42 CFR Part 2 2024 Final Rule HIPAA Alignment
The 2024 Final Rule's substantive alignment of Part 2 with HIPAA for TPO consent, breach notification, accounting, civil and criminal enforcement, and a single patient notice.
Primary source
Federal Register Vol. 89, No. 26 (Feb 16, 2024) — Part 2 Final Rule →https://www.federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-sud-patient-records
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
The 2024 Final Rule (89 FR 12472) substantially aligned Part 2 with HIPAA for the first time since the rule's original 1975 promulgation. Published February 16, 2024; effective April 16, 2024; compliance generally required by February 16, 2026.
Major changes:
- Single consent for TPO: a patient may sign a single consent authorizing the program to disclose Part 2 records for all future treatment, payment, and health care operations purposes.
- Breach notification: Part 2 programs are subject to the HIPAA Breach Notification Rule for breaches of Part 2 records.
- Civil and criminal enforcement: HHS may seek HIPAA-equivalent civil money penalties against Part 2 programs for violations.
- Right of accounting: patients may request an accounting of TPO disclosures of Part 2 records made through an EHR.
- Patient Notice: programs must provide a Patient Notice substantially similar to the HIPAA Notice of Privacy Practices.
- Re-disclosure: lawful recipients of Part 2 information may redisclose for TPO under HIPAA rules, with a continuing prohibition on using or disclosing for civil, criminal, administrative, or legislative proceedings against the patient without consent or a 2.61 court order.
The redisclosure prohibition for legal proceedings is the surviving structural difference from HIPAA and continues to require careful workflow handling.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- Regulation42 CFR Part 2: Confidentiality of Substance Use Disorder RecordsHeightened federal confidentiality protections for records held by federally assisted SUD programs, with prior-written-consent and segregation requirements that differ from HIPAA.
- Regulation42 CFR Part 2 Patient Consent (42 CFR 2.31)Required elements for written consent to disclose SUD treatment records under Part 2, including the prohibition on redisclosure notice.
- RegulationHIPAA Breach Notification Rule Overview (45 CFR 164.400-414)When unsecured PHI is accessed, used, or disclosed in a manner not permitted, the entity must follow individual, HHS, and (in some cases) media notification requirements within defined timelines.
- ComplianceBehavioral Health Compliance: 42 CFR Part 2 + HIPAA TogetherHow SAMHSA's 42 CFR Part 2 framework for substance use disorder records overlays HIPAA after the 2024 final rule alignment, and what behavioral health practices must document.
- Glossary42 CFR Part 2 (SUD Records)Federal regulation providing heightened confidentiality protection for substance use disorder treatment records.
- Regulation42 CFR Part 2 Court Order Exception (42 CFR 2.61-2.67)The narrow exception permitting disclosure of Part 2 records pursuant to a court order issued after specific good cause findings.
- Regulation42 CFR Part 2 Medical Emergency Exception (42 CFR 2.51)Permitted disclosures to medical personnel to the extent necessary to meet a bona fide medical emergency posing an immediate threat to the patient's or another's health.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.