42 CFR Part 2 is the federal regulation that restricts how substance use disorder (SUD) patient records from a federally assisted program may be used and disclosed. It applies to Part 2 programs and to the covered entities and business associates that receive their records. Integral Healthcare Solutions (IHS) maps your Part 2 obligations to your documents and drafts the notices, consents and procedures; your counsel confirms applicability and your team runs them.
Last reviewed: October 2026.
What is 42 CFR Part 2?
42 CFR Part 2, Confidentiality of Substance Use Disorder Patient Records, is a federal regulation issued by the Department of Health and Human Services (HHS). Its stated purpose is direct: "the regulations in this part impose restrictions upon the use and disclosure of substance use disorder patient records (“records,” as defined in this part) which are maintained in connection with the performance of any part 2 program" (42 CFR 2.2(a)).
The current text is the regulation as amended by the HHS final rule published February 16, 2024 (89 FR 12472, Federal Register document 2024-02544). The rule states: "Effective date: This final rule is effective on April 16, 2024. Compliance date: Persons subject to this regulation must comply with the applicable requirements of this final rule by February 16, 2026" (Federal Register). The same rule "makes certain other modifications to increase alignment with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to improve workability and decrease burden on programs, covered entities, and business associates" (Federal Register abstract).
Part 2 is read together with the HIPAA Privacy, Breach Notification and Enforcement rules at 45 CFR parts 160 and 164 wherever Part 2 adopts them. One example is breach notification: "The provisions of 45 CFR part 160 and subpart D of 45 CFR part 164 shall apply to part 2 programs with respect to breaches of unsecured records in the same manner as those provisions apply to a covered entity with respect to breaches of unsecured protected health information" (42 CFR 2.16(b)).
Who needs it and what triggers it
Part 2 applies to Part 2 programs and to lawful holders of their records. The regulation defines the first group this way: "Part 2 program means a federally assisted program (federally assisted as defined in § 2.12(b) and program as defined in this section)" (42 CFR 2.11). Whether your organization meets that definition is a legal question for your counsel.
The work usually starts with one of these events:
- The 2024 amendments. Notices, consent forms and procedures written before the 2024 rule needed review against the amended text by the February 16, 2026 compliance date (Federal Register). A program whose notice, consents and procedures do not yet match the amended text is past the compliance date. Whether yours does is for your counsel.
- A new program or a material change. Opening an SUD service, adding a funding source, or changing who receives records changes which provisions apply.
- Receiving Part 2 records. Covered entities and business associates that receive records under a single consent for treatment, payment and health care operations have their own use and disclosure terms under 42 CFR 2.33(a)(2).
- Continuing alignment. Consent forms, disclosure statements and breach workflows drift as staff, systems and recipients change.
How IHS helps
IHS works through a fixed process against the text of 42 CFR Part 2 as amended in 2024:
- Gap assessment. IHS reviews your current notice of privacy practices, consent forms, disclosure log, complaint process and breach workflow against the regulation.
- Document and evidence mapping. IHS builds a crosswalk from each Part 2 provision to the document that carries it, so every requirement has a named home.
- Drafting. IHS drafts the revised notice of privacy practices, consent forms, the required disclosure statements and the written procedures, for your privacy officer and counsel to review and approve.
- Mock review. IHS tests sample disclosures against the drafted procedures and the regulation and lists what would not hold up.
- Readiness support. IHS prepares staff walkthrough material so the people who handle records know what changed.
What your organization supplies: current policies and forms, screenshots of the records system where consents and disclosures are captured, contracts with recipients of records, and your privacy counsel, who confirms whether and how Part 2 applies.
The limit: IHS does not configure records systems or segment data, and gives no legal opinion on whether Part 2 applies to you. Your team runs the procedures once they are adopted.
Related IHS pages: Compliance Services, Compliance Program Development and ASAM Criteria documentation alignment.
What to have ready
Gathering these items before the first working session shortens the gap assessment. Each ties to a provision of 42 CFR Part 2 as amended in 2024.
- Your current notice of privacy practices. Part 2 requires a program to "provide notice, written in plain language, of the program's legal duties and privacy practices" (42 CFR 2.22(b)).
- Every patient consent form in use, including any single consent for treatment, payment and health care operations (42 CFR 2.33(a)(2)).
- The written statement your staff attach to consented disclosures. "Each disclosure made with the patient's written consent must be accompanied by one of the following written statements" (42 CFR 2.32(a)).
- Your written security policies and procedures. The program "must have in place formal policies and procedures to reasonably protect against unauthorized uses and disclosures of patient identifying information" (42 CFR 2.16(a)).
- Your breach response workflow and breach notification procedure, read against the HIPAA breach provisions Part 2 adopts (42 CFR 2.16(b)).
- The facts your counsel relies on to decide whether you are a federally assisted program (42 CFR 2.11, referring to § 2.12(b)).
- An inventory of the records maintained in connection with the program (42 CFR 2.2(a)).
- A list of the organizations that receive your records and the contracts with them, including covered entities and business associates (42 CFR 2.33(a)(2)).
