42 CFR Part 2 in 2026: Final Rule Changes and Checklist

42 CFR Part 2 is the federal regulation that protects the confidentiality of substance use disorder (SUD) patient records kept by federally assisted SUD programs. Unless the rule specifically allows it, a Part 2 program may not use or disclose information that identifies a patient as having, or having had, an SUD, and the records cannot be used against the patient in civil, criminal, administrative, or legislative proceedings without the patient's specific consent or a court order. The 2024 final rule (89 FR 12472) moved Part 2 closer to HIPAA: one consent can cover all future treatment, payment, and health care operations, and breaches and penalties follow HIPAA's rules. Compliance has been required since February 16, 2026, and the HHS Office for Civil Rights (OCR) enforces the rule.

For SUD providers, 2026 is the first year Part 2 has had a civil enforcement program behind it. The work is concrete: a new patient notice, updated consent forms, a breach process that covers SUD records, agreements with every vendor that touches them, and proof of what authorized each disclosure.

This guide covers what Part 2 is, who it applies to, how it differs from HIPAA, what the final rule changed, how enforcement works now, and a checklist for the rest of 2026. It is general information, not legal advice. State law can be stricter, so confirm specifics with counsel.

The short version

Part 2 protects records that identify someone as a patient of a federally assisted SUD program, and its limits follow those records to most recipients.
Compliance with the 2024 final rule has been required since February 16, 2026. Violations carry HIPAA's civil and criminal penalties, and OCR enforces the rule.
A single consent can cover all future treatment, payment, and health care operations (TPO). HIPAA entities that receive records under it may redisclose as HIPAA allows, except in proceedings against the patient.
New obligations include a HIPAA-style patient notice, breach notification, a complaint process, separate consent for SUD counseling notes, and a copy of the consent with each consented disclosure.
Recipients need not segregate records received under a TPO consent, but the records never lose their protection against use in proceedings against the patient.

What 42 CFR Part 2 is

Part 2 implements 42 U.S.C. 290dd-2. OCR states the reason plainly: fear of discrimination or legal trouble can deter people from seeking SUD treatment. The regulation's stated aim is that a patient treated in a Part 2 program is not made more vulnerable by the record than a person with an SUD who never sought treatment (42 CFR 2.2).

Records are defined broadly: any information a Part 2 program creates, receives, or acquires about a patient, including billing information, emails, voicemails, and texts (2.11).
The default is no. A record may be used or disclosed only as Part 2 permits, limited to what the purpose requires (2.13(a)), even if the requester is a government official or holds a subpoena (2.13(b)).
Permission is not compulsion. A permitted disclosure is never required, except to HHS when it investigates your compliance (2.2(b)).
Records cannot be turned against the patient. Without consent or a subpart E court order, no one who obtains a record may use it for criminal charges or in proceedings against the patient (2.12(d)(1)).

Even acknowledging a patient is covered: answers to impermissible requests must not reveal that someone is a patient (2.13(c)).

Who Part 2 applies to

A "Part 2 program" is a program that is federally assisted (2.11, 2.12). A program is a person or organization, other than a general medical facility, that holds itself out as providing, and provides, SUD diagnosis, treatment, or referral for treatment; an identified SUD unit within a general medical facility; or general medical facility staff whose primary, identified function is SUD care. Examples include treatment programs, employee assistance programs, hospital-based and school-based programs, and private practitioners who hold themselves out as SUD providers. Emergency room staff who refer an overdose to intensive care are not covered unless SUD care is their identified primary function (2.12(e)(1)).

Almost any federal tie counts as assistance: Medicare participation, federal authorization for maintenance treatment or withdrawal management, a Controlled Substances Act registration used to treat SUD, federal financial assistance in any form, operation by a state or local unit that receives federal funds, or tax-exempt status (2.12(b)). SUD records the Department of Veterans Affairs keeps under Title 38 follow a separate statute (2.12(c)(1)).

Part 2 also follows the records. Covered entities and business associates that receive them under a TPO consent may redisclose under HIPAA, except for proceedings against the patient (2.33(b)). Other lawful holders, third-party payers, and qualified service organizations (QSOs) are bound by its limits, and investigative agencies have their own duties (2.3(b), 2.66). For hospitals and primary care, a provider that is not a Part 2 program may record SUD information in its own chart without turning that chart into a Part 2 record (2.12(d)(2)(ii)), but records it receives from a Part 2 program keep their status (2.11).

