Most people know that HIPAA protects their medical records. Fewer know that records from substance use disorder treatment programs are covered by a second, older, and in some ways stricter federal rule. The regulation at 42 CFR Part 2, usually just called Part 2, was written in the 1970s on the premise that fear of exposure keeps people from seeking treatment, and that a promise of confidentiality stronger than the norm is necessary to overcome that fear. Part 2 was substantially revised in 2024 to align it more closely with HIPAA, and the revised rule reached its compliance date in early 2026. This article explains what Part 2 protects, how consent works, what changed, and what it means for a patient.
What Part 2 is and why it exists
Part 2 implements a federal statute that restricts the disclosure and use of patient records created by federally assisted substance use disorder treatment programs. Its core rule is that a Part 2 program may not disclose information that would identify a person as having or having had a substance use disorder, or as having sought or received treatment for one, without the patient's written consent or a specific exception in the regulation. The protection also follows the record: a recipient of Part 2 information is generally bound by the same restrictions on redisclosure.
The purpose is stated in the regulation itself: to ensure that a person is not made more vulnerable by reason of the availability of their record than a person who does not seek treatment. In practice, the rule has meant that substance use treatment records have historically been walled off from the rest of the medical record, sometimes to the frustration of clinicians trying to coordinate care and sometimes to the relief of patients who did not want an old treatment episode following them into every future encounter.
Which records and providers are covered
Part 2 applies to records held by a Part 2 program. A program, under the rule, is an individual or entity, other than a general medical facility, that holds itself out as providing and does provide substance use disorder diagnosis, treatment, or referral for treatment, and that is federally assisted. Federal assistance is defined broadly and includes receiving federal funds, being tax-exempt, or being licensed or certified by the federal government, so most treatment programs qualify. Within a general hospital, a specialized unit that holds itself out as providing such treatment is a program; the emergency department that treats an overdose generally is not.
This means the same fact, that a person has an opioid use disorder, can be protected differently depending on where the record was created. A note in a primary care chart is protected by HIPAA. A record from a licensed addiction treatment program is protected by Part 2 as well. Patients are sometimes surprised to learn that the protection depends on the source of the record rather than on the diagnosis itself.
Key point: Part 2 protects records created by specialized substance use treatment programs. It does not automatically cover every mention of substance use in every medical record. Ask the program whether it is a Part 2 program; it is required to notify patients of its confidentiality obligations.
How consent works under Part 2
Historically, Part 2 consent was narrow and specific. A patient had to sign a separate consent for each disclosure, naming the recipient and the purpose, and the recipient could not pass the information on without another consent. That structure protected patients but made ordinary care coordination cumbersome. Part 2 consent remains written and must include specific elements, including the name of the patient, the recipient, the purpose, how much and what kind of information may be disclosed, the patient's right to revoke, and the date or condition on which the consent expires.
Consent is also required for uses that HIPAA alone would permit without it. For example, HIPAA allows a provider to share records with another provider for treatment without asking the patient. Part 2, before the 2024 changes, generally did not. That difference is the heart of what the 2024 rule addressed.
What the 2024 final rule changed
In February 2024, HHS published a final rule revising Part 2 to implement provisions of the CARES Act that directed closer alignment with HIPAA. The compliance date for most provisions was February 16, 2026, so programs are now expected to operate under the revised rule. The main changes:
- Single consent for treatment, payment, and operations. A patient may now give one consent that allows a Part 2 program to use and disclose records for treatment, payment, and health care operations, and permits HIPAA covered entities and business associates that receive the records under that consent to redisclose them as HIPAA would allow. Patients may still choose not to sign such a consent.
- HIPAA-style breach notification. Part 2 programs are now subject to breach notification requirements modeled on the HIPAA Breach Notification Rule.
- Patient Notice aligned with the HIPAA Notice of Privacy Practices. Programs must provide a notice describing their confidentiality practices in a form aligned with HIPAA's notice.
- Right to an accounting of disclosures and to request restrictions. Patients gained rights modeled on HIPAA's, including the right to obtain a list of certain disclosures made with consent.
- Limits on use in legal proceedings. The rule strengthened protections against the use of Part 2 records and testimony in civil, criminal, administrative, or legislative proceedings against the patient without consent or a court order meeting the rule's standards.
- Separate treatment of SUD counseling notes. Notes recording the contents of counseling sessions and kept separate from the rest of the record receive heightened protection and require a specific consent, similar to HIPAA's psychotherapy notes.
- Enforcement. Violations are now subject to the same civil and criminal enforcement authorities that apply to HIPAA.
Your rights as a patient
As a patient of a Part 2 program, you have the right to receive the program's confidentiality notice, to decide whether to sign a consent and to revoke it in writing, to obtain an accounting of certain disclosures, and to request restrictions on certain disclosures. You retain your HIPAA right of access to your own records, because a Part 2 program that is also a HIPAA covered entity must honor both sets of rights, and Part 2 itself does not restrict disclosure of a record to the patient it concerns.
You also have the right to understand what you are signing. If a program presents a single consent for treatment, payment, and operations, it should explain that records disclosed under it may be redisclosed by HIPAA covered entities in the ways HIPAA permits. If you would prefer narrower sharing, you can decline that consent and sign a more specific one, or decline consent altogether, though the program may explain how that affects coordination with other providers or payment for services.
Practical questions patients ask
Will my primary care doctor see my treatment records? Only if you consent, or if an exception such as a medical emergency applies. Under the revised rule, a single TPO consent makes ongoing sharing with your other providers much simpler than it used to be, if that is what you want.
Can my employer or an insurer find out? Not from the program without your consent. If you consent to disclosure to an insurer for payment, the insurer is bound by HIPAA and, under the revised rule, may redisclose only as HIPAA permits. Part 2 continues to restrict use of the records against you in legal proceedings.
What happens to records after I leave treatment? The protection follows the record for as long as it exists, at the program and at any recipient bound by the redisclosure rules. Programs also have retention and destruction requirements when they close or discontinue services.
Where do I complain if I think my records were shared improperly? Complaints can be filed with the HHS Office for Civil Rights, which now enforces Part 2 alongside HIPAA, and with the program itself, which must have a complaint process described in its notice.
Common questions
Does 42 CFR Part 2 apply to every medical record that mentions substance use?
No. It applies to records created by federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment, or referral. A note in a general primary care chart is protected by HIPAA, not Part 2, unless it originated from a Part 2 program.
Can I sign one consent that covers all of my care coordination?
Yes. Under the 2024 final rule, with a compliance date of February 16, 2026, a patient may sign a single consent for treatment, payment, and health care operations. You may also choose a narrower consent or decline.
Can substance use treatment records be used against me in court?
Part 2 restricts the use of covered records and testimony in civil, criminal, administrative, or legislative proceedings against the patient without consent or a court order that meets the rule's specific standards. The 2024 rule strengthened those protections.
Who enforces Part 2?
Since the 2024 rule, violations are subject to the same civil and criminal enforcement authorities that apply to HIPAA, and the HHS Office for Civil Rights accepts complaints.