42 CFR Part 2: consent and redisclosure for substance use records

Reference article · 5 min read

Agencies that operate, fund, or exchange data with substance use disorder treatment programs work under two federal privacy regimes at once. HIPAA covers protected health information broadly. 42 CFR Part 2, the federal rule implementing a separate confidentiality statute for these records, is narrower in scope and stricter. A vendor saying its system is HIPAA compliant tells you nothing about whether it can satisfy Part 2.

The gap narrowed after Congress, in the CARES Act, directed HHS to align Part 2 more closely with HIPAA, and HHS issued a final rule in 2024 with a compliance date in early 2026. Alignment is not merger. Consent still does work under Part 2 that it does not do under HIPAA, and some protections follow the record after it leaves the program. Requirements change, so confirm current text and more protective state law with your counsel.

What makes something a Part 2 program

Part 2 applies to federally assisted programs that hold themselves out as providing, and do provide, substance use disorder diagnosis, treatment, or referral for treatment.

• Federal assistance is broad. It reaches past grant funding to include Medicare or Medicaid participation, federal tax-exempt status, and registration to dispense controlled substances.
• Holding out is a facts test. Signage, directories, licensure, billing, and how staff describe the service all count. A clinician who addresses substance use incidentally is usually not a program.
• Units inside general facilities count. In a hospital or clinic, an identified unit, or staff whose primary function is substance use disorder care and who are identified that way, can be the program even when the wider facility is not.
• The protected fact is broader than a diagnosis. Information identifying someone as a patient of the program is itself protected, including confirming that the person is there.

Where Part 2 and HIPAA diverge

• Consent versus permission. HIPAA allows most treatment, payment, and operations disclosures without authorization. Part 2 requires written consent outside narrow exceptions such as bona fide medical emergencies, audit and evaluation, research, and qualified service organizations.
• Downstream control. HIPAA largely stops governing a recipient who is not a covered entity or business associate. Part 2 attaches conditions to the record in the recipient's hands.
• Legal proceedings. Part 2 restricts use of the records and related testimony against the patient absent consent or a qualifying court order. HIPAA has no equivalent.

What a valid consent must contain

Part 2 consent is a specified document, not a signature line. Expect it to require, in substance: the patient's name; the program permitted to disclose; the recipient, by name or by a permitted general designation; how much and what kind of information may be disclosed; the purpose; a statement that treatment or benefits are not conditioned on signing; when the consent expires; and the patient's signature and date.

The 2024 rule allows a single consent covering future disclosures for treatment, payment, and health care operations, instead of a separate consent per recipient and purpose. Patients also gain a right to a copy of the consent and, on request, a list of entities that received the record under it, so the system must produce that list. Consents tied to criminal justice referrals follow separate rules on duration and revocability.

The redisclosure notice and what recipients may do

Each consented disclosure must carry a written statement telling the recipient that federal rules restrict further disclosure and that a general medical release does not authorize it. The 2024 rule revised that notice text. A covered entity or business associate receiving records under such a consent may then redisclose as HIPAA permits, with exceptions that persist, notably counseling notes and the restriction on use against the patient. Recipients need not segregate Part 2 data, but a commingled record can carry the restrictions with it, which is why many segment anyway.

Records, courts, and criminal investigations

A subpoena by itself is not authority. Using Part 2 records or testimony to investigate or prosecute a patient generally requires written patient consent or a court order issued under Part 2's own procedures, which call for notice and specific findings. Prosecutors commonly need both an order and a subpoena. Records custodians, drug court staff, and front desk personnel should follow a written script for subpoenas, warrants, and discovery requests, not improvise at the counter.

What this means operationally

• Co-location pulls systems into scope. When a Part 2 program shares an EHR, scheduling system, or warehouse with a clinic or county department, decide deliberately whether the data is segmented or the combined record is treated as Part 2 throughout. Role-based access control is not consent.
• An exchange needs a legal basis, not just an interface. Confirm whether the HIE acts as a qualified service organization, what consent it captures and honors, and whether it can suppress and restore sharing at the record level.
• Downstream county systems need a basis too. Before routing data to a jail, court, housing, or analytics system, identify the consent or exception that permits it.

What to ask vendors and put in the contract

1. Name Part 2 obligations in the contract, not HIPAA alone, and require a qualified service organization agreement where the vendor handles records.
2. Ask for a live demonstration: capture a consent with each required element, attach the notice to a disclosure, revoke the consent, and produce the disclosure list.
3. Ask how the product segments Part 2 data, and what happens when it cannot.
4. Require breach notification and audit logging terms consistent with current Part 2 requirements.
5. Ask what the vendor changed for the 2024 rule and how it tracks later amendments.

HQT is a technology and software company working with state and local agencies on application development, systems integration, and data management for regulated record systems.

Frequently asked questions