How Part 2 differs from HIPAA

Many Part 2 programs are also HIPAA covered entities, so both rules apply at once, and in practice you follow the stricter one. The differences that matter most:

Topic	HIPAA	42 CFR Part 2
Treatment, payment, operations	Permitted without authorization (45 CFR 164.506)	Written consent required; one consent may cover all future TPO (2.31, 2.33)
Passing records on	No accompanying notice required	Prohibition notice plus a copy or explanation of the consent (2.32)
Legal proceedings	Court order, or subpoena with required assurances (164.512(e))	Specific consent, or a subpart E court order plus a subpoena (2.61 to 2.65)
Most sensitive notes	Psychotherapy notes need an authorization (164.508(a)(2))	SUD counseling notes need a separate consent (2.31(b))
Breach and penalties	Breach Notification Rule; Social Security Act sections 1176 and 1177	The same, since the 2024 rule (2.3, 2.16(b))
State law	Preempts contrary state law, except more stringent privacy laws and other listed exceptions (160.203)	No preemption; stricter state law applies, but no state law can authorize a disclosure Part 2 prohibits (2.20)

OCR allows a Part 2 program that is also a covered entity to use one combined HIPAA and Part 2 notice.

What the 2024 final rule changed

HHS published the final rule on February 16, 2024 to implement section 3221 of the CARES Act. It took effect April 16, 2024, with compliance required by February 16, 2026. HHS said in the preamble that the changes also apply to records created before the rule.

Area	Before	Now	Where
TPO consent	Consent named its recipients	One consent covers all future TPO until revoked in writing	2.31, 2.33
Redisclosure	Only as the consent or Part 2 allowed	HIPAA entities may redisclose TPO records as HIPAA permits, except in proceedings against the patient	2.33(b)
Segregation	No express statement	Not required for records received under a TPO consent	2.12(d)(2)(i)(C)
SUD counseling notes	No such category	Separate consent required	2.11, 2.31(b)
Legal proceedings	Court order rules for civil and criminal matters	Also administrative and legislative proceedings and testimony; a stand-alone consent	2.31(d), 2.64, 2.65
Copy of consent	Notice only	Copy or clear explanation of the consent with each consented disclosure	2.32(b)
Patient notice	Written summary of the federal law	Full notice of privacy practices, also on the website if you have one	2.22
Breach notification	None	HIPAA breach rules apply	2.16(b)
Penalties	Criminal fines under Title 18	HIPAA civil money penalties and criminal penalties	2.3
Complaints	Reports could go to the U.S. Attorney	Program complaint process; complaints to HHS; no retaliation or waivers	2.4
Patient rights	Only a list of disclosures made under a general designation	Restriction requests, including paid-in-full; accounting of disclosures	2.25, 2.26
Investigative agencies	No equivalent	Liability safe harbor with reasonable diligence; annual report	2.3(b), 2.66, 2.68
Public health	No equivalent	De-identified records to public health authorities without consent	2.54

SUD counseling notes

Modeled on HIPAA psychotherapy notes, these are a clinician's notes analyzing an SUD counseling session, kept separate from the rest of the record. They exclude medication management, session times, modalities, test results, and summaries such as diagnosis, treatment plan, and progress. Using or disclosing them needs a separate consent, with narrow exceptions, and treatment cannot be conditioned on it. Process notes written into the main record are not SUD counseling notes and do not get this extra protection.

Breach notification

An impermissible use or disclosure is presumed to be a breach unless a documented four-factor risk assessment shows a low probability of compromise (45 CFR 164.402). Patients must be notified without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting 500 or more people go to HHS at the same time, and more than 500 residents of a state also triggers media notice. Smaller breaches are logged and reported within 60 days after the calendar year ends.

No segregation, but you still need to know where Part 2 data is

Dropping segregation helps hospitals and health plans. A Part 2 program still has to know which data is covered, because the proceedings restriction travels with the records, consented disclosures need the 2.32 notice and consent copy, counseling notes need their own consent, and agreed restrictions must be honored.

The safe harbor for investigative agencies

An agency that unknowingly receives Part 2 records is shielded only if, within 60 days before asking, it searched SAMHSA's online treatment locator and any similar state database, checked the provider's website or location, and viewed its patient notice or HIPAA notice (2.3(b)). If it finds Part 2 records, it must secure them, stop using them, and within 120 days seek a court order, return them, or destroy them (2.66(a)(3)). Keep your Part 2 status visible where agencies are told to look.

A Part 2 program can now ask a patient once for consent to all future TPO uses and disclosures, valid until revoked in writing. The required elements now track a HIPAA authorization, and counseling notes and legal proceedings each need a separate consent. A disclosure may not rest on a consent that has expired, been revoked, or on its face substantially fails the requirements (2.31(c)), so pre-2024 forms deserve a hard look. For the element-by-element checklist and the documentation that proves consent existed before a disclosure, see our 42 CFR Part 2 consent and documentation guide.

