Does 42 CFR Part 2 Apply to You? What Changed and How to Tell

Quick question for every provider reading this: does 42 CFR Part 2 apply to you?

If your instinct is "that's for addiction treatment centers," keep reading. Part 2, the federal rule protecting substance use disorder (SUD) records, reaches further than most providers assume, and some organizations are covered without ever having decided to be.

Here is how to find out in about five minutes, and what changed.

Why this matters now

The compliance date for the 2024 Part 2 final rule was February 16, 2026, and it has passed. On that date, the HHS Office for Civil Rights (OCR) began accepting Part 2 complaints, which anyone can file, along with breach notifications for SUD records.

HHS said the new enforcement program "marks the first time civil enforcement mechanisms will be available to protect the confidentiality" of these records. Penalties now match HIPAA's, and OCR can resolve cases through resolution agreements, monetary settlements, corrective action plans, or civil money penalties.

So "we assumed it didn't apply to us" is no longer a safe place to stand.

Four questions: is Part 2 your rule?

Part 2 applies to a "Part 2 program": a federally assisted program that holds itself out as providing, and does provide, SUD diagnosis, treatment, or referral for treatment. Answer these four questions honestly.

1. Do you diagnose, treat, or refer for treatment of SUD? Inside a hospital or other general medical facility, the rule reaches only an identified unit that does this, or staff whose primary function is SUD care and who are identified as such providers.

2. Do you hold yourself out as doing it? The regulation doesn't define the phrase, so ordinary things can count: a state license to provide SUD treatment, a web page describing your SUD services, or a listing in a treatment directory.

3. Are you federally assisted? Any one of these is enough: Medicare participation, authorization to conduct maintenance treatment or withdrawal management (an opioid treatment program, for example), a DEA registration to dispense controlled substances used in SUD treatment, federal financial assistance in any form, or tax-exempt status. The money doesn't have to pay for SUD services.

4. Do you receive SUD records from other programs? Part 2 can follow the records. If you received them with a patient's consent or under an exception, you are a "lawful holder," and some limits travel with them. HHS also notes that requirements reach qualified service organizations, HIPAA covered entities and business associates, and intermediaries.

How to score yourself. Yes to questions 1 through 3: you are a Part 2 program for those services. Yes to question 4 only: Part 2 still touches you, more narrowly. No to all four: write down why, and date it. A short applicability note is a cheap habit.

One boundary worth knowing: Part 2 protects records that identify a patient as having an SUD and come from a Part 2 program. It does not turn your whole chart into Part 2 records.

What changed: six things to act on

The 2024 final rule aligned Part 2 with HIPAA, and it changed a lot. These six matter most.

1. One consent can cover treatment, payment, and operations. A patient can sign a single consent for all future uses and disclosures for treatment, payment, and health care operations (TPO), and revoke it in writing. SUD counseling notes are the exception: they need their own, separate consent.

2. Records can travel farther. HIPAA covered entities and business associates that receive records under a TPO consent may redisclose them as HIPAA permits. The big exception is legal proceedings against the patient.

3. Legal proceedings stay walled off. Records and testimony generally can't be used against a patient in civil, criminal, administrative, or legislative proceedings without the patient's consent or a court order and subpoena (or similar legal mandate). A limited safe harbor now protects investigative agencies that used reasonable diligence before seeking records. Train whoever opens your legal mail.

4. Breach notification and HIPAA penalties now apply. HIPAA's breach notification rules cover breaches of Part 2 records, and HIPAA's civil and criminal penalty framework replaced Part 2's old criminal penalties.

5. Notices were rewritten. Part 2 programs need an updated patient notice, and HIPAA covered entities must address SUD records in their notices of privacy practices. OCR posted revised model notices in February 2026.

6. Patients gained new rights. They can request restrictions on certain disclosures, opt out of fundraising communications, and complain directly to HHS. Your program needs a complaint process and may not retaliate. A new right to an accounting of disclosures is on hold until HHS updates HIPAA's accounting rule.

One more, fresh off the press. In September 2026, OCR issued FAQs on when state Medicaid agencies may use Part 2 records to verify exclusions from Medicaid's community engagement (work) requirements, which states must implement by January 1, 2027. A TPO consent the patient already signed can cover it, or the agency can obtain its own written consent. If you serve Medicaid members in SUD treatment, learn the answer before the first request arrives.

What to do this month

None of this is exotic. It is simply easier to do before a complaint than after one.

• Write down your Part 2 determination and the reasons for it. Date it.

• Update your Part 2 patient notice and your HIPAA notice of privacy practices, starting from OCR's model notices.

• Rebuild consent forms around the single TPO consent, with separate consents for counseling notes and for legal proceedings.

• Add Part 2 records to your breach response plan, including who reports to OCR.

• Review business associate and qualified service organization agreements, and how your EHR and health information exchange handle SUD records.

• Train registration, health information management, and whoever opens legal mail.

• Set up a complaint process with a clear no-retaliation rule.

Take it further

If this post made you stop and ask, "wait, is this us?", that is the question our new book is built to answer.

Behavioral Health Quality & Compliance: A How-To Guide to Building an Effective Program, by Michael Gomila, JD, PhD, MBA, LPC, and Arvin Singh, EdD, MBA, MPH, MS, FACHE, FACHDM, shows compliance officers, quality directors, and the attorneys who support them how to build a behavioral health compliance and quality program from the ground up. Chapter 6 takes on Part 2 directly: whether your organization is a Part 2 program, what the 2024 changes mean, how redisclosure works, and what to do when a subpoena or court order arrives. Appendix I includes a sample Part 2 patient consent form.

Coming October 30, 2026. Learn more at porthudsonpress.com.

Sources

• HHS OCR: Understanding Confidentiality of Substance Use Disorder (SUD) Patient Records ("Part 2")

• HHS press release: OCR announces civil enforcement program for SUD patient records, Feb. 13, 2026

• HHS fact sheet: 42 CFR Part 2 final rule

• Final rule, 89 Fed. Reg. 12472 (Feb. 16, 2024)

• 42 CFR § 2.11, definitions and § 2.12, applicability

• OCR model notices of privacy practices

• OCR FAQ: Part 2 and state Medicaid agencies (community engagement exclusions)

This post is general information, not legal advice, and it does not create an attorney-client relationship. Rules and guidance change, so check current sources and talk with qualified counsel about your situation.