42 CFR Part 2: SUD Confidentiality, Consent, and 2024 Changes

42 CFR Part 2 is the federal regulation that protects the confidentiality of substance use disorder (SUD) treatment records. It goes further than HIPAA in one crucial way: your records cannot be used against you in a civil, criminal, administrative, or legislative proceeding without your specific written consent or a special court order. It also controls when a treatment program can share your records with other providers, insurers, family, or anyone else. A 2024 final rule brought several parts of the regulation into line with HIPAA, and covered programs must comply with the updated requirements by February 16, 2026.¹

What Part 2 Protects

The rule covers any information that could identify you as someone who has, or ever had, a substance use disorder, or who received treatment for one. That includes the obvious clinical material such as diagnoses, lab results, and treatment plans. It also covers something subtler: the bare fact that you were ever a patient at a covered program. Records about past, current, and deceased patients are all included. Information that would let a third party reasonably conclude you have an SUD is protected too, so staff have to be careful with indirect identifiers like appointment schedules or facility-specific details that could give you away.

SUD Counseling Notes

The regulation creates a heightened category of protection for SUD counseling notes: notes a counselor or mental health professional takes during a private, group, joint, or family session, provided those notes are kept separate from the rest of your medical record.² These are the SUD equivalent of psychotherapy notes under HIPAA.

Prescriptions, session start and stop times, treatment frequency, clinical test results, and summary-level diagnosis or prognosis information are specifically excluded from this category. For the notes that do qualify, the rules are strict. The program needs a separate, standalone consent to disclose them. That consent cannot be bundled with any other consent, and the program cannot condition your treatment or your insurance eligibility on you agreeing to release counseling notes.³

Which Programs Have to Follow Part 2

Not every provider who encounters a patient with an SUD is covered. Part 2 applies to “programs,” which the regulation defines three ways: a person or entity (other than a general medical facility) that holds itself out as providing SUD diagnosis, treatment, or referral for treatment; an identified unit within a general hospital that does the same; or individual staff members inside a general medical facility whose main job is SUD care.⁴ A hospital’s dedicated addiction treatment wing is covered even if the hospital’s general medical floors are not.

The program also has to be “federally assisted,” but that bar sweeps in almost everyone. A program qualifies if it receives any federal funding, participates in Medicare, holds tax-exempt status, or is registered to dispense controlled substances such as buprenorphine for SUD treatment under the Controlled Substances Act.⁵ In practice, that captures the vast majority of specialized SUD treatment providers in the country. If you are receiving SUD-specific care, assume you are covered and ask if you want to be sure.

Every covered program must give you a written Notice of Privacy Practices in plain language. It has to describe how the program can use and disclose your records without consent, which disclosures require your written consent, your right to sign a single consent for treatment, payment, and health care operations, your right to revoke consent, and how to file a complaint.⁶

When Your Written Consent Is Required

The default rule is simple: a Part 2 program cannot share your records unless you have signed a valid written consent. Consent can be on paper or electronic, but it has to contain every one of the required elements. Miss one and the consent is not valid.

The patient’s full name.
The name or specific identification of the person or class of persons authorized to make the disclosure.
The name or class of persons who will receive the information.
A specific and meaningful description of what information will be shared.
A description of each purpose for the disclosure.
A statement that consent may be revoked in writing at any time except where the program has already acted in reliance on it, plus instructions for how to revoke.
A date, event, or condition on which the consent expires.
The patient’s (or authorized representative’s) signature and the date signed.
A statement that records disclosed under the consent may be redisclosed by the recipient and may no longer be protected by Part 2.
A statement about what happens if the patient declines to sign.

The provider should give you a copy once you have signed. You can revoke consent at any time in writing, though revocation does not undo disclosures the program already made while the consent was active.⁷

A Single Consent for Routine Care

One of the biggest practical changes under the 2024 final rule is that you can sign a single consent covering all future uses and disclosures for treatment, payment, and health care operations. Before this, programs often needed separate forms for each recipient, which made coordination between providers difficult. Under the single-consent approach, the recipient field can be described broadly (for example, “my treating providers, health plans, third-party payers, and people helping to operate this program”), the purpose can simply say “for treatment, payment, and health care operations,” and the expiration can be “end of treatment” or “none.”⁸

This single consent stays in effect until you revoke it in writing. It simplifies routine information sharing, but it does not extend to other purposes such as legal proceedings or law enforcement. Those still require their own specific consent or a court order.

What Happens When Records Are Shared

Every disclosure made under your consent has to travel with a written notice telling the recipient that the records are protected. The short version reads: “42 CFR part 2 prohibits unauthorized use or disclosure of these records.”⁹ When a HIPAA-covered entity or business associate receives Part 2 records through a valid consent for treatment, payment, or health care operations, that recipient can redisclose them under HIPAA’s regular rules. But no recipient, at any point down the line, may use or disclose those records in a civil, criminal, administrative, or legislative proceeding against you.¹⁰ A general medical records authorization is never enough to release Part 2 information; the consent has to meet every Part 2 requirement.

