42 CFR Part 2 after the 2024 rule: what substance use programs and practices must do now

The short version

• Part 2 still protects substance use disorder (SUD) records more than HIPAA does. You still need the patient's written consent for most disclosures, and the records still can't be used against the patient in a civil, criminal, administrative or legislative proceeding without their specific consent or a court order.
• One consent can now cover all future treatment, payment and health care operations (TPO). A recipient that is a HIPAA covered entity or business associate may then use and redisclose the records as HIPAA allows, except in proceedings against the patient.
• Part 2 now borrows HIPAA's enforcement. Breaches of unsecured Part 2 records follow the HIPAA breach notification rule, and violations carry HIPAA's civil and criminal penalties.
• Dates: the final rule in the Federal Register was published February 16, 2024, took effect April 16, 2024, and required compliance by February 16, 2026. If your consent forms, notice of privacy practices and release workflow haven't been updated, they're overdue.

Who Part 2 covers

Part 2 applies to a "Part 2 program": a federally assisted program that holds itself out as providing, and does provide, SUD diagnosis, treatment or referral for treatment (42 CFR 2.11 and 2.12). Both halves have to be true.

Test	What it means in practice
Holds itself out	You tell the public you treat substance use: your license (a Texas chemical dependency treatment facility license, for example), your website, your directory listings, your name. A standalone IOP, PHP or outpatient SUD program almost always qualifies; our guide to starting an IOP or PHP in Texas covers the license that makes it one. So can a solo LCDC or counselor whose practice is SUD treatment.
Federally assisted	Broader than most people think. It includes Medicare participation, Medicaid or other federal money (even when it comes through the state), a DEA registration used to treat SUD, and tax-exempt status. Few programs that bill insurance fall outside it.
General medical settings	A primary care clinic, hospital or psychiatric practice isn't a Part 2 program just because it treats patients who use substances. It's covered only for an identified unit, or identified staff, whose main job is SUD care, and that is held out as such.

Part 2 also follows the records. A health plan, a hospital, a lab or a care coordinator that receives Part 2 records under a consent is bound by the rule's limits on what it does with them. That's why the notice in the next sections has to travel with every release.

Not sure whether you're a Part 2 program? If you treat SUD and bill any public payer, plan as if you are and ask your attorney to confirm. Treating records as Part 2 when they aren't costs little; the reverse can cost a lot.

What the 2024 rule changed

The CARES Act (section 3221) told HHS to bring Part 2 closer to HIPAA. The final rule from HHS, through SAMHSA and the Office for Civil Rights (OCR), did that in these ways (summarized from HHS's fact sheet on the final rule):

Topic	Before	Since the 2024 rule
Consent for TPO	Consents named specific recipients and purposes, often one form per recipient.	One consent can cover all future uses and disclosures for treatment, payment and health care operations, until the patient revokes it in writing.
Redisclosure	Recipients generally couldn't redisclose without new consent.	Covered entities, business associates and Part 2 programs that receive records under a TPO consent may redisclose them as HIPAA allows, except for proceedings against the patient. Recipients don't have to segregate Part 2 records from other records.
Legal proceedings	Records protected from use against the patient.	Still protected, and stronger: a consent to use records in a proceeding must be separate from any other consent. An investigating agency that unknowingly receives records has a safe harbor if it acted in good faith.
SUD counseling notes	No separate category.	A new category, like HIPAA's psychotherapy notes: a clinician's separate notes analyzing a counseling session need their own consent, which can't be combined with other consents. A TPO consent doesn't cover them.
Patient notice	A short Part 2 summary at admission.	A notice of privacy practices aligned with HIPAA's: your duties, how records are used, the patient's rights, how to complain, and an effective date.
Patient rights	Limited.	A right to request restrictions (including keeping a self-paid service from the health plan), a right to complain to HHS, an accounting of disclosures (the TPO part is on hold until HHS updates HIPAA's accounting rule), and a right to opt out of fundraising.
Breaches	No Part 2 breach notification rule.	HIPAA's breach notification rule applies to breaches of unsecured Part 2 records.
Penalties	Criminal fines only.	HIPAA's civil money penalties and criminal penalties, enforced by OCR.

Consent, including the single TPO consent

Most disclosures still need the patient's signed consent. A valid Part 2 consent (42 CFR 2.31) now closely matches a HIPAA authorization. It includes:

• The patient's name, and who is allowed to make the disclosure (your program, by name or general designation).
• A specific, meaningful description of what may be shared, for example "all SUD treatment records" or "attendance and discharge summary".
• Who receives it: a name, or for a TPO consent a class such as "my treating providers, health plans, third-party payers, and people helping to operate this program".
• The purpose. "At the request of the patient" and "for treatment, payment, and health care operations" are both acceptable descriptions.
• The patient's right to revoke in writing, how to do it, and that revoking doesn't undo what was already shared.
• An end date, event or condition.
• For a TPO consent to a covered entity or business associate, a statement that the records may be redisclosed as HIPAA allows. Also a statement about the patient's right to choose not to sign, and the date and signature of the patient (or the person authorized to sign for them).

