42 CFR Part 2 is a federal confidentiality rule that gives special protection to records identifying a person as having received substance use disorder diagnosis, treatment, or referral services from a federally assisted Part 2 program. Its purpose is to reduce the risk that fear of stigma, discrimination, or legal consequences will keep people from seeking addiction treatment.
Part 2 works alongside HIPAA. The two rules overlap in many treatment settings, but Part 2 adds specific protections for substance use disorder records and places special limits on how those records can be used or disclosed.
Who does 42 CFR Part 2 apply to?
Part 2 applies to federally assisted programs that provide substance use disorder diagnosis, treatment, or referral for treatment. HHS calls these Part 2 programs. Certain requirements can also follow the records when they are received by other health care providers, HIPAA covered entities, business associates, qualified service organizations, intermediaries, or investigative agencies.
What kinds of records does Part 2 protect?
Part 2 protects records that identify a person as having or having had a substance use disorder and that are created or maintained by a covered Part 2 program in connection with SUD services. Depending on the record, this can include information about identity, diagnosis, prognosis, treatment, medications, attendance, or referral.
The rule is important because even confirming that someone is a patient at an addiction treatment program can disclose sensitive SUD information.
How is Part 2 different from HIPAA?
HIPAA protects a broad range of protected health information held by covered health plans, health care providers, and their business associates. Part 2 is narrower in subject matter but provides additional protections specifically for qualifying substance use disorder records.
In 2024, HHS issued a final rule aligning important parts of Part 2 more closely with HIPAA. The rule became effective April 16, 2024, and HHS required compliance by February 16, 2026. Among other changes, the rule allows a single patient consent for future treatment, payment, and health care operations uses and disclosures in certain circumstances while retaining special protections against use of Part 2 records in legal proceedings against a patient.
Does Part 2 mean my addiction records can never be shared?
No. Part 2 does not create an absolute ban on disclosure. Records may be used or disclosed when the patient gives a valid consent and in other circumstances specifically permitted by the regulation, such as certain medical emergencies, audits and evaluations, court-authorized disclosures, or qualifying treatment, payment, and health care operations uses after appropriate consent.
The exact rules depend on who holds the record, why the disclosure is being made, and whether the 2024 Part 2 requirements are satisfied.
Can addiction treatment records be used against me in court?
Part 2 places strong restrictions on using or disclosing protected SUD records in civil, criminal, administrative, or legislative proceedings against a patient. HHS explains that the 2024 final rule strengthened these protections and generally requires patient consent or a specific court order that meets Part 2 requirements before protected records may be used in such proceedings.
Can I authorize family members or another provider to receive records?
Yes. A patient can generally authorize disclosure by signing an appropriate consent or release. The consent should make clear who may receive information and what type of disclosure is permitted.
For a practical explanation of authorizations, see Trinity Behavioral Health’s guide to release of information forms in rehab.
Does Part 2 protect records from my employer?
Part 2 can restrict a treatment program from disclosing protected SUD information to an employer without a permitted basis. Separate employment laws may also protect medical information once an employer receives it. However, Part 2 does not mean an employee never has to provide limited medical documentation for leave, disability, or accommodation requests.
Can I access my own Part 2 records?
Part 2 does not prevent patients from accessing their own records. HIPAA-covered providers generally must also give patients access to information in their designated record set, subject to limited exceptions. Treatment programs can explain how to request copies after discharge.
What should patients ask before signing a release?
- Who will receive the information?
- What records or categories of information will be shared?
- Why is the disclosure needed?
- How long will the consent remain valid?
- Can the consent be revoked, and what happens to information already disclosed?
- Could the recipient redisclose the information under current Part 2 and HIPAA rules?
Frequently asked questions
Is 42 CFR Part 2 the same as HIPAA?
No. They are separate federal privacy frameworks. Many addiction treatment records can be protected by both.
Does Part 2 apply to every mention of substance use in a medical chart?
Not automatically. Part 2 applies to records created or maintained by qualifying federally assisted SUD programs and to certain recipients of those records.
Can I revoke a Part 2 consent?
Patients can generally revoke consent going forward, subject to the rule and actions already taken in reliance on the consent.
Who enforces Part 2?
HHS Office for Civil Rights is responsible for civil enforcement of Part 2 under the updated federal framework.
Authoritative sources
- HHS: Understanding Confidentiality of Substance Use Disorder Patient Records
- HHS: 42 CFR Part 2 Final Rule Fact Sheet
- Electronic Code of Federal Regulations: 42 CFR Part 2
This article provides general privacy information, not legal advice. For Trinity Behavioral Health, current privacy and authorization procedures should be confirmed with the treatment team or privacy contact for the specific situation.