation, contact information, and an effective date. It must be in plain language and available in paper or electronic form on request.

A program that already maintains a HIPAA notice should not simply staple the two together. The section 2.22 notice has its own content list and its own trigger, and the two documents describe different legal regimes even where they overlap.

Patient rights: access, accounting, and restriction requests

Section 2.23 covers patient access and restrictions on use and disclosure. Section 2.26 gives patients the right to request privacy protection for records, which parallels the HIPAA right to request restrictions on disclosures for treatment, payment, and health care operations.

Section 2.25 is the one worth reading twice. It gives a patient the right to an accounting of all disclosures made with consent under section 2.31 in the three years before the request, and it provides that a program must account for treatment, payment, and operations disclosures only where those disclosures are made through an electronic health record. That second half carries a caveat most summaries skip: HHS tied the compliance date for the electronic health record accounting requirement to the effective date of any finalized HHS modifications to the HITECH accounting of disclosures requirements, and that HITECH rulemaking has not been finalized. So the three-year accounting for consented disclosures is a live duty today, while the broader treatment, payment, and operations accounting through an electronic health record waits on separate rulemaking. A program should build the accounting log now and should not claim the deferred piece is already required.

Security and breach notification under section 2.16

Section 2.16 requires Part 2 programs to have formal policies and procedures for both paper and electronic records. For paper, that means secure storage such as a locked room, cabinet, safe, or similar container when records are not in use, plus procedures for transfer, removal, and destruction through sanitization. For electronic records, it means policies covering creating, receiving, maintaining, and transmitting records, and secure destruction that renders patient information non-retrievable. De-identification is pointed at the HIPAA standard in 45 CFR 164.514(b), such that there is no reasonable basis to believe the information can be used to identify a particular patient.

The larger change is in the same section: 45 CFR part 160 and subpart D of 45 CFR part 164 now apply to Part 2 programs for breaches of unsecured records. In practice that means the HIPAA breach notification workflow is the Part 2 breach notification workflow: the same four-factor risk assessment, the same individual notification timing, the same media notice threshold, and the same reporting to the Secretary. A Part 2 program that is not also a HIPAA covered entity may be meeting these obligations for the first time, and that is the gap most likely to produce a bad first year.

Enforcement is the part that changed the risk calculation

Before the final rule, a Part 2 violation carried criminal fine exposure under the statute and very little else. Section 2.3 now provides that any person who violates 42 U.S.C. 290dd-2(a) through (d) is subject to the applicable penalties under sections 1176 and 1177 of the Social Security Act, the same civil money penalty and criminal provisions behind HIPAA enforcement. Section 2.3(c) goes further and applies 45 CFR part 160, subparts C, D, and E to noncompliance with Part 2 in the same manner as they apply to covered entities and business associates. Those subparts are the compliance and investigation procedures, the civil money penalty procedures, and the hearing procedures.

Section 2.3(b) also creates the limitation on liability for investigative agency personnel that HHS describes as a safe harbor. An agency that exercises reasonable diligence to determine whether Part 2 applies before requesting records, and that complies with the applicable provisions afterward, is protected from civil or criminal liability. The fact sheet notes that reasonable diligence includes checking the SAMHSA facility locator and provider notices.

On February 13, 2026 HHS announced a civil enforcement program for the confidentiality of SUD patient records, effective February 16, 2026. From that date OCR accepts complaints alleging Part 2 violations and notifications of breaches of SUD patient records, and penalties align with the HIPAA mechanisms: resolution agreements, monetary settlements, corrective action commitments, and civil money penalties. OCR Director Paula M. Stannard framed the program as a way to instill confidence in patients so they will seek treatment from covered providers.

The practical read is straightforward. Part 2 moved from a rule with strict requirements and weak consequences to a rule with slightly looser requirements and HIPAA-grade consequences. Complaint-driven enforcement is how most HIPAA cases begin, and Part 2 now has a complaint channel.

Records in legal proceedings

The 2024 rule tightened rather than relaxed the protection that gave Part 2 its original purpose. Part 2 records and testimony relaying their content generally may not be used in a civil, criminal, administrative, or legislative proceeding against the patient unless the patient gives specific written consent or a court issues an order that authorizes the use or disclosure, with the procedures in subpart E of Part 2 setting out how such an order is obtained. A subpoena on its own is not enough.

This is where a well-trained records clerk is worth more than a policy binder. The moment a subpoena arrives, someone has to recognize that these records are different, route the request correctly, and avoid the reflex of producing what was asked for. That recognition is a training outcome, not a documentation outcome.

What this means for workforce training

Part 2 does not publish a course syllabus, and no federal agency certifies individuals or organizations as Part 2 compliant, just as no federal agency issues an official HIPAA certificate. What the rule does is create a set of decisions that front-line staff have to get right in real time, most of which a general HIPAA course never mentions.

A reasonable training scope for a Part 2 program covers the HIPAA baseline first, because the breach rule, the security expectations, and the notice structure now come straight from HIPAA. On top of that it needs the Part 2 layer: what makes an organization a Part 2 program, why the fact of a person's presence is itself protected, what a valid section 2.31 consent looks like, which notes are SUD counseling notes, what the section 2.22 notice promises patients, how accounting and restriction requests are handled, what to do when a subpoena arrives, and how to report a suspected breach fast enough for someone to investigate it.

Keep the evidence retrievable. Under an enforcement regime that now includes compliance reviews and complaint investigations, the useful artifacts are the same ones HIPAA investigators ask for: who was trained, on what scope, on what date, with a record someone can produce without a search. A workforce training requirement is only as good as the file behind it.

One boundary is worth stating clearly, because vendors blur it constantly. Training proof and organizational compliance are different things. A certificate documents that a named person completed training covering a defined scope on a specific date. It does not establish that the program's consent forms are current, that the section 2.22 notice has been issued, that breach procedures work, or that the accounting log exists. Use the certificate as the workforce-training evidence inside a Part 2 program, and keep the rest of the program documentation where a compliance officer can retrieve it when OCR, a payer, or a partner asks.

A short reading list of primary sources

Work from the regulation and the agency, not from summaries. The regulation itself is at 42 CFR Part 2 on eCFR, with subpart B carrying the general provisions at sections 2.11 through 2.26 and subpart C carrying the consent rules at sections 2.31 through 2.36. The statute is 42 U.S.C. 290dd-2. The rulemaking record is the February 16, 2024 final rule. HHS maintains both a plain-language Part 2 overview and a final rule fact sheet. The enforcement announcement is the February 13, 2026 HHS press release.

None of this is legal advice, and a program with a genuinely hard question about federal assistance, segmentation, or a specific subpoena should get counsel. What the sources above do give you is a way to check any claim someone makes about Part 2 against the section number it supposedly comes from, which is usually enough to separate the accurate summaries from the confident ones.