⚖️ 42 CFR Part 2 Guide
What Does 42 CFR Part 2 Require From Your Systems?
The hardest part of changing IT providers is not choosing the new one. It is getting your own systems back from the old one. Here is the full handover list, in writing, before you give notice.
- The compliance date was 16 February 2026 — this is now an enforced standard, not a future one
- A single consent can now cover treatment, payment and health care operations, replacing the old per-disclosure model
- Record segregation is no longer required — older guidance saying otherwise is out of date
- Breach notification now follows the same path as the rest of your protected records
- Enforcement now runs on civil penalties aligned with the general privacy rules, replacing Part 2’s old criminal-only exposure
Free IT Assessment
No obligation. We evaluate your environment and deliver a clear action plan within 24 hours.
Thanks — you’re in good hands.
A local team member will reach out within 1 business hour.
20+Years in Business
8minAvg. Response Time
99.9%Uptime Guarantee
0hrsContracted Downtime
#36MSP 501 Nationally
#4MSP in California
Part 2 Basics
What Does 42 CFR Part 2 Require From Your Systems?
Part 2 is a federal confidentiality rule for substance use disorder treatment records held by federally assisted programs. It sits on top of the general privacy rules, and for years it worked very differently from them. The 2024 final rule closed much of that gap without removing the extra protection.
- It applies to Part 2 programs — federally assisted providers whose primary function is SUD diagnosis, treatment or referral — and to anyone who lawfully receives those records.
- It protects the fact of treatment itself, not only the clinical detail. Confirming that someone is a patient can be a disclosure.
- Consent is now one written consent capable of covering treatment, payment and operations, rather than a fresh consent per disclosure.
- Once lawfully redisclosed under that consent, records may generally be handled under the same standards as the rest of the record set.
- The practical work is mostly in your systems: knowing where the records are, who can reach them, and what your logs can prove.
16 Feb 2026
The compliance date — already in force, not approaching
Which Records Part 2 Actually Covers
Scope is where most organisations get this wrong, in both directions. Over-applying it blocks legitimate care; under-applying it is a violation.
Federally Assisted Programs
The rule reaches providers who are federally assisted and whose primary function is SUD diagnosis, treatment or referral. Federal assistance is broader than direct funding.
The Fact of Treatment
Part 2 protects the existence of the patient relationship, not just the clinical notes. A confirmation to a caller can itself be a disclosure.
Records You Receive
If you lawfully receive Part 2 records from a covered program, the obligations travel with the records into your systems.
General Medical Providers
A hospital or practice is not automatically a Part 2 program. It becomes entangled when it holds an identified SUD unit or receives Part 2 records.
Counselling Notes and Messaging
Secure messaging, telehealth recordings and care-coordination notes can all carry Part 2 content without anyone labelling them.
Billing and Claims Data
Claims describing SUD treatment are records too. Billing systems and clearinghouses are commonly overlooked.
Registries and Referrals
Referral lists, intake logs and bed-availability registries frequently identify patients by name against a Part 2 service.
Vendor and Cloud Copies
Backups, analytics extracts and EHR vendor environments hold the same records under someone else’s control.
What It Does Not Cover
Records held outside a Part 2 program and never received from one are governed by the general rules instead — the distinction is worth documenting.
What Changed When the Final Rule Landed
The final rule was issued on 16 February 2024, took effect on 16 April 2024, and became enforceable after a two-year implementation period on 16 February 2026.
01
Single Consent
One written consent can now cover treatment, payment and health care operations, replacing a model that required consent for each disclosure.
02
Redisclosure Permitted
Records disclosed under that consent may generally be redisclosed under the standards applying to the rest of the record, rather than being frozen behind Part 2 forever.
03
Segregation Dropped
Recipients are no longer required to segregate Part 2 records from the rest of the chart. This reverses years of guidance and a great deal of system design.
04
Breach Rules Aligned
The general breach notification obligations now apply, so a Part 2 incident is reported through the same channel as any other.
05
Patient Rights Extended
Patients gained accounting-of-disclosure and complaint rights closer to those they already had elsewhere.
06
Penalties Realigned
Part 2’s criminal-only penalty structure was replaced with the civil and criminal enforcement authorities that apply to the rest of your protected records. Confirm current penalty tiers with counsel before budgeting against them.
