HIPAA (the Health Insurance Portability and Accountability Act) is not the strictest federal privacy rule in healthcare. For one category of records, substance use disorder treatment records, Congress built something tighter: 42 CFR Part 2 (the federal rule on confidentiality of substance use disorder patient records), a regulation older than HIPAA and, in several places, tougher. If your practice treats SUD (substance use disorder) patients, or receives records from a program that does, HIPAA is only half your rulebook.
This article covers who Part 2 actually applies to (fewer providers than assume it, more than know it), where it is stricter than HIPAA, and how the 2024 final rule pulled the two regimes closer together.
42 CFR Part 2 and HIPAA: Who Is Covered by Which
The "Part 2 Program" Test
HIPAA covers essentially every provider that bills electronically. Part 2 is narrower. It starts with federally assisted (tied to the federal government through tax status, DEA registration, or federal program participation), a broad test in practice that most licensed providers meet. Among those, it applies only to Part 2 programs (programs that hold themselves out as providing substance use disorder diagnosis, treatment, or referral).
The operative phrase is "holds itself out." A dedicated addiction treatment clinic, an opioid treatment program, a detox unit: Part 2 programs. A general family practice where a physician sometimes treats SUD alongside everything else typically is not one, because the practice does not hold itself out as an SUD program. That boundary decides your obligations, it is fact-specific, and if your practice sits near it, that is a question worth an hour of qualified advice, not a guess.
One more group is pulled in: anyone who receives Part 2 records. The records carry their restrictions with them, along with a required notice prohibiting redisclosure. A primary care office that receives records from a treatment program cannot simply refile them under ordinary HIPAA rules.
Where Part 2 Is Stricter Than HIPAA
Under HIPAA, TPO (treatment, payment, and health care operations) runs on permitted uses (disclosures the rule allows without the patient's permission). Part 2's default is the opposite: disclosure generally requires the patient's written consent, even for many things HIPAA would wave through. A standard HIPAA release form does not satisfy Part 2's consent content requirements on its own.
Second, law enforcement. Where HIPAA permits various disclosures to law enforcement, Part 2 requires a specific court order, and it prohibits using the records to investigate or prosecute the patient absent that order. This is the provision the rule was built around: people avoid addiction treatment when treatment records can become prosecution evidence.
Third, redisclosure (a recipient passing the records on to someone else). Part 2 records travel with an explicit prohibition notice, and the recipient is bound by it. HIPAA has no general equivalent; its release forms merely warn that redisclosure may happen.
Part 2 vs HIPAA at a Glance
| Question | HIPAA | 42 CFR Part 2 |
|---|---|---|
| Who it covers | Covered entities (essentially every provider that bills electronically) and their business associates | Part 2 programs, plus anyone who receives Part 2 records |
| Treatment, payment, operations | Permitted uses; no patient permission needed | Written patient consent; since the 2024 rule, one consent can cover all future TPO uses |
| Law enforcement | Various disclosures permitted | Specific court order required; no use to investigate or prosecute the patient without one |
| Redisclosure | No general prohibition; release forms warn it may happen | Records travel with a prohibition notice that binds the recipient |
| Breach notification | Breach Notification Rule | Same rule since the 2024 final rule |
| Penalties | HIPAA civil and criminal penalty structure | Aligned with HIPAA's structure since the 2024 final rule |
What the 2024 Final Rule Changed
For decades the two regimes ran on incompatible plumbing, and providers bore the friction. The 2024 final rule, required by the CARES Act, aligned much of it. The headline changes: a patient can now give a single consent covering all future uses and disclosures for treatment, payment, and operations; Part 2 breach notification now follows HIPAA's Breach Notification Rule; enforcement and penalties now align with HIPAA's civil and criminal penalty structure; and SUD counseling notes gained a protection modeled on HIPAA's psychotherapy notes. The rule took effect April 16, 2024, and compliance was required by February 16, 2026, so these are current obligations, not upcoming ones.
