15.2 Comparing 42 CFR Part 2 and HIPAA: Consent & Disclosures

15.2 Comparing 42 CFR Part 2 and HIPAA: Consent & Disclosures

[!NOTE] Navigating the Dual Regulatory Landscape: Behavioral health professionals operate at the intersection of two distinct federal privacy frameworks: the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules (45 CFR Parts 160 and 164) and federal regulations governing the Confidentiality of Substance Use Disorder Patient Records (42 CFR Part 2). Navigating these overlapping legal mandates requires advanced addiction counselors and clinical supervisors to master statutory preemption, differing operational standards for healthcare operations, and specialized vendor contracting.

---

The Federal Preemption Doctrine: Which Law Controls?

When behavioral health providers encounter conflicts between the HIPAA Privacy Rule and 42 CFR Part 2, clinicians and compliance officers must apply the federal legal doctrine of preemption.

Under HIPAA administrative rules (45 CFR § 160.203), HIPAA was designed to establish a federal regulatory "floor" of baseline privacy protections across the American healthcare system. However, HIPAA contains an explicit anti-preemption standard: it does not preempt any contrary provision of federal or state law that is "more stringent" than HIPAA.

A law or regulation is defined as "more stringent" if it:

• Provides greater privacy protection for the individual's health information.
• Grants greater rights of access or control to the individual regarding their records.
• Restricts disclosures that would otherwise be permitted under HIPAA without patient authorization.

Because 42 CFR Part 2 prohibits disclosures that HIPAA freely permits (such as unconsented disclosures for treatment coordination and insurance billing) and mandates specialized judicial procedures to access records in legal proceedings, 42 CFR Part 2 is significantly more stringent than HIPAA. Therefore, whenever an entity qualifies as a Part 2 program, 42 CFR Part 2 governs and controls all substance use disorder patient identifying information.

---

Protected Health Information (PHI) vs. SUD Patient Identifying Information

The scope of protected data diverges substantially between the two statutes:

Protected Health Information (PHI) under HIPAA

Under 45 CFR § 160.103, Protected Health Information (PHI) is defined broadly as individually identifiable health information transmitted or maintained in any form or medium (electronic, paper, or oral) by a covered entity or its business associate. It relates to the past, present, or future physical or mental health condition of an individual, the provision of healthcare to the individual, or the past, present, or future payment for healthcare.

SUD Patient Identifying Information under 42 CFR Part 2

Under 42 CFR § 2.11, Patient Identifying Information is defined as any information that identifies or could reasonably be used to identify an individual—either directly or indirectly—as having or having had a substance use disorder, or as being or having been diagnosed, treated, or referred for treatment for a substance use disorder by a Part 2 program.

The Operational Mandate: "Neither Confirm Nor Deny" (§ 2.13)

Under the HIPAA Privacy Rule (45 CFR § 164.510), general hospitals and medical clinics are permitted to maintain a facility directory containing the patient's name, room location, and general condition, and may disclose this information to individuals who ask for the patient by name (unless the patient explicitly opts out).

In stark contrast, under 42 CFR § 2.13, maintaining a public directory or acknowledging a patient's presence in an addiction treatment program is strictly prohibited. If a spouse, employer, family member, or law enforcement officer contacts an addiction treatment clinic asking if a specific individual is admitted, enrolled, or present, staff are legally forbidden from saying, "Yes, they are in group," or "They were discharged yesterday." Confirming presence reveals the individual has an SUD, violating federal law. Staff must utilize standard neutral language:

"Federal confidentiality regulations prohibit this facility from confirming or denying the presence, enrollment, or treatment of any individual without explicit written consent."

---

Treatment, Payment, and Health Care Operations (TPO): A Critical Divergence

The most profound operational distinction between HIPAA and 42 CFR Part 2 lies in their respective standards for Treatment, Payment, and Health Care Operations (TPO) disclosures:

+-----------------------------------------------------------------------------------+
|                    TPO DISCLOSURE STANDARDS: HIPAA VS. PART 2                     |
+-----------------------------------------------------------------------------------+
| HIPAA PRIVACY RULE (45 CFR § 164.506):                                            |
|   * Covered entities are legally authorized to disclose PHI for Treatment,       |
|     Payment, and Operations WITHOUT obtaining patient consent or authorization.   |
|   * Example: A hospital may bill an insurer or send records to a consulting       |
|     cardiologist without any signed patient release.                              |
+-----------------------------------------------------------------------------------+
                                     VERSUS
+-----------------------------------------------------------------------------------+
| 42 CFR PART 2 (§§ 2.31 & 2.33):                                                   |
|   * Part 2 strictly PROHIBITS disclosures for Treatment, Payment, or Operations   |
|     without prior written patient consent.                                        |
|   * Example: An addiction clinic CANNOT bill an insurer, coordinate care with an  |
|     outside physician, or consult an outside pharmacy without signed consent.     |
|   * CARES Act Section 3221 allows a SINGLE broad consent for all future TPO,      |
|     but that initial written consent remains an absolute statutory prerequisite.  |
+-----------------------------------------------------------------------------------+

Under HIPAA, obtaining patient consent for billing or clinical coordination is an administrative option, not a legal requirement. Under 42 CFR Part 2, releasing records to a commercial insurer, Medicaid managed care plan, or consulting primary care physician without a signed Part 2 consent form constitutes a direct violation of federal law, exposing the provider to civil monetary penalties.

