Framework Healthcare & Human Services
42 CFR Part 2
42 CFR Part 2 is the federal confidentiality rule for substance use disorder treatment records held by federally assisted programs. It is stricter than HIPAA: records identifying a person as a patient in an SUD program cannot be disclosed without written consent except in narrow circumstances, and recipients cannot redisclose them.
A February 2024 final rule, required by the CARES Act, moved Part 2 closer to HIPAA by allowing a single consent for treatment, payment, and health care operations, adding HIPAA-style breach notification and patient notice requirements, and applying HIPAA civil and criminal penalties to violations. The rule took effect April 16, 2024 with a compliance date of February 16, 2026.
In writing, a Part 2 program needs a patient notice (which may be combined with the HIPAA notice of privacy practices), consent forms that carry every element in section 2.31, the redisclosure prohibition notice attached to disclosures, written policies and procedures for security of records and for breach notification, qualified service organization agreements, and staff training records.
Programs must also be ready for the accounting of disclosures obligation when it becomes enforceable.
Who has to comply
Federally assisted programs that hold themselves out as providing SUD diagnosis, treatment, or referral: specialty treatment providers, opioid treatment programs, and identified SUD units or staff within general medical facilities. Lawful holders who receive Part 2 records with consent, including health plans, are bound by the redisclosure rules.
What you have to write
Documents on this site that 42 CFR Part 2 requires or expects, each with who must have it, the review cycle and the obligations that cite it.
- HIPAA Privacy Policies and Procedures Healthcare
- HIPAA Security Policies and Procedures Information security
- Notice of Privacy Practices Healthcare
- 42 CFR Part 2 Consent and Redisclosure Policy Healthcare
- Health Care Compliance Program Policies and Code of Conduct Healthcare
What the assessor asks to see
An investigator asks for the patient notice and how it is given, the consent form and a sample of executed consents, the redisclosure notice used on disclosures, written security policies for paper and electronic records, breach risk assessments and notifications, QSOAs and business associate agreements, staff training records, disclosure logs, and the program's procedure for responding to subpoenas and court orders.
Where the requirement sits: 42 CFR 2.16 security policies and procedures; 2.22 patient notice; 2.31 consent; 2024 final rule alignment with HIPAA
Key dates
Final rule published February 16, 2024; effective April 16, 2024; compliance required by February 16, 2026. HHS has indicated the accounting of disclosures provision will not be enforced until the related HIPAA standard is finalized (verify current enforcement position).
What AllyMatter does here
Writes, approves and proves workforce acknowledgment of Part 2 policies, with the review cycle and audit trail.
AllyMatter publishes this site.
Assessors
Who assesses 42 CFR Part 2
HHS Office for Civil Rights investigates complaints and breaches and can impose civil money penalties; the Department of Justice can bring criminal cases. State licensing surveys and accreditors (CARF, Joint Commission) check Part 2 practices as part of broader surveys. There is no certification.
No firm has claimed a 42 CFR Part 2 assessor listing yet. Claim yours →
Consultants
Who helps with 42 CFR Part 2
Health care privacy consultants, behavioral health compliance firms, and law firms that write joint HIPAA and Part 2 policy sets; EHR and HIE vendors help with segmentation. Typical engagement shape is a policy and consent-form rewrite, staff training, and updating QSOAs and business associate agreements before the compliance date.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
No firm has claimed a 42 CFR Part 2 consultant listing yet. Claim yours →
Software
Tools for 42 CFR Part 2
Tools that name this framework in their own material.
Related reading
- Final Rule: 42 CFR Part 2, Confidentiality of Substance Use Disorder Patient RecordsClinician-facing summary of what the 2024 final rule changed, including the single consent for treatment, payment and operations.American Psychiatric Association
- Substance Abuse Disorder Records (42 CFR Part 2) Final Rule Is Here!Health lawyers walk through the new enforcement exposure, breach notification and consent mechanics programs now have to operate.Quarles & Brady
- Understanding and Implementing the Updates to 42 CFR Part 2Implementation guide covering consent forms, patient notice and how Part 2 now sits alongside the HIPAA Privacy Rule.Network for Public Health Law
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for 42 CFR Part 2
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Run the Policy Side of 42 CFR Part 2 in AllyMatter
Approve the policies 42 CFR Part 2 asks for, keep every version, and record a named acknowledgment from each person who has to read them.