Three consents stay separate: the TPO consent, any consent to share SUD counseling notes, and any consent to use records in a legal proceeding. Don't combine them on one form.

Minors. Who signs for a minor depends on state law. Texas lets a minor consent to some SUD treatment (Texas Family Code 32.003), and Part 2 (42 CFR 2.14) then gives the minor control of the consent to disclose. Have your attorney set your intake rules for minors, and record who consented and on what basis.

A general medical release ("release any and all records") is not a valid Part 2 consent. The federal notice says so in as many words.

The notice that goes with every release

Every disclosure made with the patient's consent has to carry the notice to the recipient in 42 CFR 2.32, plus a copy of the consent or a clear explanation of what it allows. The 2024 rule rewrote the notice. In short, it tells the recipient that the record is protected by 42 CFR Part 2, can't be used against the patient in any proceeding without their consent or a court order, and can be used or disclosed further only if the patient's written consent or Part 2 allows it, or if the recipient is a covered entity or business associate that received it for TPO. It ends by saying a general authorization for release of medical information is not enough.

The rule also allows an abbreviated version where space is short: "42 CFR part 2 prohibits unauthorized use or disclosure of these records." Use the full text on letters, record copies and faxes, and keep the exact wording from the current regulation in your release template.

Disclosures that don't need consent

Part 2 allows a short list of disclosures without the patient's consent. Each one has limits, so write down which one you relied on every time:

• Medical emergencies (2.51): to medical personnel, to the extent needed to treat a bona fide emergency. Record who, when, what and why.
• Qualified service organizations and business associates (2.12(c)(4)): vendors such as your EHR, billing company or lab, under a written agreement that binds them to Part 2.
• Communications inside the program among staff who need the information to do their jobs.
• Reports of suspected child abuse or neglect under state law (2.12(c)(6)). The rest of the record still needs consent or a court order.
• Crimes on the program's premises or against staff (2.12(c)(5)), limited to the circumstances of the incident.
• Research, audits and evaluations (2.52, 2.53), under their own conditions.
• Court orders issued under Part 2's own procedures (2.61 to 2.67). A subpoena alone is not enough: Part 2 requires a court order that meets the rule's criteria, and a subpoena to compel the disclosure.

The patient's own request for their records isn't a disclosure to a third party at all. It's their right of access, which in Texas runs on a 15-business-day clock for electronic records. Our HIPAA checklist covers the patient-rights requests.

Patient rights and your notice of privacy practices

• Notice of privacy practices. Give it at admission (or as soon as the patient can understand it), post it, and put it on your website. It describes how Part 2 records are used and the patient's rights. If you're also a HIPAA covered entity, one combined notice can meet both rules.
• Restrictions. Patients may ask you to restrict disclosures. You must agree when they pay in full out of pocket and ask that the health plan not be told about that service.
• Accounting and list of disclosures. Keep a record of every disclosure outside the program. HIPAA already requires an accounting of non-TPO disclosures for 6 years; Part 2's new TPO accounting is on hold until HHS finalizes changes to HIPAA's accounting rule.
• Complaints. Patients can complain to you and to HHS, and you can't retaliate against them for it.

Breaches and penalties

Part 2 programs now follow the HIPAA breach notification rule for unsecured Part 2 records (42 CFR 2.16). That means a risk assessment for every incident, notice to affected patients without unreasonable delay and within 60 days of discovery, and notice to HHS (within 60 days for 500 or more people, or in the annual log for fewer). In Texas, the state breach law (Business and Commerce Code 521.053) adds notice to the Attorney General within 30 days when 250 or more Texans are affected. Records encrypted to HHS's standard aren't "unsecured", which is the best argument for encrypting every laptop and phone. Our HIPAA checklist walks through the incident response steps.

Penalties now follow HIPAA's tiers, from civil money penalties for violations through criminal penalties for knowing misuse. OCR enforces both HIPAA and Part 2.

If your program closes or is sold

Part 2 has its own rule for this (42 CFR 2.19). When a program stops operating or is taken over, it must remove patient-identifying information or destroy the records, unless the patient consents in writing to transfer them to the new program, or a law requires the records to be kept longer. Records kept under a legal requirement are sealed (paper) or moved to an encrypted, labeled store (electronic), marked with the program's name, the law requiring them and the date they may be destroyed, and destroyed after that date. Our Texas records retention guide covers how long that is.

The Part 2 checklist

Need the forms themselves? Cima Consulting's practice policies and forms kit ($750) includes a Part 2-ready release of information, and the program policy manual ($4,500) includes the Part 2 confidentiality policy. See the policy kits and services.

