42 CFR Part 2

Editorial approval scope: The team checked current source fidelity, scope boundaries, dates, arithmetic, reader usefulness, practical workflow, and general-information limitations.

Part 2 starts with program and record status

The HHS Part 2 hub explains the federal confidentiality framework for substance-use-disorder patient records. Part 2 does not automatically cover every behavioral-health record or every reference to alcohol or medication.

Ask whether the source is a federally assisted Part 2 program, whether the information is a Part 2 record, who now holds it, and which rule applies to the planned action. General medical facilities have specific rules for identified units and personnel whose primary function is SUD diagnosis, treatment, or referral.

An ABA practice can be outside Part 2 program status and still receive protected records. Preserve provenance, any accompanying consent or explanation, recipient type, and restrictions rather than copying a sensitive label into broad notes.

The current rule aligns selected HIPAA workflows

The HHS 2024 final-rule fact sheet, updated January 30, 2026, says a patient can give one consent for future treatment, payment, and health-care-operations uses and disclosures. HIPAA covered entities and business associates receiving records under that consent may redisclose them under HIPAA, subject to Part 2's remaining limits.

The change does not make Part 2 identical to HIPAA. Determine which rule supplies authority and apply any more protective requirement that also governs.

Some records and uses need separate treatment

SUD counseling notes kept separately from the rest of the treatment and medical record have a distinct consent rule. Uses and disclosures for civil, criminal, administrative, or legislative proceedings against the patient also retain stricter protection and generally require specific consent or a qualifying court order.

Do not combine a proceeding consent with a routine treatment, payment, or operations consent. A subpoena, request, or authorization labeled “HIPAA compliant” does not by itself satisfy Part 2.

Notice and breach duties are operative

The current 42 CFR Part 2 text contains patient-notice, consent, disclosure, security, breach, complaint, and enforcement provisions. HHS aligned the Part 2 patient notice with the HIPAA Notice of Privacy Practices structure and applied HIPAA Breach Notification Rule requirements to Part 2-record breaches.

The HHS enforcement announcement says OCR began accepting Part 2 complaints and breach notifications on February 16, 2026. Route an incident promptly through both Part 2 and every applicable HIPAA, state, contract, payer, licensing, and insurer analysis.

Segregation is optional while control remains necessary

The final rule states that segregating or segmenting Part 2 data is not required. A practice still needs reliable classification and access controls for consent, SUD counseling notes, legal proceedings, notices, disclosures, breach response, and patient rights.

Use metadata, restricted document types, purpose-based access, release checks, and audit logs that fit the system. Avoid flags visible to people who have no role in the care or disclosure.

Vendors need scoped instructions

Map whether a vendor is acting for a Part 2 program, a HIPAA covered entity, a business associate, another lawful holder, or several roles. Contracts should define permitted uses, access, subcontractors, safeguards, incident reporting, return or deletion, legal demands, and assistance with rights.

A contract cannot create patient consent or erase a regulatory restriction. Test the vendor's actual configuration and exports.

A fictional record inventory

A fictional ABA practice reviews 14 external records that mention substance-use care. Nine have complete provenance, program-status evidence, consent or other authority, recipient classification, and access mapping. Three are confirmed Part 2 records; six are governed through other privacy routes. Five remain held for source clarification.

Classification completeness is 9 of 14, or 64.3%. The holds remain unavailable for routine secondary use. Among the three confirmed Part 2 records, all three have the correct restricted document type and legal-demand route: 3 of 3.

These figures measure record controls. They do not decide a person's diagnosis, consent capacity, or legal rights.

Use an action-specific release gate

Before a use or disclosure, record the program, record, holder, person with authority, purpose, recipient, consent or regulatory permission, proceedings analysis, notice, minimum necessary rule when applicable, transmission, and disclosure log. Preserve denials and unresolved cases.

Questions owners should ask

• Which source established Part 2 program and record status?
• Who holds the record, and which permission supports this action?
• Does the request involve SUD counseling notes or a proceeding against the patient?
• Which notice, breach, disclosure-log, and patient-right workflows apply?
• Can every vendor and downstream recipient follow the same scope?

Treat an unclear source or purpose as a hold with a named reviewer. Urgent care can follow an applicable emergency provision while the legal record is completed accurately.