HIPAA is not the strictest federal privacy rule in healthcare. For one category of records, substance use disorder treatment records, Congress built something tighter: 42 CFR Part 2, a regulation older than HIPAA and, in several places, tougher. If your practice treats S.U.D. (Substance Use Disorder) patients, or receives records from a program that does, HIPAA is only half your rulebook.
This article covers who Part 2 actually applies to (fewer providers than assume it, more than know it), where it is stricter than HIPAA, and how the 2024 final rule pulled the two regimes closer together.
42 CFR Part 2 and HIPAA: Who Is Covered by Which
The "Part 2 Program" Test
HIPAA covers essentially every provider that bills electronically. Part 2 is narrower: it applies to "Part 2 programs," meaning federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment, or referral. "Federally assisted" is a broad test in practice; most licensed providers qualify through tax status, DEA registration, or federal program participation.
The operative phrase is "holds itself out." A dedicated addiction treatment clinic, an opioid treatment program, a detox unit: Part 2 programs. A general family practice where a physician sometimes treats SUD alongside everything else typically is not one, because the practice does not hold itself out as an SUD program. That boundary decides your obligations, it is fact-specific, and if your practice sits near it, that is a question worth an hour of qualified advice, not a guess.
One more group is pulled in: anyone who receives Part 2 records. The records carry their restrictions with them, along with a required notice prohibiting redisclosure. A primary care office that receives records from a treatment program cannot simply refile them under ordinary HIPAA rules.
Where Part 2 Is Stricter Than HIPAA
Under HIPAA, treatment, payment, and health care operations run on permitted uses; no patient permission needed. Part 2's default is the opposite: disclosure generally requires the patient's written consent, even for many things HIPAA would wave through. A standard HIPAA release form does not satisfy Part 2's consent content requirements on its own.
Second, law enforcement. Where HIPAA permits various disclosures to law enforcement, Part 2 requires a specific court order, and it prohibits using the records to investigate or prosecute the patient absent that order. This is the provision the rule was built around: people avoid addiction treatment when treatment records can become prosecution evidence.
Third, redisclosure. Part 2 records travel with an explicit prohibition notice, and the recipient is bound by it. HIPAA has no general equivalent; its release forms merely warn that redisclosure may happen.
What the 2024 Final Rule Changed
For decades the two regimes ran on incompatible plumbing, and providers bore the friction. The 2024 final rule, required by the CARES Act, aligned much of it. The headline changes: a patient can now give a single consent covering all future uses and disclosures for treatment, payment, and operations; Part 2 breach notification now follows HIPAA's Breach Notification Rule; enforcement and penalties now align with HIPAA's civil and criminal penalty structure; and SUD counseling notes gained a protection modeled on HIPAA's psychotherapy notes. The rule took effect April 16, 2024, and compliance was required by February 16, 2026, so these are current obligations, not upcoming ones.
What did not change: the court order requirement for law enforcement use, and the basic consent-first architecture. Alignment made the paperwork saner. It did not demote the protection.
What This Means for a Small Practice
Three situations cover most readers. If you are a Part 2 program: you need the Part 2 consent forms, the redisclosure notices, and staff who understand that "HIPAA allows it" is not the end of the analysis; enforcement is real, as the recent Part 2 enforcement action shows. If you receive Part 2 records: segregate or flag them so they are not redisclosed on a routine HIPAA basis. If you are a general practice treating some SUD patients: document the analysis of why you are not a Part 2 program, and still handle SUD information with elevated care under the Privacy Rule and any stricter state law.
---
FAQ
Does 42 CFR Part 2 apply to every provider who treats addiction?
No. It applies to federally assisted programs that hold themselves out as providing SUD diagnosis, treatment, or referral. A general practice treating some SUD patients among others is typically not a Part 2 program, though the analysis is fact-specific.
Is a HIPAA release form enough for substance use records?
Not for Part 2 records. Part 2 has its own written consent requirements. Since the 2024 final rule, a single consent can cover all future treatment, payment, and operations uses, but the consent must meet Part 2's content rules.
Can police get Part 2 records with a subpoena?
No. Part 2 requires a specific court order for law enforcement use, and the records cannot be used to investigate or prosecute the patient without one. This is stricter than HIPAA's law enforcement provisions.
What happens if a Part 2 program has a breach?
Since the 2024 alignment rule, Part 2 breaches follow HIPAA's Breach Notification Rule: assessment, individual notice, HHS notice, and the same clocks.
What should we do with Part 2 records we receive from a treatment program?
Honor the redisclosure prohibition they arrive with. Flag or segregate them so they are not released under a routine HIPAA disclosure, and train records staff on the difference.
Conclusion
Behavioral health and SUD-adjacent practices carry the most layered privacy obligations in outpatient care, and they are exactly who One Guy Consulting built the behavioral health compliance program for. The Full-Scope plan adds four hours of consulting a month for the Part 2 boundary questions. Start with a free 30-minute compliance review. No obligation, no pressure.
Sources
- 42 CFR Part 2 (current text)
- HHS: Confidentiality of Substance Use Disorder (SUD) Patient Records
- 45 CFR Part 164 Subpart E (HIPAA Privacy Rule)
Related Reading