How Cima handles Part 2 releases

We built these rules into Cima for addiction counselors and the Program plan for IOPs and PHPs because our own program has to follow them; the same rules engine runs our program's records. On each client's Privacy tab:

• Releases are checked before anything goes out. A signed release records the recipient, the purpose, what may be shared and an end date. Cima refuses a release when there's no current consent for that recipient, when the consent was revoked or has expired, or when the client has a restriction on file for that recipient, and it tells you why. The refusal opens the form to record the client's signed release, filled in, then brings you back to the release.
• The general treatment-and-billing consent asks who. When you release under it, Cima asks which provider or plan, and whether it's for treatment or payment, so the restriction check and the client's list of disclosures name a real recipient.
• The 42 CFR 2.32 notice prints on the release. For a substance use program, every chart released outside the practice carries the federal notice to the recipient as its last page. Cima downloads the PDF; you send it by secure email or fax.
• Exceptions need a reason. A medical emergency, court order, audit, QSO, research, child abuse report or crime on the premises can be chosen as the basis, and each asks you to write what it rests on, such as the order's number.
• The client's own copy goes only to the client (or their personal representative). Anyone else needs the client's signed consent.
• Every release goes on the client's list of disclosures, ready to print when they ask, and into the practice's access log, which can only be added to.
• Self-pay restrictions block the claim. If the client paid in full and asked that their plan not be told, Cima won't send that claim.

Our Business Associate Agreement includes the qualified service organization terms Part 2 asks for. What Cima doesn't do: decide for you whether you're a Part 2 program, write your notice of privacy practices, or train your staff. Those stay with you. See how Cima protects records, from the BAA to the access log.

Questions

When did the 2024 Part 2 rule take effect?

HHS published the final rule on February 16, 2024. It took effect April 16, 2024, and programs, covered entities and business associates had to comply by February 16, 2026. Part 2's new accounting of TPO disclosures is on hold until HHS updates HIPAA's accounting rule.

Can one consent cover all treatment, payment and operations now?

Yes. A patient can sign a single consent for all future uses and disclosures for treatment, payment and health care operations. It lasts until they revoke it in writing. Consents for SUD counseling notes and for use in legal proceedings must still be separate.

Does the redisclosure notice still have to go with every release?

Yes. Each disclosure made with the patient's consent carries the 42 CFR 2.32 notice, updated by the 2024 rule, plus a copy of the consent or a clear explanation of its scope.

Is a solo LCDC in private practice a Part 2 program?

Often, yes: a counselor who holds out as treating substance use and is federally assisted (for example, through Medicare or Medicaid billing) meets the definition. Confirm your own situation with an attorney, and treat your records as Part 2 until you do.

Can we release records in response to a subpoena?

Not on a subpoena alone. Part 2 requires a court order issued under its own procedures (42 CFR 2.61 to 2.67), or the patient's specific consent. Call your attorney when a subpoena arrives, and respond in a way that doesn't confirm the person is a patient.

What's the difference between HIPAA and 42 CFR Part 2?

HIPAA covers almost all health information held by providers, plans and their vendors, and allows treatment, payment and operations disclosures without the patient's permission. Part 2 covers only records from federally assisted SUD programs and still requires the patient's written consent for most disclosures, bars use of the records against the patient in legal proceedings without consent or a court order, and requires the 2.32 notice on every consented release. The 2024 rule made the two work alike in many ways, but not those.

Does Part 2 cover mental health records?

Not on their own. Part 2 covers records that would identify someone as having or having had a substance use disorder, from a Part 2 program. Mental health records follow HIPAA and, in Texas, Health and Safety Code chapter 611. A co-occurring program's SUD records are Part 2 records; when in doubt, treat the whole chart as Part 2.

Do Part 2 breaches have to be reported now?

Yes. Since the 2024 rule, breaches of unsecured Part 2 records follow the HIPAA breach notification rule: notice to the patients affected within 60 days of discovery, and to HHS. Texas law adds notice to the Attorney General when 250 or more Texans are affected.

Sources

• HHS, Fact sheet: 42 CFR Part 2 final rule
• Federal Register, Confidentiality of Substance Use Disorder (SUD) Patient Records, final rule (Feb. 16, 2024)
• eCFR, 42 CFR Part 2, including 2.11, 2.14, 2.16, 2.25 and 2.31
• Baker Donelson, HHS compliance deadline approaching for updated Part 2 record protections
• AHIMA, 42 CFR Part 2 HIPAA alignment final rule FAQ
• Network for Public Health Law, Summary of the Part 2 final rule
• NASW, New HHS final rule modifies protections for substance use disorder records
• HHS, Breach Notification Rule; Texas Business and Commerce Code 521.053; Texas Health and Safety Code 181.101 and 181.102