When Records Can Be Shared Without Your Consent

Part 2 permits disclosure without your written consent only in a narrow set of situations, and each one carries its own limits.

Medical emergencies. If you cannot give consent because of a genuine medical emergency, the program may share what medical personnel need to treat the emergency. The same rule applies when a program is closed because of a state or federally declared disaster and cannot reach you.¹¹

Scientific research. Researchers may access records only if they agree to follow strict privacy protocols, resist any effort to obtain the data through court, and publish only in de-identified, aggregate form.¹²

Audits and evaluations. Government agencies and certain private reviewers doing management audits or financial evaluations can access records to check that the program is running properly. Reviewers are bound to protect the information, cannot redisclose it, and cannot use anything they see to investigate or prosecute patients.

Public health reporting. Programs may share information with a public health authority without consent, but only if it has been de-identified so no one could reasonably use it to identify a patient.¹³

Court orders. A Part 2 court order is a specialized order. It authorizes disclosure but does not by itself force the program to hand over anything; a separate subpoena or similar mandate has to accompany it.¹⁴ Before signing, the judge has to make two “good cause” findings: that no other way to get the information is available or would be effective, and that the public interest in disclosure outweighs the injury to the patient, the physician-patient relationship, and treatment services.¹⁵ The bar is deliberately high. A standard subpoena, without a Part 2 court order, is not enough to force disclosure of these records.

Protection in Legal Proceedings

This is the protection that matters most for many patients, and it survived the 2024 updates intact. Your records, and any testimony describing what those records contain, cannot be used or disclosed in a civil, criminal, administrative, or legislative proceeding against you unless you give specific written consent or a court issues an order meeting Part 2’s requirements. Consent for this use has to be on its own separate form; it cannot be combined with your consent for treatment or any other purpose.¹

The protection follows the records. Even after a HIPAA-covered entity lawfully receives your Part 2 information and redistributes it under HIPAA rules, that downstream recipient still cannot use it against you in a legal proceeding. HIPAA has no equivalent restriction, which is what makes Part 2 meaningfully different.

Your Rights as a Patient

Access to Your Own Records

Part 2 does not stop a program from giving you access to your own records, including the right to inspect and copy them. The program does not need your written consent to share your records with you. Anything you get from your record, though, still cannot be used to bring or support criminal charges or investigations against you.¹⁶

Requesting Restrictions on Disclosures

You can ask a Part 2 program to restrict how it uses or discloses your records for treatment, payment, or health care operations, even if you have already signed a consent form. The program usually does not have to agree. There is one important exception: if you (or someone other than your health plan) pay for a service entirely out of pocket, the program must agree to your request to withhold that information from your health plan for payment or health care operations purposes.¹⁷ This mirrors a similar right under HIPAA and matters especially if you want to keep SUD treatment off your insurance records.

Accounting of Disclosures

You can ask for an accounting of all disclosures the program made with your consent during the previous three years, or a shorter period if you prefer. Disclosures made through an electronic health record for treatment, payment, and health care operations have to be included. For other consent-based disclosures, the accounting has to meet HIPAA’s standard requirements.¹⁸

Filing a Complaint

If you believe a program, covered entity, business associate, or other lawful holder of your records has violated Part 2, you can file a complaint with the HHS Secretary. In practice, that means the Office for Civil Rights, and the process follows the same procedures used for HIPAA complaints under 45 CFR 160.306.¹⁹ Programs must also run their own internal complaint process. The regulations flatly prohibit any program from intimidating, threatening, or retaliating against a patient who exercises these rights, and a program cannot make you waive your right to file a complaint as a condition of treatment, payment, or enrollment.

What Changed in 2024 and When Programs Must Comply

Part 2 dates back to the early 1970s, when Congress first passed confidentiality protections for SUD treatment records. For most of its history it operated on a stricter, separate track from HIPAA. The CARES Act of 2020 told HHS to bring parts of the rule into alignment with HIPAA and the HITECH Act, and HHS issued the final rule in 2024. Covered programs have until February 16, 2026 to come into compliance.¹

The biggest changes: patients can now sign a single broad consent covering future treatment, payment, and health care operations disclosures; HIPAA-covered recipients of Part 2 records can redisclose them under HIPAA (except in legal proceedings against the patient); the old criminal-only penalty scheme was replaced with HIPAA’s tiered civil and criminal enforcement; and programs must give patients a written Notice of Privacy Practices. What did not change is the core protection: your records still cannot be used against you in court without your specific consent or a qualifying court order.

Penalties for Violations

The 2024 rule replaced Part 2’s old criminal-only penalties, which topped out at a few thousand dollars and were widely viewed as too small to deter misconduct. Programs and other holders of Part 2 records now face the same tiered civil monetary penalty structure that applies to HIPAA violations, scaled by the violator’s level of culpability, from unknowing violations at the low end to willful neglect that goes uncorrected at the high end. Criminal penalties remain available for the most serious cases, including fraud or selling records for personal gain. Enforcement is handled by HHS through the Office for Civil Rights, using the same mechanisms it uses for HIPAA: complaint investigations, compliance reviews, and monetary penalties.¹