42 CFR Part 2 is the strictest privacy rule in American healthcare, and for substance use disorder programs it is not optional. As of February 16, 2026, the 2024 final rule that overhauled Part 2 is being enforced, which makes this a good moment to confirm that your consent forms and documentation are actually current.
The good news is that the changes mostly help: a single consent can now cover far more than it used to, and the paperwork burden that made Part 2 notorious has eased. The catch is that the consent form and the documentation around it have to be right, or a routine disclosure becomes a violation. This is a general compliance guide, not legal advice, and state law can be stricter, so confirm specifics with counsel.
The short version
- As of February 16, 2026, the 2024 Part 2 final rule is being enforced. Old-format consents may no longer be compliant.
- A single patient consent can now cover all future treatment, payment, and health care operations (TPO) until revoked in writing.
- The Part 2 consent form's required elements now track a valid HIPAA authorization.
- Recipients no longer have to segregate Part 2 records after a single consent.
- The form is necessary but not sufficient. Capturing consent before disclosure, and being able to produce it, is what protects you.
What Part 2 protects, in one paragraph
Part 2 protects the records of patients treated for a substance use disorder by a federally assisted Part 2 program. It has historically been stricter than HIPAA, with tight limits on when SUD treatment information can be shared and strong protections against its use against the patient, including in legal proceedings. A wrongful disclosure is not a paperwork technicality; it carries real consequences, which is why the consent mechanics are worth getting exactly right.
What changed in the 2024 final rule (now enforced)
On February 16, 2024, SAMHSA released a final rule aligning Part 2 more closely with HIPAA, as directed by the CARES Act. The rule took effect on April 16, 2024, and after a two-year runway, enforcement of the updated requirements began on February 16, 2026. The headline changes:
- Single consent for TPO. A Part 2 program can now obtain a single patient consent for all future uses and disclosures for treatment, payment, and health care operations, effective until the patient revokes it in writing. That replaces the old pattern of a separate consent for nearly every disclosure.
- Consent aligned with HIPAA authorization. The required elements of the Part 2 consent form now track those of a valid HIPAA authorization, which simplifies form design and staff training.
- No more segregation after single consent. A recipient that receives Part 2 records based on a single consent is no longer required to segregate or segment those records from the rest of the chart.
For the legal detail, see summaries from the American Psychiatric Association and Shipman & Goodwin.
Single consent or specific consent: which to use
The single TPO consent is a major convenience, but it is not always the right tool. A single consent is well suited to ongoing treatment relationships, care coordination, and routine billing. A narrower, specific consent still makes sense for one-off disclosures to a defined recipient for a defined purpose, especially outside TPO, or where a patient wants to limit what is shared. Many programs will use both: a single TPO consent at intake for the routine flow of care and payment, and specific consents layered on for anything outside that. The important thing is that whichever you use carries the required elements and that the patient understood what they signed.
What a compliant Part 2 consent must include
Whether you use a single TPO consent or a narrower one, the form has to carry the required elements. Use this as an illustrative checklist, not a substitute for your own reviewed template:
- The patient's name.
- The name of the Part 2 program permitted to make the disclosure.
- The recipient(s) authorized to receive the information. For TPO, this may be a broad designation such as treating providers, the health plan, and their business associates, as permitted.
- The purpose of the disclosure (for example, treatment, payment, and health care operations).
- How much and what kind of information may be disclosed.
- The patient's right to revoke in writing, and how to do it.
- An expiration date, event, or a statement that the consent lasts until revoked.
- A statement about redisclosure and the limits Part 2 places on using the information against the patient.
- The patient's signature and the date.
Documentation that keeps you covered
The form is necessary but not sufficient. What actually protects you is the documentation around it:
- Capture consent before the disclosure, not after. A disclosure made before a valid consent is on file is the classic Part 2 miss.
- Store it and be able to produce it. If you cannot show the consent that authorized a disclosure, you effectively did not have one.
- Track revocations. A revocation in writing has to actually stop future disclosures, and you should be able to show when it took effect.
- Include the required notice to recipients about the prohibition on redisclosure and on using the information against the patient.
- Keep it current. Old-format consents that predate the 2024 rule may not carry the elements now expected, and enforcement is live.
- Log the disclosure. Being able to tie each disclosure to the consent that authorized it is the difference between a defensible record and a hopeful one.
