15.2 42 CFR Part 2 Confidentiality
Key Takeaways
- A Part 2 program is a federally assisted program that holds itself out as providing, and provides, SUD diagnosis, treatment, or referral for treatment (42 CFR 2.11 and 2.12)
- The February 16, 2024 HHS/SAMHSA final rule (effective April 16, 2024; compliance required by February 16, 2026) still requires written consent before TPO sharing, but one consent may cover all future treatment, payment, and health care operations
- Current 42 CFR 2.31 consent elements include the patient's name, who may disclose, a meaningful description of the information (kind/amount), the recipient, purpose, right to revoke, expiration, signature, and date
- Exceptions without patient consent include a bona fide medical emergency, a crime on premises or against personnel, child-abuse reporting, a court order after a good-cause showing, audit/evaluation, and a qualified service organization agreement
- SUD counseling notes and use of records in legal proceedings against the patient cannot ride on a broad TPO consent; a subpoena is not a Part 2 court order
What 42 CFR Part 2 protects
42 CFR Part 2 is the federal Confidentiality of Substance Use Disorder Patient Records rule. It implements 42 U.S.C. 290dd-2. The purpose is practical: people avoid treatment if they fear that an SUD record will be shown to an employer, landlord, or prosecutor. Part 2 protects records that would identify a patient as having or having had a substance use disorder (SUD) and that were obtained by a Part 2 program for diagnosis, treatment, or referral for treatment.
This section teaches the current rule. HHS, through SAMHSA and the Office for Civil Rights, published a final rule on February 16, 2024 (89 FR 12472). The rule was effective April 16, 2024. Persons subject to it had to comply by February 16, 2026. As of this 2026 study date, that compliance date has passed. Do not treat 2017-only consent practice—a new named-recipient consent for almost every disclosure, with no single TPO consent—as if it were still the governing federal text.
CARES Act section 3221 (March 27, 2020) directed HHS to make specified Part 2 provisions consistent with the HIPAA Rules and HITECH. The 2024 rule did that for consent content, a single TPO consent, certain redisclosures by HIPAA covered entities and business associates, breach notification, penalties, patient notice, accounting and restriction rights, and SUD counseling notes. What did not change: SUD records still cannot be used to investigate or prosecute the patient without written consent or a qualifying court order.
Who is a Part 2 program
Two tests both have to be met: the setting is a program under § 2.11, and it is federally assisted under § 2.12(b).
Program means:
- A person (other than a general medical facility) that holds itself out as providing, and provides, SUD diagnosis, treatment, or referral for treatment; or
- An identified unit inside a general medical facility that holds itself out as providing, and provides, those services; or
- Medical personnel or other staff in a general medical facility whose primary function is SUD diagnosis, treatment, or referral and who are identified as such providers.
Federally assisted is a low bar. Examples in § 2.12(b) include being conducted by a U.S. agency; participating in Medicare; holding federal authorization to conduct maintenance treatment or withdrawal management; holding DEA registration to dispense a controlled substance used to treat SUD; receiving any federal financial assistance, even if the dollars were not earmarked for SUD; being run by a state or local unit that receives federal funds that could be spent on the program; or having IRS tax-exempt status or deductible contributions.
Trap: assuming every hospital encounter is Part 2. § 2.12(e)(1) gives the classic counter-example: emergency-room staff who send an overdose to intensive care are not a Part 2 program unless their primary function is SUD care or the emergency room has promoted itself as an SUD provider. A private cash-pay counselor with no Medicare, no grant, no tax-exempt status, and no SUD-related DEA registration may also fall outside Part 2—though state law can still be strict.
A patient includes current and former patients, and anyone who applied for diagnosis, treatment, or referral. Records include recorded and unrecorded information relating to a patient (diagnosis, billing, emails, voicemails, texts).
Written consent: current § 2.31 elements
Unlike HIPAA, Part 2 still generally requires written patient consent before a program uses or discloses records for treatment, payment, and health care operations (TPO). The 2024 change is that one consent may cover all future TPO uses and disclosures until the patient revokes it in writing.
