The federal rule that protects addiction treatment records — stricter than HIPAA in key ways. Here's what programs need to know.
42 CFR Part 2 is a federal regulation that protects the confidentiality of substance use disorder (SUD) treatment records held by federally assisted programs. It restricts when and how a program may disclose that a person has sought or received SUD treatment, generally requiring patient consent for disclosures — historically making it stricter than HIPAA in several respects.
Part 2 applies to "Part 2 programs" — federally assisted programs that provide SUD diagnosis, treatment, or referral. Its core purpose is to encourage people to seek treatment without fear that the fact of their treatment will be disclosed, for example to employers or law enforcement. In practice, records identifying someone as a SUD patient generally cannot be released without the patient's written consent, with limited exceptions such as medical emergencies.
Both protect health information, but Part 2 has historically been more restrictive for SUD records — particularly around consent and re-disclosure. A 2024 federal final rule aligned Part 2 more closely with HIPAA, including allowing a single patient consent to cover future uses and disclosures for treatment, payment, and health care operations. Programs should confirm their current consent forms, notices, and policies reflect the latest requirements.
| What it is | A federal confidentiality rule for SUD treatment records |
|---|---|
| Who it applies to | Federally assisted SUD programs ("Part 2 programs") |
| Core requirement | Patient consent generally required to disclose SUD treatment records |
| vs. HIPAA | Historically stricter; a 2024 rule aligned it more closely with HIPAA |
42 CFR Part 2 is a federal regulation that protects the confidentiality of substance use disorder treatment records held by federally assisted programs. It restricts disclosure of the fact that a person has sought or received SUD treatment, generally requiring patient consent.
Both protect health information, but Part 2 has historically been more restrictive for SUD records, especially around consent and re-disclosure. A 2024 federal final rule aligned Part 2 more closely with HIPAA, including allowing a single consent for future treatment, payment, and operations disclosures.
Part 2 applies to federally assisted programs that provide substance use disorder diagnosis, treatment, or referral for treatment — often called Part 2 programs.
Generally yes. Records identifying someone as an SUD patient typically cannot be disclosed without the patient's written consent, with limited exceptions such as medical emergencies. Recent rule changes have updated how consent can be structured.
DHCS licensing vs. certification, explained.
The full sequence from level of care to opening.
How to get in-network and reimbursed.
Level Up Compliance guides behavioral health founders through every step — licensing, accreditation, contracting, and operations.