10.1 42 CFR Part 2 Federal Confidentiality Regulations & Consent Requirements

10.1 42 CFR Part 2 Federal Confidentiality Regulations & Consent Requirements

Quick Summary: Title 42 of the Code of Federal Regulations Part 2 (42 CFR Part 2) establishes stringent federal confidentiality protections for records maintained by substance use disorder (SUD) diagnosis, treatment, and referral programs. Designed to prevent SUD patients from facing criminal prosecution, civil discrimination, or social stigma, Part 2 enforces strict consent requirements, mandatory redisclosure warnings, and specialized service agreements (QSOAs) that surpass standard healthcare privacy protections.

---

Historical Context & Core Legislative Purpose

Congress enacted federal confidentiality legislation governing alcohol and drug abuse treatment in the early 1970s, culminating in the formal promulgation of 42 CFR Part 2 by the Substance Abuse and Mental Health Services Administration (SAMHSA) and the U.S. Department of Health and Human Services (HHS). The foundational rationale behind Part 2 rests on a critical public health principle: individuals suffering from substance use disorders will not seek life-saving treatment if they fear that their admissions, medical records, or clinical notes could be weaponized against them in criminal prosecutions, child custody disputes, employment terminations, or insurance denials.

Unlike general medical privacy rules, 42 CFR Part 2 explicitly restricts the use of SUD patient records in criminal proceedings, civil lawsuits, administrative investigations, and law enforcement actions against the patient. The regulation establishes an uncompromising shield: patient identity, attendance, diagnosis, prognosis, and treatment records are strictly confidential and cannot be disclosed except under narrowly defined regulatory exceptions or explicit patient authorization.

---

Scope of Coverage & Applicability Criteria

To fall within the jurisdiction of 42 CFR Part 2, a facility, unit, or practitioner must satisfy a two-pronged statutory test: it must qualify as a covered program AND receive federal assistance.

1. Covered Program Definition

A "program" under 42 CFR Part 2 includes:

• An individual or entity (other than a general medical facility) that holds itself out as providing, and provides, SUD diagnosis, treatment, or referral for treatment.
• An identified unit within a general medical facility (such as a dedicated addiction ward or specialized outpatient SUD clinic) that holds itself out as providing SUD services.
• Medical personnel or telehealth staff in a general medical facility whose primary function is the provision of SUD diagnosis, treatment, or referral for treatment.

Note on "Holding Out": "Holding out" means advertising, marketing, publicly listing, or representing to the community that the facility or provider offers specialized SUD services. General medical practitioners who treat addiction incidentally during routine primary care are generally not covered programs unless their primary clinical function or specialized department is dedicated to SUD.

2. Federal Assistance Requirement

Federal assistance is interpreted extraordinarily broadly under Part 2. A program receives federal assistance if it:

• Is conducted, operated, or directly funded by any federal department or agency (e.g., SAMHSA, Veterans Health Administration).
• Receives federal revenue, including Medicare or Medicaid reimbursements.
• Has tax-exempt status granted by the Internal Revenue Service (IRS) or receives tax-deductible charitable contributions.
• Holds a registration with the Drug Enforcement Administration (DEA) to dispense controlled substances (such as methadone or buprenorphine) for SUD treatment.
• Is authorized, licensed, or registered by a federal agency to conduct business.

Because virtually all licensed addiction treatment facilities receive Medicaid, tax exemptions, or DEA registrations, nearly all specialized SUD treatment programs in the United States are governed by 42 CFR Part 2.

---

Mandatory Elements of Valid Written Patient Consent

Under 42 CFR Part 2, patient consent cannot be vague, implied, or blanketed. Consent may be paper or electronic, and 42 CFR § 2.31(a) sets out the required elements:

1. Patient Name: The name of the individual whose records are being disclosed.
2. Who May Disclose: The name or other specific identification of the person(s) — or class of persons — authorized to make the requested use or disclosure.
3. Description of the Information: A description of the information to be used or disclosed that identifies it in a specific and meaningful fashion (e.g., "urine drug screen results from January to June 2026," or "initial biopsychosocial assessment and discharge summary").
4. Recipient(s): The name(s) of the person(s), or class of persons, to whom disclosure is to be made. For a single consent covering all future treatment, payment, and health care operations (TPO) uses and disclosures, the recipient may be described generally — for example, "my treating providers, health plans, third-party payers, and people helping to operate this program." Special rules apply when the recipient is an intermediary, and when the recipient is a covered entity or business associate receiving records for TPO the consent must state that the record may be redisclosed under the HIPAA rules except for use in civil, criminal, administrative, or legislative proceedings against the patient.
5. Purpose: A description of each purpose of the requested use or disclosure. "At the request of the patient" suffices when the patient initiates the consent; "for treatment, payment, and health care operations" suffices for a single TPO consent.
6. Right to Revoke: The patient's right to revoke in writing and how to do so — except to the extent the program or other lawful holder has already acted in reliance on the consent.
7. Expiration Date or Event: An expiration date or expiration event tied to the patient or the purpose. "End of the treatment," "none," or similar language is sufficient for a TPO consent; "end of the research study" is sufficient for research.
8. Signature: The signature of the patient — or, for a minor or a patient adjudicated as lacking capacity or deceased, the signature of the person authorized under § 2.14 or § 2.15. Electronic signatures are permitted unless otherwise prohibited by law.
9. Date Signed: The date on which the consent is signed.
10. Two Extra Statements for TPO Consents: A consent for treatment, payment, or health care operations must also state (a) the potential for the records to be redisclosed by the recipient and no longer protected by Part 2, and (b) the consequences to the patient of refusing to sign.