How Part 2 interacts with HIPAA and state law
The 2024 rule aligns Part 2 more closely with HIPAA, but it does not merge them. Part 2 still adds protections on top of HIPAA, particularly around the use of SUD records in legal proceedings and the redisclosure notice that has to travel with the information. And Part 2 is a federal floor, not a ceiling: many states impose stricter confidentiality requirements for SUD and mental health records, and where state law is more protective, it generally controls. The practical takeaway is to treat Part 2 as one layer in a stack, HIPAA underneath it and state law potentially on top, rather than as a single rule that replaced the others.
Penalties, and why this matters now
For years, Part 2 enforcement was light enough that some programs treated the rule as a formality. That era is over. With the 2024 rule now enforced, wrongful disclosures of SUD records carry real exposure, and the update also brought Part 2's enforcement mechanisms into closer alignment with HIPAA. Beyond the legal risk, a Part 2 breach is a trust breach. The entire premise of the rule is that patients will not seek treatment for a substance use disorder if they fear the records will be used against them. A program that mishandles Part 2 information risks both a penalty and the confidence of the population it exists to serve.
Common Part 2 scenarios
Most Part 2 questions come down to a handful of everyday situations. A few, at a high level:
- Sharing with a primary care provider. Under a single TPO consent, coordinating care with the patient's other treating providers is generally covered where the consent names them or uses an appropriate designation.
- Disclosing to a health plan for payment. Billing and payment activities fall within TPO and can be covered by a single consent.
- A medical emergency. Part 2 has long allowed disclosures to medical personnel in a bona fide emergency, documented after the fact.
- Family and friends. Disclosures to family generally still require the patient's consent, named appropriately, and are an area where a specific consent often makes sense.
- Court orders and subpoenas. A subpoena alone is not enough. Part 2 requires a court order meeting specific criteria before records can be disclosed for legal proceedings.
These are simplified for illustration. The point is that consent design should anticipate the disclosures your program actually makes, and staff should know which scenario calls for which consent.
What to do before an audit
A short readiness list:
- Update your consent forms to the 2024, HIPAA-aligned format.
- Decide where you will use single TPO consent and where you will use specific consents, and make the language explicit.
- Confirm that consent is captured at intake and can be produced on demand, tied to the disclosures it authorized.
- Train intake and records staff on the redisclosure notice and on how revocations are handled.
- Check any state-specific requirements that go beyond Part 2.
- Keep everything contemporaneous. Part 2 rewards programs that can show their work and penalizes the ones that cannot.
How Adentris helps
Adentris builds 42 CFR Part 2 controls into its documentation review. It flags when a required consent is missing before a claim or disclosure goes out, checks that the note reflects a captured, current consent, and keeps the audit trail that shows you had it, so a Part 2 obligation does not quietly become a Part 2 violation. It is HIPAA compliant and SOC 2 certified, with 42 CFR Part 2 controls and BAAs in place. To see it on your own charts, book a 30-minute call with our team.
Related reading
- Behavioral health payer audit readiness solutions
- Best behavioral health documentation compliance software
- Documentation software for clinicians
Frequently asked questions
What changed in the 42 CFR Part 2 final rule?
The 2024 final rule lets a Part 2 program obtain a single patient consent for all future treatment, payment, and health care operations disclosures until the patient revokes it in writing, aligns the consent form's required elements with a HIPAA authorization, and removes the requirement to segregate Part 2 records after a single consent. It took effect April 16, 2024, and enforcement began February 16, 2026.
What must a 42 CFR Part 2 consent include?
At minimum: the patient's name; the disclosing Part 2 program; the authorized recipient(s); the purpose; how much and what kind of information; the right to revoke in writing; an expiration date, event, or 'until revoked' statement; a redisclosure and prohibition-on-use notice; and the patient's signature and date.
Is 42 CFR Part 2 the same as HIPAA now?
No. The 2024 rule aligns Part 2 more closely with HIPAA, but Part 2 still adds protections, including limits on using SUD records against the patient and the redisclosure notice. State law can also be stricter, so treat Part 2 as an additional layer, not a replacement for HIPAA.
When did enforcement of the new Part 2 rule begin?
Enforcement of the updated Part 2 requirements began on February 16, 2026, two years after the rule took effect on April 16, 2024.
Do we still need a separate consent for every disclosure?
Not for treatment, payment, and health care operations. A single consent can now cover all future TPO uses and disclosures until the patient revokes it in writing. Narrower, specific consents still make sense for one-off disclosures outside TPO or where a patient wants to limit what is shared.
About the author: Sergey Yudovskiy is the Chief Product Officer of Adentris, which builds AI for revenue integrity and documentation compliance in behavioral health and substance use disorder care.
