HIPAA vs 42 CFR Part 2
HIPAA is the general federal privacy baseline for all PHI. 42 CFR Part 2 is the stricter rule governing substance use disorder treatment records held by federally-assisted SUD programs.
Last reviewed May 24, 2026
Side by side
HIPAA
General federal privacy and security baseline for protected health information held by covered entities and business associates.
45 CFR Parts 160 & 164- Treatment, payment, and operations (TPO) disclosures permitted without authorization.
- Patient authorization required for most other disclosures.
42 CFR Part 2
Confidentiality of Substance Use Disorder Patient Records — governs records of patients who receive SUD diagnosis, treatment, or referral at a federally-assisted Part 2 program.
42 CFR Part 2- Stricter than HIPAA for the records it covers.
- 2024 final rule aligned Part 2 closer to HIPAA for TPO uses, but disclosure restrictions remain.
- Records cannot be used in criminal proceedings against the patient without a court order.
When to use HIPAA
- General medical practice handling PHI — HIPAA is the applicable rule.
When to use 42 CFR Part 2
- A federally-assisted methadone clinic, OUD treatment program, or SUD-specific provider — Part 2 applies in addition to HIPAA.
- Handling SUD treatment records received from a Part 2 program — re-disclosure restrictions follow the record.
Common mistakes
- Assuming HIPAA authorization is sufficient for SUD records — Part 2 requires a more specific consent and re-disclosure notice.
- Forgetting the 2024 Final Rule changes (alignment with HIPAA for TPO with a single consent).
- Applying Part 2 to a general practice that is not federally-assisted for SUD treatment.
Sources
- SAMHSA — 42 CFR Part 2 Fact Sheethttps://www.samhsa.gov/about/laws-regulations/confidentiality-regulations-42-cfr-part-2
- HHS — 42 CFR Part 2 Final Rule (2024)https://www.federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-sud-patient-records
Related
Track SUD record handling in the SRA readiness check
Open sra studio →D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
This comparison is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at CMS, HHS, OCR, eCFR, NIST, and the relevant payer or state regulator. Last reviewed May 24, 2026.