- A record of what was updated for the February 16, 2026 compliance date and what was not (Federal Register).
When the list is together, the introductory call is the place to start.
How it compares
Organizations handling SUD records usually weigh these routes. They are not exclusive, and many organizations use more than one.
| Route | What it covers | What it does not cover |
|---|---|---|
| HIPAA Privacy Rule program alone (45 CFR part 164) | Covered entity privacy duties. The 2024 Part 2 rule was written to increase alignment with it (Federal Register abstract). | The added restrictions Part 2 places on records from a federally assisted SUD program (42 CFR 2.2(a)). |
| Privacy counsel engagement | A legal opinion on whether and how Part 2 applies, and legal review of forms. | Legal review of the forms and the applicability opinion are counsel's work; IHS does not give that opinion. |
| In-house build by the privacy officer | Full control of the documents by the people who use them. | Depends on staff time to read the amended rule and rebuild each document. |
| IHS gap assessment and drafting | The crosswalk, drafted notice, consents, disclosure statements and procedures, mock review, and walkthrough material. | Legal opinions, records-system configuration and data segmentation. |
What it costs
42 CFR Part 2 is a federal regulation, not an accreditation program, so there is no application or certification fee to pay a government body. Your costs depend on scope, meaning the number of programs, forms, recipients and systems involved. IHS scopes each engagement after a free introductory call.
What this is not
- This page is not legal advice, and IHS does not give a legal opinion on whether Part 2 applies to your organization. Your privacy counsel does.
- IHS does not configure electronic records systems or segment data.
- IHS does not file anything with, or speak for your organization to, HHS or any other agency. IHS drafts; your organization adopts and acts.
Frequently asked questions
What is 42 CFR Part 2 and how is it different from HIPAA?
42 CFR Part 2 restricts the use and disclosure of substance use disorder patient records maintained in connection with a federally assisted Part 2 program (42 CFR 2.2(a)). HIPAA governs protected health information held by covered entities more broadly. The 2024 Part 2 final rule was written to increase alignment with the HIPAA Privacy Rule, and Part 2 adopts some HIPAA provisions directly, such as breach notification.
Does Part 2 apply to my program, and what makes a program federally assisted?
The regulation defines a Part 2 program as a federally assisted program, with federally assisted defined in 42 CFR 2.12(b) (42 CFR 2.11). Whether your program meets that definition is a legal determination for your privacy counsel. IHS can organize the facts counsel needs, but does not give the opinion.
What had to be in place by February 16, 2026?
The 2024 final rule took effect April 16, 2024, and states that persons subject to the regulation must comply with its applicable requirements by February 16, 2026. In practice that meant reviewing notices, consent forms, disclosure statements and procedures against the amended text. A program whose notice, consents and procedures do not yet match the amended text is past the compliance date. Whether yours does is for your counsel.
Can we use a single patient consent for treatment, payment and health care operations?
Yes, the amended rule provides for it. Under 42 CFR 2.33(a)(2), when a patient gives a single consent for all future uses and disclosures for treatment, payment and health care operations, a Part 2 program, covered entity or business associate may use and disclose those records as permitted by the HIPAA regulations until the patient revokes the consent in writing.
What must a Part 2 notice of privacy practices contain?
42 CFR 2.22(b) requires a Part 2 program to provide notice, written in plain language, of the program's legal duties and privacy practices. IHS drafts the notice against the full text of that section for your counsel to review.
What statement has to accompany a disclosure made with patient consent?
42 CFR 2.32(a) states that each disclosure made with the patient's written consent must be accompanied by one of the written statements set out in that section. IHS builds the template from the regulation's own wording, and the procedure for attaching it.
Do HIPAA breach notification rules now apply to Part 2 records?
Yes. 42 CFR 2.16(b) states that 45 CFR part 160 and subpart D of 45 CFR part 164 apply to Part 2 programs with respect to breaches of unsecured records in the same manner as they apply to a covered entity. Your breach workflow should be checked against both texts.
We receive records from a Part 2 program. What are our obligations as a covered entity or business associate?
Under 42 CFR 2.33(a)(2), records received under a single consent for treatment, payment and health care operations may be used and disclosed for those purposes as permitted by the HIPAA regulations until the patient revokes the consent in writing. Other redisclosure questions depend on the facts and belong with your counsel. IHS maps the provisions to your procedures and contracts.
What written policies and procedures does Part 2 require for record security?
42 CFR 2.16(a) requires the Part 2 program or other lawful holder to have formal policies and procedures to reasonably protect against unauthorized uses and disclosures of patient identifying information. IHS drafts those policies against the full text of the section for your privacy officer and counsel to approve.
Do we need a consultant, privacy counsel or both for Part 2?
Counsel decides whether and how Part 2 applies and reviews the legal sufficiency of your documents. A consultant such as IHS does the operating work: the gap assessment, the crosswalk, the drafted forms and procedures, and the mock review. Many organizations use both, with counsel approving what IHS drafts.