Free checklist

42 CFR Part 2 consent checklist for the 2024 final rule (PDF)

The required elements of a written consent under the 2024 final rule, how the single consent for treatment, payment and health care operations works, the checks to run before each disclosure, and sample wording.

Get the Part 2 consent checklist Free, with a work email.

Within the program, or with an entity that has direct administrative control over it, when staff need the information for SUD care duties (2.12(c)(3)).
Qualified service organizations, for the service they provide under a written agreement (2.12(c)(4)).
Medical emergencies, to medical personnel when prior consent cannot be obtained. Immediately record the recipient and facility, who disclosed, the date and time, and the nature of the emergency (2.51).
Crimes on the premises or against staff (2.12(c)(5)), and child abuse and neglect reports required by state law (2.12(c)(6)).
Research under 2.52, and public health with de-identified records only (2.54).
Audits and evaluations, including Medicare, Medicaid, and CHIP audits, if the auditor agrees in writing to Part 2's limits (2.53). See our UPIC audit response guide.
Court orders under subpart E, which authorize but do not compel disclosure: a subpoena is also needed, and a subpoena alone is never enough (2.61).

Enforcement in 2026: OCR is in charge

On August 25, 2025, the HHS Secretary delegated Part 2 enforcement to the OCR Director, including civil money penalties, resolution agreements, and subpoenas (90 FR 41833). On February 13, 2026, OCR announced the first civil enforcement program for SUD patient records, and on February 16 it began accepting Part 2 complaints and SUD breach notifications. It can run compliance reviews and investigations under the HIPAA Enforcement Rule (45 CFR part 160, subparts C, D, and E).

Civil money penalties follow HIPAA's four culpability tiers, from no knowledge to uncorrected willful neglect, with amounts adjusted for inflation each year (45 CFR 160.404). Criminal penalties under 42 U.S.C. 1320d-6 reach fines of up to $50,000 and one year in prison for knowing violations, rising to $250,000 and ten years with intent to sell or use the information for commercial advantage, personal gain, or malicious harm.

As of mid-October 2026, we found no Part 2 settlement among OCR's announced resolution agreements, but its HIPAA enforcement already reaches SUD providers. On February 19, 2026, OCR announced that Top of the World Ranch Treatment Center, an Illinois SUD provider, paid $103,000 and accepted a two-year corrective action plan after a phishing breach affecting 1,980 patients, citing evidence that it had not done an accurate and thorough risk analysis. That was a HIPAA case, but it shows what OCR examines after a breach.

New in September 2026: Part 2 and Medicaid community engagement

On September 29, 2026, OCR issued guidance on when a state Medicaid agency may use Part 2 records to verify that someone is excluded from the new Medicaid community engagement requirement (generally 80 hours a month of work or other qualifying activities, or half-time education, for certain adults ages 19 to 64). Exclusions include people who are medically frail, including certain people with SUD, and people in certain SUD treatment programs. The guidance notes that states must implement the requirement by January 1, 2027.

The agency may use the records if it received them under a TPO consent a Part 2 program obtained, or if it gets the patient's own written consent, and they stay off limits for proceedings against the patient. Because states must verify exclusions from reliable information they already have where possible, a valid TPO consent sent with each disclosure can affect how easily patients' exclusions are verified.

Your 2026 Part 2 compliance checklist

Notices

Replace the old summary with a notice that meets every element of 2.22, starting from OCR's model Part 2 patient notice.
Give it to each patient by their first service after the compliance date, post it at each site without identifying anyone as an SUD patient, and post it on your website.
If you are also a covered entity, update your HIPAA notice of privacy practices for Part 2 records (45 CFR 164.520, compliance date February 16, 2026) or adopt a combined notice.

Retire pre-2024 forms. Confirm TPO consents carry the 2.31(a)(10) statements and, for HIPAA recipients, the redisclosure statement in 2.31(a)(4)(iii). Keep counseling notes and proceedings consents separate.
Flag Part 2 records in your EHR and billing systems so claim attachments, records requests, and exchange feeds carry the 2.32 notice and a copy or explanation of the consent.
Decide whether clinicians keep SUD counseling notes, and if so, keep them separate.
Log each disclosure and its authority, including 2.51(c) emergency entries. The accounting right (2.25) has a tolled compliance date, but the log proves authorization.
Adopt a subpoena protocol, and make revocations and agreed restrictions, including the mandatory paid-in-full restriction (2.26), stop disclosures in practice.