Where Part 2 Records Live in a Real Environment
Compliance work is mostly discovery. These are the places we find covered records during an assessment.
EHR Modules
Behavioural health modules and flags
Email & Messaging
Referrals and coordination threads
Backups
Snapshots predating any policy change
Call Recordings
Intake and triage lines
Reporting Extracts
BI exports and spreadsheets
Scan & Fax Shares
Network folders nobody owns
Shared Drives
Case files kept outside the EHR
Vendor Tenants
Billing and clearinghouse systems
Mobile Devices
Clinician phones and tablets
Test Environments
Production copies used for training
Segregation Is No Longer the Answer
If your systems were designed around keeping these records apart, that design is now solving a problem the rule stopped asking you to solve.
1
Stop Building Walls
Recipients no longer have to hold Part 2 records separately. Segregation that exists purely for compliance can often be retired — deliberately, and with the rationale written down.
2
Start Building Records
What replaces segregation is evidence: consent captured properly, access controlled by role, and disclosures logged in a form you can produce on request.
3
Fix Consent Capture First
A single consent is only useful if it is scoped correctly and retrievable. Paper consents in a filing cabinet do not support an electronic disclosure trail.
4
Know Your Access Lists
Role-based access to the modules holding these records is the control auditors ask about first, and the one most often stale.
5
Extend It to Vendors
Every vendor holding a copy needs the same expectations in writing. Backups and analytics extracts are the usual gaps.
6
Keep the Old Guidance Out
Plenty of published material still describes the pre-2024 segregation requirement. Check the date on anything you are working from, including internal policy.
Part 2 Questions, Answered
What organisations ask most often once they realise the rule reaches their systems.
Does 42 CFR Part 2 apply to our practice if we are not an addiction treatment centre?
Possibly. The rule reaches federally assisted programs whose primary function is substance use disorder diagnosis, treatment or referral, and it also follows the records into any organisation that lawfully receives them. A general medical practice is not automatically covered, but one holding an identified SUD service line, or receiving records from a Part 2 program, can be. The scope question is worth answering in writing rather than assuming either way.
Do we still have to keep these records separate from the rest of the chart?
No. The 2024 final rule removed the segregation requirement for recipients, and that is one of the most significant practical changes it made. A great deal of published guidance and internal policy still says otherwise, so check the date on anything you are working from. If your systems were built around segregation, retiring it is a deliberate project with its own documentation, not something to do quietly.
What does the single consent actually let us do?
One properly scoped written consent can now cover disclosures for treatment, payment and health care operations, rather than requiring a separate consent for each disclosure. That is a substantial reduction in administrative friction. The consent still has to be specific enough to be meaningful, and it has to be retrievable — a consent you cannot produce is very close to a consent you do not have.
How is a breach handled differently now?
It largely is not, and that is the point of the change. Breach notification for Part 2 records now follows the same obligations as the rest of your protected records, so incidents move through one process rather than two. Practically, that means your existing incident response plan should cover these records explicitly rather than treating them as a special case bolted on afterwards.
How is Part 2 enforced now?
The final rule replaced Part 2’s criminal-only penalty structure with the same civil and criminal enforcement authorities that apply to the rest of your protected records. In practice that means enforcement looks like it does elsewhere in health privacy rather than being a separate regime, and it is a meaningful escalation from where Part 2 sat before. Current penalty tiers are adjusted periodically, so confirm the live figures with counsel rather than working from a number you read once.
Where do we start?
With discovery, not policy. Find where covered records physically live — the EHR module, email, backups, reporting extracts, vendor tenants — because you cannot control access to systems you have not listed. Once the inventory exists, consent capture and role-based access are the two controls that carry the most weight, and both are easier to evidence than to argue about.
Keep reading: Healthcare Compliance Consulting · IT Services for Healthcare Organizations · Healthcare Cybersecurity · Healthcare Backup & Disaster Recovery · Microsoft 365 for Healthcare
Get Started Today
Find Out Where Your Records Actually Live
We will map the systems holding covered records across your environment — the EHR, email, backups, reporting extracts and vendor tenants — and show you where access and evidence are thinner than your policy assumes.