---

The Nine Mandatory Elements of a Valid Part 2 Consent Form (§ 2.31)

Under 42 CFR § 2.31, patient consent to disclose substance use disorder records is subjected to rigorous technical standards. A general, blanket authorization—common in general medical settings—is completely void under Part 2. To be legally binding, a Part 2 consent form must contain all nine mandatory structural elements:

---

The 2024 Part 2 Final Rule — Fully Enforceable Since February 16, 2026

[!IMPORTANT] This is the most consequential recent change in SUD privacy law, and it is now live. HHS (the Office for Civil Rights jointly with SAMHSA) published the Part 2 Final Rule on February 16, 2024, implementing the CARES Act Section 3221 amendments. The rule took effect April 16, 2024, with a compliance date of February 16, 2026. OCR announced its Civil Enforcement Program for Confidentiality of Substance Use Disorder Patient Records on February 13, 2026 and began accepting Part 2 complaints on February 16, 2026. A 2026 candidate answering from pre-2024 Part 2 rules will get consent and redisclosure items wrong.

What the Final Rule actually changed:

[!CAUTION] What did NOT change. Part 2 still requires patient consent as the gateway — the single TPO consent replaces repeated consents, not the consent requirement itself. Records still cannot be used in criminal, civil, administrative, or legislative proceedings against the patient without a Subpart E court order or specific patient consent. And the more-stringent-rule preemption analysis is unchanged: where Part 2 gives more protection than HIPAA, Part 2 still controls.

---

The Prohibition on Redisclosure Notice (42 CFR § 2.32)

Whenever a Part 2 program discloses confidential patient identifying information pursuant to a valid written consent, the disclosure must be accompanied by a written notice addressing redisclosure. This requirement prevents a third party (such as an employer, family member, or non-HIPAA medical specialist) from re-releasing sensitive addiction records. Note the Final Rule interaction: where the disclosure was made to a HIPAA covered entity, business associate, or another Part 2 program under a single TPO consent, § 2.32 now permits an alternative notice reflecting that the recipient may redisclose under HIPAA. The classic verbatim notice below remains the correct choice for every other consented disclosure — the recipient who is not a covered entity, the employer, the court, the family member.

The regulatory notice must state verbatim or summarize the statutory prohibition:

"This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR Part 2). The federal rules prohibit you from making any further disclosure of this information unless further disclosure is expressly permitted by the written consent of the person to whom it pertains or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. The federal rules restrict any use of the information to investigate or prosecute with respect to a crime any patient with a substance use disorder, except as provided at §§ 2.12(c)(5) and 2.65."

---

Business Associate Agreements (BAAs) vs. Qualified Service Organization Agreements (QSOAs)

Both HIPAA and Part 2 recognize that healthcare facilities must routinely contract with third-party outside vendors for ancillary administrative, technical, and professional services (such as electronic health record [EHR] software hosting, medical billing, legal counsel, laboratory toxicology screening, and data management). However, the legal instruments authorizing these disclosures differ fundamentally:

Why a Standard HIPAA BAA Fails Under Part 2

On the IC&RC AADC examination, candidates are frequently tested on vendor management. If an addiction treatment clinic contracts with a cloud-based EHR company or a toxicology laboratory and executes only a standard HIPAA Business Associate Agreement, the clinic is in active violation of 42 CFR Part 2.

Under 42 CFR § 2.11, a Qualified Service Organization Agreement must contain an explicit contractual commitment wherein the service organization:

1. Acknowledges that in receiving, storing, processing, or otherwise dealing with any patient records from the program, it is fully bound by the provisions of 42 CFR Part 2.
2. Pledges that, if necessary, it will resist in judicial proceedings any efforts to obtain access to patient identifying information related to substance use disorders, except as permitted by Part 2 regulations.

---

Side-by-Side Comparison Matrix: HIPAA vs. 42 CFR Part 2

---

Breach Notification Requirements & Compliance Decision Workflow

Under the HITECH Act and the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414)—formally incorporated into 42 CFR Part 2 via CARES Act Section 3221—programs must execute strict incident response protocols following any unauthorized acquisition, access, use, or disclosure of unencrypted patient identifying data:

+-----------------------------------------------------------------------------------+
|                         PART 2 COMPLIANCE DECISION TREE                           |
+-----------------------------------------------------------------------------------+
| Step 1: Is the clinical entity federally assisted?                                |
|         NO  --> 42 CFR Part 2 does not apply (HIPAA or state privacy rules apply). |
|         YES --> Proceed to Step 2.                                                |
|                                                                                   |
| Step 2: Does the entity meet the § 2.11 definition of an SUD "Program"?           |
|         NO  --> 42 CFR Part 2 does not apply (HIPAA Privacy Rule governs).        |
|         YES --> 42 CFR Part 2 fully governs all SUD records.                      |
|                                                                                   |
| Step 3: What legal authority supports the requested disclosure?                   |
|         * Written Consent (§ 2.31) --> Verify all 9 elements + attach § 2.32 notice|
|         * Bona Fide Emergency (§ 2.51) --> Disclose minimum necessary & document  |
|         * Subpart E Court Order --> Verify good cause order + subpoena are present|
|         * Subpoena Alone --> REFUSE TO DISCLOSE; file motion to quash             |
|         * Outside Vendor --> Ensure signed QSOA + BAA are active before transfer   |
+-----------------------------------------------------------------------------------+

Breach Response Timelines

If an unauthorized breach of Part 2 records occurs (e.g., an unencrypted laptop is stolen or records are misdirected), the program must:

1. Conduct a formal four-factor risk assessment evaluating: the nature/extent of the data, the unauthorized recipient, whether data was actually viewed/acquired, and the extent of mitigation.
2. Notify each affected individual in writing without unreasonable delay and in no case later than 60 calendar days following discovery.
3. If the breach affects 500 or more individuals, notify the HHS Secretary and prominent media outlets within the jurisdiction within 60 days. If fewer than 500 individuals are affected, maintain an internal breach log and report annually to HHS.