Exam trap — signature and date are separate elements, and the redisclosure notice is not a consent element at all. The notice that accompanies a disclosure lives in § 2.32, covered below. Under § 2.31(c), a disclosure may not be made on a consent that has expired, that on its face substantially fails to conform to these requirements, that is known to be revoked, or that is known (or through reasonable diligence could be known) to be materially false.

One more rule worth memorizing: § 2.31(d) provides that consent to use or disclose records — or testimony describing them — in a civil, criminal, administrative, or legislative investigation or proceeding cannot be combined with a consent for any other purpose. Likewise, under § 2.31(b), consent is separately required for SUD counseling notes, a consent for counseling notes may only be combined with another counseling-notes consent, and a program may not condition treatment, payment, enrollment, or benefits on the patient signing one.

---

Mandatory Prohibition on Redisclosure Statement

Whenever a Part 2 program discloses records with the patient's written consent, the disclosure must be accompanied by a written notice warning the recipient about further use and disclosure. 42 CFR § 2.32 was rewritten by the 2024 Final Rule, and it now gives programs a choice between two statements — many older training materials still quote the pre-2024 wording, so check which version your study source is using.

Statement 1 (the long form)

"This record which has been disclosed to you is protected by Federal confidentiality rules (42 CFR part 2). These rules prohibit you from using or disclosing this record, or testimony that describes the information contained in this record, in any civil, criminal, administrative, or legislative proceedings by any Federal, State, or local authority, against the patient, unless authorized by the consent of the patient, except as provided at 42 CFR 2.12(c)(5) or as authorized by a court in accordance with 42 CFR 2.64 or 2.65. In addition, the Federal rules prohibit you from making any other use or disclosure of this record unless at least one of the following applies: (i) Further use or disclosure is expressly permitted by the written consent of the individual whose information is being disclosed in this record or as otherwise permitted by 42 CFR part 2. (ii) You are a covered entity or business associate and have received the record for treatment, payment, or health care operations, or (iii) You have received the record from a covered entity or business associate as permitted by 45 CFR part 164, subparts A and E. A general authorization for the release of medical or other information is NOT sufficient to meet the required elements of written consent to further use or redisclose the record (see 42 CFR 2.31)."

Statement 2 (the short form)

"42 CFR part 2 prohibits unauthorized use or disclosure of these records."

The Second, Frequently Missed Requirement

§ 2.32(b) requires that each consent-based disclosure also be accompanied by a copy of the consent, or a clear explanation of the scope of the consent. Programs that paste the notice onto a fax cover sheet and stop there are only half compliant.

Together these provisions stop third parties — employers, insurers, primary care offices — from forwarding SUD records onward outside the permitted lanes, while preserving the absolute bar on using the record against the patient in a proceeding.

---

Qualified Service Organization Agreements (QSOAs)

In modern clinical practice, addiction programs rely on external vendors for necessary operational, administrative, and clinical support services—such as billing services, laboratory testing, legal counsel, electronic health record (EHR) hosting, and accounting. Obtaining individual patient consent for every routine administrative vendor transaction would paralyze program operations.

To resolve this, 42 CFR Part 2 establishes Qualified Service Organization Agreements (QSOAs).

Key Principles of a QSOA

• Definition: A QSOA is a formal written agreement between a Part 2 program and an external service provider (the Qualified Service Organization) that provides specialized services to the program.
• Permitted Information Flow: Under a QSOA, the Part 2 program may disclose patient records to the vendor without obtaining written patient consent.
• Contractual Obligations: In the QSOA, the service organization explicitly:
  1. Acknowledges that it is fully bound by 42 CFR Part 2 regulations upon receiving patient records.
  2. Agrees to resist in judicial proceedings any efforts to compel disclosure of patient records except as permitted by Part 2.
  3. Agrees to maintain appropriate administrative, physical, and technical safeguards to secure patient data.

Clinical Distinction: A QSOA is strictly designed for vendors providing services to the treatment program. A QSOA cannot be used to share patient information with third-party treatment providers, referral agencies, employers, or family members; disclosures to those entities always require explicit written patient consent.