42 CFR Part 2 in 2026: Substance Use Treatment Confidentiality

Direct answer: 42 CFR Part 2 is a federal rule that protects records created by federally assisted programs that meet the rule’s definition of a substance use disorder program. Under the 2024 final rule, whose compliance date was February 16, 2026, a patient may provide one consent for future treatment, payment, and health-care-operations uses and disclosures. Separate protections still restrict using Part 2 records against a patient in legal proceedings.

Part 2 is important, but blanket statements such as “no one can share any addiction record without a new written consent each time” are no longer accurate. The answer depends on whether the record and program are covered, what consent exists, who received the record, and why it would be used or disclosed.

This article is general education, not legal advice. Organizations should have qualified privacy or legal counsel apply the current regulation to their operations.

What changed for 2026?

HHS issued a final rule in 2024 aligning parts of Part 2 more closely with HIPAA. Covered organizations were required to comply by February 16, 2026.

Major changes described by HHS include:

• one patient consent can authorize future uses and disclosures for treatment, payment, and health-care operations, often called TPO
• HIPAA covered entities and business associates that receive Part 2 records under that consent may generally redisclose them as HIPAA permits
• Part 2 records still cannot be used in civil, criminal, administrative, or legislative proceedings against a patient without specific consent or a qualifying court order
• Part 2 now incorporates breach-notification obligations and HIPAA-aligned civil and criminal enforcement authorities
• the rule adds patient notice requirements and certain rights involving complaints, accounting of disclosures, and requested restrictions
• SUD counseling notes maintained separately from the medical record receive special treatment and require specific consent for use or disclosure

The details and effective timing of particular rights matter. Use the current HHS guidance and regulation rather than an older consent template or blog summary.

Does Part 2 cover every record mentioning substance use?

No. Part 2 applies to records that identify a person as having or having had a substance use disorder and are obtained or maintained by a federally assisted Part 2 program for diagnosis, treatment, or referral for treatment.

Whether a clinician, department, or organization is a Part 2 program is a legal and operational determination. A general medical practice that happens to discuss substance use is not automatically identical to a specialized Part 2 program. HIPAA, state privacy law, professional duties, and other requirements may still protect the information even when Part 2 does not apply.

Part 2 and HIPAA are not interchangeable

| Question | HIPAA | 42 CFR Part 2 | |---|---|---| | What information is covered? | Protected health information held by covered entities and business associates | Covered SUD patient records held by Part 2 programs and certain lawful recipients | | Can one consent cover future TPO disclosures? | HIPAA often permits TPO without authorization | The 2024 Part 2 rule permits a single consent for future TPO uses and disclosures | | Can records be used against the patient in a legal proceeding? | Depends on HIPAA and other law | Part 2 imposes specific consent or court-order protections | | Do breach rules apply? | HIPAA breach notification can apply | The final Part 2 rule applies corresponding breach-notification requirements | | Are separately maintained counseling notes special? | HIPAA has special rules for psychotherapy notes | Part 2 now defines and specially protects SUD counseling notes |

The rules overlap in real workflows. A recipient may need to satisfy both, plus state law.

What should a valid consent workflow address?

A Part 2 program should not rely on a generic checkbox with unclear scope. The current regulation should guide the required elements and form of consent. Operationally, the workflow should make it understandable:

• who or which category of recipients may receive information
• the purpose and scope of the authorization
• whether the consent covers future TPO uses and disclosures
• when and how the patient may revoke consent
• which disclosures require separate consent, including SUD counseling notes or use in proceedings
• how the organization documents the consent and communicates its scope to recipients

Revocation does not necessarily undo actions already taken in reliance on a valid consent. The precise effect should be explained using the governing rule and the organization’s current notice.

What remains strongly protected in legal proceedings?

HHS states that Part 2 records cannot be used to investigate or prosecute a patient without written patient consent or a court order that satisfies Part 2. The final rule also restricts using records or testimony in civil, criminal, administrative, and legislative proceedings against the patient.

A subpoena alone should not be treated as automatic permission to disclose Part 2 records. Organizations need a trained escalation path for subpoenas, warrants, court orders, law-enforcement requests, audits, and litigation holds.

Emergency care and public-health disclosures

Part 2 contains limited pathways for medical emergencies and other specified circumstances. The final rule also permits disclosure to public-health authorities when the disclosed records are de-identified according to HIPAA standards.

These are not blanket permissions to share an entire record. Staff should know the applicable basis, minimum necessary scope where relevant, documentation requirements, and who must approve the disclosure.

What patients should ask

Patients can request the current Notice of Privacy Practices or Part 2 patient notice and ask:

1. Is this organization or service a Part 2 program?
2. What does the consent I am signing authorize?
3. Which organizations can receive my information for treatment, payment, or operations?
4. How do I revoke consent, request a restriction, get a copy of my record, or file a complaint?
5. How are SUD counseling notes handled?
6. Will information be shared with a referral partner, insurer, pharmacy, family member, or health-information exchange?
7. Who can answer a privacy question before I sign?

Coverage under a family member’s insurance, adolescent consent, guardianship, state minor-consent laws, and access to portal or billing information can be complex. Do not rely on a universal promise that a parent, spouse, employer, or policyholder will never see any related information.

What referral partners should do

Referral relationships should be designed around consent and minimum necessary information, not improvised after a referral arrives. Partners should document:

• which organization is the Part 2 program
• how consent is obtained and transmitted
• what information will flow at referral, acceptance, admission, discharge, and follow-up
• how revocation, redisclosure, patient requests, and record corrections are handled
• how urgent safety communication and emergency exceptions are escalated
• how vendors, business associates, portals, messaging tools, and analytics are governed

Grata’s partner pathway can be used to begin a referral conversation. The appropriate information exchange depends on patient consent, the participants’ legal roles, and current privacy requirements.

Sources

• Fact Sheet: 42 CFR Part 2 Final Rule — HHS
• Understanding Confidentiality of SUD Patient Records — HHS
• 42 CFR Part 2 — Electronic Code of Federal Regulations