Vendors, security, and breach

Sign a QSO agreement with every vendor that handles Part 2 records. It must state the vendor is fully bound by Part 2 and will resist judicial efforts to obtain records except as Part 2 permits. A business associate of a program that is also a covered entity can qualify (2.11).
Keep 2.16 security policies for paper and electronic records, with de-identification to the 45 CFR 164.514(b) standard.
Extend your HIPAA breach procedure to Part 2 records, including documented risk assessments.

People and governance

Run a complaint process, bar retaliation, and remove any waiver of complaint rights from intake paperwork (2.4).
Train intake, clinical, billing, records, and front desk staff on notices, consents, counseling notes, and subpoenas.
Check minors' consent rules (2.14) and stricter state law (2.20), and keep your website and treatment locator listings accurate.

Common gaps to look for in a Part 2 self-audit

Start where the rule is most specific and easiest to test:

A notice that never changed, or no notice on the website.
Disclosures since February 16, 2026 resting on pre-2024 consents without the 2.31(a)(10) statements.
Outgoing records without the 2.32 notice or a copy of the consent.
Counseling notes in the wrong place, or released under a TPO consent.
Subpoenas answered as if HIPAA applied, without a subpart E order or specific consent.
Vendors without agreements, such as a billing company, IT provider, or AI tool with no QSOA or qualifying BAA.
A misdirected fax judged "not a breach" with no documented risk assessment.
Revocations that do not stick because a payer feed kept sending records.

What to ask of your software

Your systems should show consent status at the point of disclosure, attach the 2.32 notice and consent to outgoing records, keep counseling notes separate, honor revocations, and produce a disclosure log on demand. We compare SUD EHRs and compliance layers on those points in our guide to the best 42 CFR Part 2 compliant software.

How Adentris helps

Adentris reviews every active chart, not a sample, against payer and regulatory rules before claims go out, and its rule coverage includes 42 CFR Part 2 alongside ASAM level of care, medical necessity, Medicaid and payer documentation rules, and treatment plan and signature timing. Each finding cites the rule that fired, and Adentris drafts the correction for staff to approve.

It works on top of any EHR, connecting through its API or FHIR, HL7 feeds, an API our agents build where none exists, or the AI Web Agent, usually with no IT project on your side, and is typically live in about 30 days. Adentris has completed SOC 2 Type I and Type II, operates under HIPAA with a signed BAA, runs AI inference inside Microsoft Azure, and sends no patient data to external LLM APIs. Our 42 CFR Part 2 compliance monitoring service applies this review to Part 2 specifically. To see it on your own charts, book a 30-minute call with our team.

Sources

Frequently asked questions

What is 42 CFR Part 2?

It is the federal regulation, under 42 U.S.C. 290dd-2, that protects the confidentiality of SUD patient records from federally assisted SUD programs. Records may be used or disclosed only with patient consent or under specific exceptions, and they cannot be used against the patient in legal proceedings without specific consent or a court order.

Who does 42 CFR Part 2 apply to?

Programs that hold themselves out as providing SUD diagnosis, treatment, or referral and are federally assisted, for example through Medicare participation, federal funding, or tax-exempt status. Many of its limits also bind those who receive Part 2 records, such as covered entities, health plans, and qualified service organizations.

What is the difference between HIPAA and 42 CFR Part 2?

HIPAA permits uses and disclosures for treatment, payment, and health care operations without authorization. Part 2 requires written consent, although one consent can now cover all of them, requires a notice and consent copy with each consented disclosure, and bars use against the patient in legal proceedings. Breach notification and penalties are now the same.

What did the 42 CFR Part 2 final rule change?

It allows a single consent for all future TPO, lets HIPAA entities redisclose those records as HIPAA permits except in proceedings against the patient, states that recipients need not segregate them, creates SUD counseling notes, and adds breach notification, HIPAA penalties, complaints to HHS, a new patient notice, new patient rights, and a safe harbor for investigative agencies.

When did the new Part 2 rule take effect, and who enforces it?

It took effect April 16, 2024, with compliance required by February 16, 2026. The HHS Office for Civil Rights enforces it and began accepting Part 2 complaints and breach notifications on February 16, 2026.

Can a Part 2 program release records in response to a subpoena?

Not on a subpoena alone. Disclosure for legal proceedings requires the patient's specific consent or a subpart E court order accompanied by a subpoena or similar mandate. Responses to impermissible requests must not confirm that the person is or was a patient.

42 CFR Part 2 in 2026: What the Final Rule Changed and What SUD Providers Must Do Now

What 42 CFR Part 2 is

Who Part 2 applies to

How Part 2 differs from HIPAA