42 CFR Part 2: Confidentiality of Substance Use Disorder Records
Heightened federal confidentiality protections for records held by federally assisted SUD programs, with prior-written-consent and segregation requirements that differ from HIPAA.
Primary source
42 CFR Part 2 — eCFR →https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
42 CFR Part 2 sets heightened federal confidentiality protections for substance use disorder (SUD) treatment records held by "Part 2 programs" — programs that are federally assisted and hold themselves out as providing SUD diagnosis, treatment, or referral for treatment.
Core posture: a record's existence cannot be disclosed (much less the contents) without prior written consent, unless a narrow exception applies — medical emergency, certain audit/evaluation activity, research, court order with good cause shown, or a qualified service organization arrangement.
Part 2 is administered by SAMHSA (not OCR) and predates HIPAA. Historically the consent requirements have been stricter than HIPAA's Privacy Rule, complicating record exchange between SUD providers and the broader health system.
The 2024 Final Rule (published February 16, 2024; effective April 16, 2024; compliance generally required by February 16, 2026) substantially aligned Part 2 with HIPAA: a single patient consent can support all future TPO uses and disclosures (rather than requiring separate consents per disclosure); breach notification mirrors HIPAA; and patient rights to an accounting expand. The rule does not eliminate the segregation requirement: re-disclosure restrictions still travel with Part 2 records.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- Regulation42 CFR Part 2 2024 Final Rule HIPAA AlignmentThe 2024 Final Rule's substantive alignment of Part 2 with HIPAA for TPO consent, breach notification, accounting, civil and criminal enforcement, and a single patient notice.
- Regulation42 CFR Part 2 Patient Consent (42 CFR 2.31)Required elements for written consent to disclose SUD treatment records under Part 2, including the prohibition on redisclosure notice.
- RegulationHIPAA Privacy Rule: General Rules for Uses and Disclosures (45 CFR 164.502)The general rules covered entities follow for any use or disclosure of protected health information, including the minimum necessary standard and treatment, payment, and operations exceptions.
- Glossary42 CFR Part 2 (SUD Records)Federal regulation providing heightened confidentiality protection for substance use disorder treatment records.
- ComplianceBehavioral Health Compliance: 42 CFR Part 2 + HIPAA TogetherHow SAMHSA's 42 CFR Part 2 framework for substance use disorder records overlays HIPAA after the 2024 final rule alignment, and what behavioral health practices must document.
- SRAHIPAA Risk Analysis for a Mental Health PracticeWhat therapists, psychologists, and psychiatry practices need in a HIPAA Security Risk Analysis, including the psychotherapy notes carve-out at 45 CFR 164.501 and 164.508(a)(2).
- ComplianceBreach Risk Assessment: The 4-Factor Analysis Required by 45 CFR 164.402After a possible PHI incident, the four-factor breach risk assessment at 45 CFR 164.402 determines whether you notify. Do it in writing, do it on the record.
- CompliancePsychiatry Compliance: Controlled Substances + 42 CFR Part 2 + TelepsychiatryDEA controlled-substance prescribing, 42 CFR Part 2 SUD confidentiality, the DEA/HHS fourth temporary telemedicine extension through December 31, 2026, and the documentation surveyors actually sample first.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.