What did not change: the court order requirement for law enforcement use, and the basic consent-first architecture. Alignment made the paperwork saner. It did not demote the protection.
The alignment also reached HIPAA's own text. A covered entity that creates or maintains Part 2 records had to update its NPP (notice of privacy practices) by February 16, 2026, and HIPAA's notice rule now states the court order protection in its own words:
Substance use disorder treatment records received from programs subject to 42 CFR part 2, or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the individual unless based on written consent, or a court order after notice and an opportunity to be heard is provided to the individual or the holder of the record, as provided in 42 CFR part 2.
What This Means for a Small Practice
Three situations cover most readers. If you are a Part 2 program: you need the Part 2 consent forms, the redisclosure notices, and staff who understand that "HIPAA allows it" is not the end of the analysis; enforcement is real. OCR (the HHS Office for Civil Rights) started civil enforcement of Part 2 on February 16, 2026. OCR has also already settled with an SUD treatment provider, though that case fell under the HIPAA Security Rule (see the recent OCR settlement with an SUD treatment provider). If you receive Part 2 records: segregate or flag them so they are not redisclosed on a routine HIPAA basis. If you are a general practice treating some SUD patients: document the analysis of why you are not a Part 2 program, and still handle SUD information with elevated care under the Privacy Rule and any stricter state law.
The pattern I see most often is not bad intent; it is paperwork that waited too long. In Case 01, a Florida mental health franchise office called me with policies never written, records with holes, training half done, and a state auditor due in days. We ran a fast gap analysis, built a ranked plan around what the auditor was most likely to ask for, and checked in daily; the office was audit-ready in under a week and passed its state audit. In Case 05, a single-location practice had several vendors handling PHI (protected health information) with no BAA (business associate agreement); we got every missing BAA signed and set up a repeatable vendor review. My advice for a Part 2 program is the same: build the consent forms, redisclosure notices, and vendor review before anyone asks to see them. If your vendors touch Part 2 records, that vendor review is where I would start.
About the Author
Chuck Weiselberg (full author bio: oneguyconsulting.com/author/chuck-weiselberg) is the Founder and HIPAA Consultant at One Guy Consulting and has been consulting since 2015. Over roughly 23,000 meetings with more than 3,500 organizations, his record is simple: zero clients fined, zero failed audits.
FAQ
Does 42 CFR Part 2 apply to every provider who treats addiction?
No. It applies to federally assisted programs that hold themselves out as providing SUD diagnosis, treatment, or referral. A general practice treating some SUD patients among others is typically not a Part 2 program, though the analysis is fact-specific.
Is a HIPAA release form enough for substance use records?
Not for Part 2 records. Part 2 has its own written consent requirements. Since the 2024 final rule, a single consent can cover all future treatment, payment, and operations uses, but the consent must meet Part 2's content rules.
Can police get Part 2 records with a subpoena?
No. Part 2 requires a specific court order for law enforcement use, and the records cannot be used to investigate or prosecute the patient without one. This is stricter than HIPAA's law enforcement provisions.
What happens if a Part 2 program has a breach?
Since the 2024 alignment rule, Part 2 breaches follow HIPAA's Breach Notification Rule: assessment, individual notice, HHS notice, and the same clocks.
What should we do with Part 2 records we receive from a treatment program?
Honor the redisclosure prohibition they arrive with. Flag or segregate them so they are not released under a routine HIPAA disclosure, and train records staff on the difference.
Behavioral health and SUD-adjacent practices carry the most layered privacy obligations in outpatient care, and they are exactly who One Guy Consulting built the behavioral health compliance program for. The Full-Scope plan adds four hours a month of one-on-one implementation calls with Chuck. Start with a free 30-minute intro call. No obligation, no pressure.
One Guy Consulting in 37 Seconds
Sources
- 42 CFR Part 2 (current text)
- HHS: Confidentiality of Substance Use Disorder (SUD) Patient Records
- 45 CFR Part 164 Subpart E (HIPAA Privacy Rule)
Related Reading
Try three One Guy Consulting 3D staff training courses free →