Consent may be paper or electronic. Required elements under current § 2.31(a) include:
| Element | Current rule (2024 text) |
|---|---|
| Patient | Name of the patient |
| Who may disclose | Name or specific identification of the person(s) or class authorized to use or disclose |
| Kind and amount | A description of the information that identifies it in a specific and meaningful fashion |
| Recipient | Name(s) or class of persons to whom disclosure is made. For a single TPO consent, a statement such as "my treating providers, health plans, third-party payers, and people helping to operate this program" is enough |
| Purpose | A description of each purpose. "At the request of the patient" suffices when the patient initiates and elects not to specify. "For treatment, payment, and health care operations" suffices for a single TPO consent |
| Right to revoke | Right to revoke in writing, except to the extent the program or other lawful holder has already acted in reliance, and how to revoke |
| Expiration | A date or an event tied to the patient or the purpose. "End of the treatment," "none," or similar language is sufficient for TPO |
| Signature | Patient signature (and a person authorized under § 2.14 or § 2.15 when required for a minor or a patient who lacks capacity). Electronic signatures are permitted unless another law forbids them |
| Date | Date the consent is signed |
A TPO consent must also state that records may be redisclosed by the recipient and no longer protected by Part 2, and must state the consequences of refusing to sign. If the recipient is a HIPAA covered entity or business associate receiving records for TPO, the consent must state that the record may be redisclosed under HIPAA except for uses and disclosures in civil, criminal, administrative, or legislative proceedings against the patient.
Do not combine TPO consent with consent to use records in legal proceedings against the patient. SUD counseling notes—notes analyzing counseling conversation that the clinician voluntarily keeps separate from the rest of the SUD and medical record—need their own consent. A broad TPO consent does not authorize those notes. They are analogous to HIPAA psychotherapy notes. Medication monitoring, session times, test results, and summaries of diagnosis, the treatment plan, symptoms, prognosis, and progress are not SUD counseling notes.
Each disclosure made with consent must include a copy of the consent or a clear explanation of its scope. A consent that has expired, is facially deficient, is known to be revoked, or is known to be materially false cannot support a disclosure.
Once a valid TPO consent is in place, a Part 2 program, covered entity, or business associate may use and disclose those records for TPO as permitted by the HIPAA regulations until written revocation. A covered entity or business associate that is not itself a Part 2 program may further disclose those records under HIPAA. Records still may not be used against the patient in legal proceedings without specific consent or a Part 2 court order. Segregating Part 2 data is not required after a TPO consent, though programs may still segment as an operational choice.
Exceptions that do not need patient consent
Consent is the default. These are the exceptions ADC items expect you to recognize.
Medical emergency (§ 2.51). Disclose to medical personnel to the extent necessary to meet a bona fide medical emergency when prior written consent cannot be obtained, or when the program is closed during a declared disaster and cannot obtain consent. Immediately document: the name and affiliation of the medical personnel, the name of the person who disclosed, the date and time, and the nature of the emergency.
Crime on premises or against personnel (§ 2.12(c)(5)). Limited reports to law enforcement about a patient's crime, or threat of a crime, on program premises or against program personnel. Limit the content to the circumstances of the incident, including patient status, name, address, and last known whereabouts. This is not a general "call the police with the whole chart" exception.
Child abuse and neglect reporting (§ 2.12(c)(6)). Part 2 does not block the initial report of suspected child abuse or neglect required by state law. Follow-up use of the original SUD record in later civil or criminal proceedings is still restricted.
Court order after good cause (Subpart E, including § 2.64). A subpoena is not enough. A court must enter an order that meets Part 2, after a good-cause showing, before SUD records are used in legal proceedings against the patient. Criminal investigation of a patient has even tighter order rules (§ 2.65).
Audit and evaluation (§ 2.53). Specified government agencies, payers, and quality-improvement entities may receive records to audit or evaluate the program, with conditions. Those records still cannot be turned around to prosecute the patient without consent or a qualifying order.
Qualified service organization agreement (QSOA) (§§ 2.11, 2.12(c)(4)). A qualified service organization (QSO) provides services to the program (data processing, billing, dosage preparation, laboratory analyses, legal, accounting, medical staffing, and similar work) under a written agreement that the QSO is fully bound by Part 2 and will resist improper judicial efforts to obtain patient identifying information. Communications needed for the QSO to serve the program do not require patient consent.
Other 2024-era permissions you should recognize: internal communications among staff who need the information to treat; communications to an entity with direct administrative control over the program; and disclosure of de-identified records to a public health authority without consent (§ 2.54).
Scenario: A client's adult child demands "the whole file" at the front desk. There is no written consent naming that child, no emergency, and no court order. Do not disclose. A lobby family member is not a QSO.
Trap: treating a lawyer's letterhead subpoena as a Part 2 court order. It is not. Another trap: refusing the initial child-abuse report because the chart is Part 2. The initial state-law report is permitted; handing over the entire SUD file for the later proceeding is not, unless a separate permission exists.
Which setting is a 42 CFR Part 2 program?
Under the current 42 CFR 2.31 consent rule, including the 2024 HHS/SAMHSA revisions, which statement is correct?
A prosecutor sends a subpoena for a client's entire SUD file. No Part 2 court order has been issued. What is the correct response?