42 CFR Part 2: substance use disorder records and HIPAA

Part 2 is not part of HIPAA. It is a separate federal regulation, older than HIPAA, written so that people seeking addiction treatment don’t fear their records being used against them. Since 2024 the two rules work much more closely together, but Part 2 remains stricter in important ways. This page explains the basics; because the stakes for patients and programs are high, get legal advice on specific situations.

Who Part 2 applies to

A Part 2 program is a federally assisted person or unit that holds itself out as providing, and provides, substance use disorder diagnosis, treatment or referral for treatment (42 CFR 2.11). That can be a specialty treatment program, an identified SUD unit inside a general medical facility, or medical staff whose primary function is SUD care and who are identified as such. “Federally assisted” is broad — it includes, for example, participating in Medicare, being registered to dispense controlled substances for SUD treatment, and receiving federal funds (42 CFR 2.12(b)).

HHS’s own example of what is not covered: emergency room staff who refer a patient to intensive care for an apparent overdose, unless their primary function is SUD care (2.12(e)). Organizations that receive Part 2 records — health plans, other providers, business associates — take on obligations for those records too.

How Part 2 differs from HIPAA

	HIPAA	42 CFR Part 2
Covers	PHI held by covered entities and business associates	SUD records from Part 2 programs, wherever they go
Treatment, payment, operations	Generally no patient permission needed	Written patient consent needed — but one consent can cover all future TPO uses
After disclosure	Recipient follows its own HIPAA duties	Recipient covered entities may redisclose as HIPAA allows; others are restricted
Legal proceedings against the patient	Subpoena or court order pathways	Records can’t be used against the patient without consent or a specific court order
Special notes	Psychotherapy notes	SUD counseling notes, kept separate, get extra protection
Breaches	Breach Notification Rule	Same HIPAA breach notification requirements since 2024
Enforcement	OCR, civil money penalties	OCR, civil penalties aligned with HIPAA since 2024

What changed with the 2024 rule

The final rule published in February 2024 implemented Section 3221 of the CARES Act. It took effect on April 16, 2024, and compliance has been required since February 16, 2026. The main changes, per the HHS fact sheet:

• Single consent for all future uses and disclosures for treatment, payment and health care operations (42 CFR 2.33).
• Redisclosure: HIPAA covered entities and business associates that receive records under that consent may redisclose them as the HIPAA rules permit, with limits on use against the patient.
• Breach notification: HIPAA’s breach notification requirements now apply to Part 2 records.
• Penalties: Part 2’s old criminal-only penalties were replaced with the civil and criminal enforcement framework HIPAA uses. OCR announced its Part 2 civil enforcement program on February 13, 2026.
• SUD counseling notes: a new protected category, like psychotherapy notes — notes of SUD counseling sessions kept separate from the rest of the record.
• Notices: Part 2 programs’ patient notices and HIPAA Notices of Privacy Practices were updated to reflect the changes.

If you are a therapist or practice

Most therapists and medical practices are not Part 2 programs, but you may receive Part 2 records from one — for example, when coordinating care for a patient in a treatment program. Those records arrive with restrictions. If you do hold yourself out as providing SUD treatment and are federally assisted, Part 2 applies to you in addition to HIPAA. See therapists and psychologists for the HIPAA side.