3.3 Confidentiality, 42 CFR Part 2, and HIPAA
Key Takeaways
- 42 CFR Part 2 protects identifying SUD records maintained by federally assisted substance use disorder programs.
- The 2024 Final Rule allows a single patient consent for future treatment, payment, and health care operations (TPO) uses, with a February 16, 2026 compliance date.
- After a valid single TPO consent, recipients may redisclose Part 2 records for TPO purposes without a brand-new consent for each TPO transfer.
- An attorney subpoena alone is insufficient to release Part 2 records for proceedings against a patient; consent or a Part 2-compliant court order is required.
- When HIPAA and Part 2 both apply, counselors must follow the stricter privacy protection, especially for non-TPO and criminal-justice uses.
Confidentiality, 42 CFR Part 2, and HIPAA
Substance use disorder (SUD) treatment records receive federal protections beyond HIPAA. For NCAC I, you must know what 42 CFR Part 2 covers, what changed in the 2024 Final Rule, and what did not change—especially limits on law-enforcement and prosecution uses.
What 42 CFR Part 2 Covers
42 CFR Part 2 applies to federally assisted SUD programs (federal funds, federal licensing, tax-exempt status, Medicare/Medicaid participation, or DEA registration for opioid treatment). Part 2 protects records that identify a person as having or having had an SUD and that relate to diagnosis, treatment, or referral in a Part 2 program.
Core rule: No use or disclosure without patient consent or a specific legal exception in the regulation.
Written Consent: Elements Still Required
Even with the 2024 updates, a valid written consent must still include:
| Element | What the patient must know |
|---|---|
| Who | Individual or program permitted to disclose |
| What | Description of the information to be disclosed |
| To whom | Person or entity receiving the information |
| Purpose | How the recipient will use the information |
| Expiration | Date or event that ends the consent |
| Right to revoke | That the patient may revoke in writing (with limited exceptions for actions already taken) |
| Signature & date | Patient (or personal representative) and date signed |
Vague consents ("release all records to anyone") are exam and practice traps.
2024 Final Rule: Key Changes for Counselors
On February 8, 2024, HHS (SAMHSA and OCR) published a Final Rule modernizing Part 2. Compliance date: February 16, 2026.
- Single consent for TPO — One written consent may authorize all future uses and disclosures for treatment, payment, and health care operations (TPO) within the scope described.
- TPO redisclosure — A recipient who receives records under a valid TPO consent may redisclose them for TPO purposes to other Part 2 programs, HIPAA covered entities, and business associates consistent with that consent—without a brand-new consent for each downstream TPO share.
- HIPAA alignment — Definitions, notice practices, and breach-notification concepts moved closer to HIPAA, while Part 2's heightened protections for SUD records remain.
- Investigations and prosecution — SUD records generally cannot be used to investigate or prosecute the patient without patient consent or a Part 2–compliant court order.
What Has NOT Changed (High-Yield)
- An attorney subpoena alone is insufficient. Release for civil or criminal proceedings against the patient requires patient consent or a Part 2–compliant court order (Subpart E)—not merely a subpoena from counsel.
- Non-TPO disclosures (employment, licensing boards, child custody, general litigation against the patient) still require specific consent or another lawful exception—not the broad TPO single-consent pathway.
- Recipients still receive notice that records are Part 2–protected.
Exam trap: Do not assume every redisclosure always requires a new consent. After a valid single TPO consent, TPO redisclosures may proceed without a separate consent for each transfer if the original consent covers that TPO use. Non-TPO redisclosure still needs its own authority.
Qualified Service Organization Agreements (QSOAs)
When an outside vendor (billing, lab, EHR host, auditor) needs access to identifying SUD records, a Qualified Service Organization Agreement (QSOA) binds the vendor to Part 2 confidentiality, prohibits unauthorized redisclosure, requires safeguards, and addresses return/destruction of records when services end. When HIPAA also applies, meet both BAA and QSOA requirements.
Limited Exceptions (High Level)
- Medical emergency: Disclosure to medical personnel treating a bona fide medical emergency when the patient cannot consent, with documentation and redisclosure limits.
- Child abuse and neglect: Mandatory reporting laws still apply. Part 2 does not eliminate reporter duties; report only what state law and program policy require.
- Other exceptions (research, audit, crime on premises) are narrower and less frequently tested than consent, TPO, emergencies, and court orders.
HIPAA vs Part 2
When both apply to the same record, follow the stricter protection.
| Topic | HIPAA | 42 CFR Part 2 |
|---|---|---|
| Scope | PHI at covered entities/business associates | Identifying SUD records from federally assisted SUD programs |
| TPO | Many TPO uses without individual authorization | Requires consent; 2024 rule allows a single future-use TPO consent |
| Law enforcement / prosecution | Certain disclosures with procedural requirements | Much stricter for investigating/prosecuting the patient |
| Redisclosure | Purpose and minimum-necessary limits | TPO pathway under 2024 rule; otherwise often needs new consent |
Bottom line: For SUD treatment records, Part 2 is generally more restrictive than HIPAA for non-TPO uses and criminal-justice contexts. Never release SUD records to family, employers, or police based on HIPAA alone when Part 2 applies.
A counselor receives a subpoena signed by a defense attorney demanding the immediate release of a client's complete addiction treatment record for an ongoing civil lawsuit. The client has explicitly refused to sign a consent form. What is the counselor's legal obligation under 42 CFR Part 2?
An addiction facility hires an external billing company to process insurance claims. To allow the vendor access to client billing data without requiring individual written consents from every client, what legal agreement must be executed?
Which of the following elements is strictly required for a written consent form to be considered legally valid under federal 42 CFR Part 2 regulations?
When HIPAA privacy rules and 42 CFR Part 2 regulations apply to the same addiction treatment record, how must the counselor handle the disclosure of information?