A 42 CFR Part 2 consent form is the written authorization that lets a federally protected substance use disorder treatment program release your records to a specific person or organization. To be valid, the form must contain every element listed in 42 CFR § 2.31(a): your name, who is disclosing, who is receiving, what information is covered, why, your right to revoke, an expiration, and your signature and date. Miss any one of them and the program cannot lawfully send the records, even if you clearly intended to authorize the release.
Required Elements of the Form
Work through the form field by field. Each item below corresponds to a requirement in § 2.31(a), and a gap in any of them can invalidate the whole consent.
Patient Name
Write your full legal name as it appears in the program’s records. Nickname and maiden-name mismatches are one of the most common reasons a release stalls at the records desk.
Who Is Disclosing
Name the person or program authorized to release the records — the entity that currently holds your file. Use the program’s full legal name rather than an abbreviation or informal name.
Who Receives the Records
Identify the recipient. For a targeted release, list the person or organization by name: a specific attorney, a specific employer, a specific clinic. For a broader consent covering treatment, payment, and healthcare operations, a description like “my treating providers, health plans, third-party payers, and people helping to operate this program” is acceptable.
If records are moving through a health information exchange or similar intermediary, name the intermediary and either list its participants or describe a class of participants limited to those who have a treating provider relationship with you.
What Information Is Being Shared
The regulation requires you to describe the information “in a specific and meaningful fashion.” That means naming the parts of your record involved: intake assessments, lab results, progress notes, a discharge summary, or some combination. “All my records” is not specific enough for most consents. The one exception is a consent covering treatment, payment, and healthcare operations, where the scope naturally covers clinical information relevant to your ongoing care.
Purpose of the Disclosure
State why you are releasing the records. If you initiated the consent yourself and prefer not to give a reason, “at the request of the patient” is enough. For a treatment, payment, and healthcare operations consent, “for treatment, payment, and health care operations” satisfies the requirement. Other common purposes include coordinating care with a specialist, supporting a disability claim, or responding to a court proceeding. If the program plans to use your records for its own fundraising, the form must also tell you about your right to opt out of fundraising communications.
Right to Revoke
The form must state that you can revoke consent in writing at any time and explain how. It must also note the limitation: the program is not liable for records already sent before your revocation arrived.
Expiration Date or Event
Every consent needs either an expiration date or an expiration event tied to you or the purpose of the release. For a one-time disclosure to an attorney handling a specific matter, the event might be the conclusion of that case. For a consent covering treatment, payment, and healthcare operations, “end of treatment” or “none” are both acceptable, meaning the consent stays in effect indefinitely until you revoke it in writing.
Signature and Date
You sign and date the form yourself. The signature date is when the consent becomes effective. If you lack legal capacity to sign because of age, guardianship, or incapacity, a legally authorized representative signs on your behalf.
Additional Statements for a Treatment, Payment, or Healthcare Operations Consent
If you are signing a broad consent that covers treatment, payment, and healthcare operations — often called a TPO consent — two extra statements must appear on the form. The first tells you that once records are disclosed, the recipient could redisclose them and they would no longer be protected by Part 2. The second explains the consequences of refusing to sign.
A TPO consent also has to include a statement that the records may be redisclosed under HIPAA’s rules when the recipient is a covered entity or business associate receiving them for treatment, payment, or healthcare operations, with one carveout: the records still cannot be used in legal proceedings against you.
Under the 2024 final rule, a single TPO consent can cover all future disclosures of that type, so you do not have to sign a new form every time your treating program sends records to another provider involved in your care. Programs had until February 16, 2026, to update their consent forms and procedures to match the new rule.
Signing for Someone Else
If you are completing the form on behalf of another patient, your authority matters. For a living patient who cannot sign, a legally authorized representative — appointed through guardianship, a power of attorney, or another mechanism recognized under state law — can sign.
For a deceased patient, the rule is narrower. Under 42 CFR § 2.15(b)(2), only the personal representative appointed under state law (an executor or administrator of the estate), the patient’s spouse, or, if there is no spouse, a responsible family member can authorize the release. Someone who was permitted to receive records while the patient was alive does not automatically gain the right to sign a new release after death.
How to Submit the Form
Programs generally accept a completed consent through several channels. Pick the one that gets the form there securely and gives you proof of delivery.
- Mail: send the form by USPS with tracking or delivery confirmation, and keep the tracking number.
- Fax: fax to the medical records department at a verified, secure number, and save the confirmation page.
- Encrypted patient portal: many programs accept uploads through secure electronic health record portals that require a login, which routes the form directly to the right department and reduces interception risk.
After submitting, call the records department to confirm receipt. Most programs acknowledge the form within one to two business days. Actually pulling the records, attaching the required redisclosure notice the regulation makes the program send, and getting everything out to the recipient typically takes five to ten business days depending on the volume of documentation.
Keep a copy of every signed consent. If the program rejects the form for a missing element or a name mismatch, having your copy lets you fix the specific problem rather than starting over.
Revoking the Consent Later
You can revoke a Part 2 consent at any time, but the regulation at § 2.31(a)(6) requires you to do it in writing. A phone call is not enough. Send a written statement, on paper or through an electronic channel the program accepts, that includes the date, your name, and enough detail to identify which consent you are revoking. That last piece matters if you have several active consents on file for different recipients.
The revocation takes effect when the program receives it. Anything sent before that moment was lawfully disclosed and cannot be recalled. Once the revocation is processed, the program has to update your file so no further disclosures go out under the old consent.
Checking Where Your Records Went
Under 42 CFR § 2.25, you can ask the program for an accounting of disclosures made with your consent during the previous three years, or a shorter period you specify. For disclosures made for treatment, payment, and healthcare operations, the accounting only has to cover those sent through an electronic health record. The standards match HIPAA’s accounting rules at 45 CFR § 164.528. If you signed a broad TPO consent, this is how you find out which providers and payers actually received your information.