42 CFR Part 2 after the 2024 final rule: what SUD programs and their partners must do now

For decades, 42 CFR Part 2 ran on its own track, with consent rules stricter than HIPAA and very little enforcement. The 2024 final rule moved it much closer to HIPAA, and as of February 16, 2026, the new rules are in force with a federal enforcement program behind them. If your organization treats substance use disorders, or receives records from a program that does, this is worth a careful review.

What Part 2 is and who it reaches

Part 2 is the federal regulation that protects the confidentiality of SUD patient records, based on the statute at 42 U.S.C. 290dd-2. It applies to a "Part 2 program," meaning a federally assisted program that holds itself out as providing, and provides, SUD diagnosis, treatment, or referral for treatment.

Both parts of that definition are broader than many people assume. Under 42 CFR 2.12, a program is federally assisted if, among other things, it participates in Medicare, holds a DEA registration to dispense controlled substances used to treat SUD, receives federal financial assistance in any form, or has tax-exempt status. And a "program" can be an identified SUD unit inside a general hospital, or staff in a general medical facility whose primary function is providing SUD services, not only a freestanding treatment center.

The rule also travels with the records. A "lawful holder" is anyone who receives Part 2 records through patient consent or one of the regulation's exceptions, and many of Part 2's restrictions apply to them. In practice that can include hospitals, primary care practices, health plans, qualified service organizations, and the vendors that host or process these records.

The 2024 final rule and its dates

Section 3221 of the CARES Act, passed in 2020, directed HHS to align Part 2 more closely with HIPAA. HHS, through OCR and SAMHSA, implemented it in the final rule Confidentiality of Substance Use Disorder (SUD) Patient Records, published in the Federal Register on February 16, 2024 (89 FR 12472). The rule took effect April 16, 2024, and anyone subject to it had to comply by February 16, 2026.

What changed

A single consent for treatment, payment, and health care operations. A patient can now give one written consent covering all future uses and disclosures for treatment, payment, and health care operations. Before, programs often needed separate, narrow consents for each recipient and purpose.

Redisclosure under HIPAA. HIPAA covered entities and business associates that receive Part 2 records under that consent may redisclose them as the HIPAA Privacy Rule permits. Part 2 programs that are not covered entities still redisclose only within the scope of the consent. Each consent-based disclosure must carry the required Part 2 notice statement, along with a copy of the consent or a clear explanation of its scope, under 42 CFR 2.32.

No segregation requirement. The rule says outright that a Part 2 program, covered entity, or business associate receiving records under a single TPO consent is not required to segregate or segment them. That is a relief for EHR design, but it does not remove the need to know where the records are and what consent covers them.

SUD counseling notes. The rule creates a new category, similar to HIPAA psychotherapy notes: notes recorded by a Part 2 program provider who is an SUD or mental health professional, documenting or analyzing a private or group counseling session, and kept separate from the rest of the record. They require their own specific consent and cannot be disclosed under a general TPO consent. Medication, session times, treatment modalities, and similar items are excluded from the definition.

Protection in legal proceedings. Without the patient's consent or a court order that meets Part 2's requirements, records and testimony about them cannot be used against the patient in civil, criminal, administrative, or legislative proceedings. Consent for use in a proceeding cannot be combined with consent for any other purpose. Investigative agencies get limited protection from liability if they act with reasonable diligence, which includes checking SAMHSA's treatment facility locator and the provider's privacy notice before requesting records.

Breach notification. The HIPAA Breach Notification Rule now applies to breaches of unsecured Part 2 records in the same way it applies to protected health information. That means notifying affected patients, HHS, and in larger breaches the media. HHS's breach reporting page now accepts Part 2 breach reports through the same portal used for HIPAA.

Penalties and enforcement. Part 2 violations are now subject to the same civil and criminal penalties that apply under HIPAA, and HHS applies its HIPAA enforcement procedures to Part 2. In August 2025, HHS delegated authority to administer and enforce Part 2 to the OCR Director, with the delegation notice published August 27, 2025.

Patient notice. The Part 2 patient notice now lines up with the HIPAA Notice of Privacy Practices, and patients gain new rights, including the right to request restrictions on certain disclosures. A separate HIPAA rule finalized in 2024 also required covered entities that create, receive, or maintain Part 2 records to add SUD record information to their own privacy notices. A federal court in Texas vacated most of that rule in June 2025, but the Part 2 notice provisions were not vacated and carried the same February 16, 2026 compliance date.

Complaints. Patients may now file a Part 2 complaint directly with HHS, as well as with the program. Programs may not retaliate against a patient for filing, and they need complaint procedures that track the HIPAA requirements.

What has happened since February 16, 2026

On February 13, 2026, HHS announced a civil enforcement program for Part 2. Starting February 16, OCR began accepting complaints alleging Part 2 violations and notifications of breaches of SUD records. OCR said investigations may end in resolution agreements, monetary settlements, corrective action commitments, or civil money penalties.

OCR also published an updated model HIPAA Notice of Privacy Practices and a model Part 2 Patient Notice in February 2026. A Part 2 program that is also a covered entity may use one combined notice that meets both sets of requirements.

On September 29, 2026, OCR issued an FAQ on when Part 2 allows state Medicaid agencies to use SUD records to verify exclusions from the Medicaid community engagement requirement. It is narrow, but it confirms OCR is now interpreting Part 2 as its own program. The current list of resources is on OCR's Part 2 page.

What to check now

Whether you run a behavioral health program, a hospital with an SUD unit, or a vendor that touches these records, these are the areas to review:

• Consent forms. Confirm your forms meet the elements in 42 CFR 2.31, including a revocation right and an expiration date or event. Decide whether to offer a single TPO consent, and make sure SUD counseling notes and legal proceedings each have their own separate consent.
• Notices. Compare your Part 2 Patient Notice and HIPAA Notice of Privacy Practices against the February 2026 models. Covered entities that only receive Part 2 records, such as a primary care practice getting records from a hospital, need the update too. Post the current notice on your website.
• EHR handling and labeling. Segmentation is not required, but you still need to find Part 2 records, know which consent applies, attach the 2.32 notice to disclosures, and keep SUD counseling notes separate. Ask your EHR vendor how its system flags Part 2 data and what travels with an outbound disclosure.
• Business associate and QSO agreements. Agreements written before 2024 may not mention Part 2 at all. Look for redisclosure limits, breach reporting duties for Part 2 records, and the bar on use in proceedings against the patient.
• Breach procedures. Your incident response plan should treat Part 2 records as reportable, set out who files the report, and follow the HIPAA timelines.
• Complaint process. Have a written procedure for receiving and documenting Part 2 complaints, and a clear no retaliation policy.
• Staff training. Front desk, release of information, billing, and clinical staff all need to know what changed: what the new consent now allows, and what still requires separate consent or a court order.

Include Part 2 records in your risk analysis

Part 2 requires programs to maintain formal policies and procedures to protect records, paper and electronic, against unauthorized use and disclosure. For covered entities and business associates, SUD records in their systems are also electronic protected health information under the HIPAA Security Rule. Now that breaches of these records are reportable and enforceable, they belong in your security risk analysis by name: which systems hold them, which vendors can reach them, and what would happen if they were exposed.

EHR Resources can help with each piece: a HIPAA security risk analysis that accounts for Part 2 data flows, updates to policies, consent forms, and notices, and staff training on the new rules. If your organization has not reviewed Part 2 since the compliance date, now is a good time to do it, before a complaint or a breach makes the decision for you.