42 Cfr Part 2

42 CFR Part 2 — Substance Use Disorder Records

Overview

42 CFR Part 2 establishes federal confidentiality protections for patient records created by federally assisted programs treating substance use disorders (SUDs). Originally enacted under the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act of 1970 and the Drug Abuse Prevention, Treatment, and Rehabilitation Act of 1972, Part 2 was designed to remove barriers to treatment by ensuring that SUD records could not be used to criminally prosecute or otherwise discriminate against patients. Part 2 is intentionally stricter than HIPAA — it requires specific written consent for most disclosures and prohibits re-disclosure by recipients. The CARES Act §3221 (enacted March 2020) and the subsequent 2024 Final Rule (89 FR 12472, effective February 16, 2024) significantly amended Part 2 to align certain provisions with HIPAA while preserving core patient protections.

Applicability — Who Must Comply

Part 2 Programs

Part 2 applies to any "program" that is federally assisted and holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment. A program is federally assisted if it:

1. Is conducted by any department or agency of the United States (VA, IHS, military)
2. Is carried out under a license, certification, registration, or authorization from the federal government (DEA registration for opioid treatment programs)
3. Is supported by funds from any federal department or agency (Medicare/Medicaid participation qualifies)
4. Is assisted by the IRS through tax-exempt status under 26 USC §501(c)(3)
5. Is conducted by a state or local government receiving federal funds that could be used for SUD programs (even if not directly used for SUD)

Asclepius Health Network Applicability: Asclepius operates 3 dedicated SUD treatment facilities and provides SUD treatment services in all 12 hospitals. Because Asclepius participates in Medicare and Medicaid, all SUD treatment records are Part 2 records. Asclepius maintains a separate consent workflow for Part 2 records in its EHR.

General Medical Facilities

A general medical facility (like a hospital ED) is a Part 2 program only with respect to an identified unit that holds itself out as providing SUD diagnosis, treatment, or referral. However, the 2024 amendments clarify that incidental SUD information in a general medical record (e.g., a note that a patient has a history of alcohol use disorder documented during a cardiac admission) is subject to Part 2 only if the information was obtained from a Part 2 program.

What Records Are Protected — §2.12

Part 2 protects records that:

1. Would identify a patient as having or having had a substance use disorder
2. Are created by a Part 2 program (or received from a Part 2 program)
3. Contain SUD diagnosis, treatment, or referral information

The protections apply to any information that would identify an individual as a SUD patient, including the fact that the person is or was a patient in a Part 2 program.

Consent Requirements — §2.31

Written Consent Required

Unlike HIPAA, which permits disclosures for TPO without consent, Part 2 historically required specific written consent for virtually all disclosures. The 2024 amendments introduced a HIPAA-aligned consent-once model for TPO, but with important safeguards.

Pre-2024 Consent Requirements (Still Applicable for Non-TPO Disclosures)

A valid Part 2 consent must include all of the following:

2024 Amendments — HIPAA-Aligned Consent for TPO

The 2024 Final Rule (89 FR 12472) introduced §2.33, allowing a single prior written consent for all future uses and disclosures for treatment, payment, and healthcare operations:

Key Features of §2.33 Consent:

• Patient may provide a single written consent covering all future TPO disclosures
• Consent covers disclosures to treating providers, payers, and entities performing healthcare operations
• Consent need not name each specific recipient — a general designation of recipient categories is sufficient (e.g., "my treating providers" or "my health plan")
• Consent does not expire unless the patient revokes it
• Patient retains the right to revoke at any time (revocation effective prospectively)
• Recipients remain bound by Part 2's anti-discrimination and limited use/disclosure restrictions

Asclepius Health Network Implementation: Asclepius offers patients a §2.33 TPO consent form at SUD program intake. Patients who sign the TPO consent have their Part 2 records flagged in the EHR for permitted sharing with treating providers and the patient's health plan. Patients who decline the TPO consent retain the traditional per-disclosure consent process. All consent decisions are documented in the EHR.

Re-Disclosure Prohibition — §2.32

The Core Part 2 Protection

Each disclosure of Part 2 records must be accompanied by the following notice:

"This record which has been disclosed to you is protected by federal confidentiality rules (42 CFR Part 2). The federal rules prohibit you from making any further disclosure of information in this record that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose (see §2.31). The federal rules restrict any use of the information to investigate or prosecute with regard to a crime any patient with a substance use disorder, except as provided at §§2.12(c)(5) and 2.65."

2024 Amendment Impact on Re-Disclosure

Under the 2024 amendments, when Part 2 records are disclosed pursuant to a §2.33 TPO consent:

• Recipients who are HIPAA covered entities or business associates may further use and disclose the records under HIPAA rules (effectively treating them as HIPAA-protected PHI for TPO purposes)
• The re-disclosure prohibition is relaxed for HIPAA-covered recipients to permit standard HIPAA-authorized TPO activities
• However, Part 2's prohibition on use in civil, criminal, administrative, or legislative proceedings against the patient is preserved (§2.12(d))
• Non-HIPAA-covered recipients remain bound by the traditional re-disclosure prohibition

Court Order Requirements — §2.64, §2.65

Authorizing Disclosures by Court Order

When consent is unavailable or not applicable, a court may issue an order authorizing disclosure only after the court finds "good cause" — meaning that:

1. Other ways of obtaining the information are not available or would not be effective
2. The public interest and need for disclosure outweigh the potential injury to the patient, the physician-patient relationship, and the treatment services