42 CFR Part 2 Patient Consent (42 CFR 2.31)
Required elements for written consent to disclose SUD treatment records under Part 2, including the prohibition on redisclosure notice.
Primary source
42 CFR 2.31 — eCFR →https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2/subpart-C/section-2.31
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
42 CFR 2.31 sets the required content for written consent to disclose Part 2 records.
The consent must include: the name(s) of the Part 2 program(s) permitted to disclose; the name(s) or general designation of the person(s) or organization(s) to whom the disclosure may be made; the name of the patient; how much and what kind of information is to be disclosed (including amount and kind); the purpose of disclosure; the patient's signature; the date signed; a statement of revocation right; and a date, event, or condition on which the consent expires.
Each disclosure of Part 2-protected information must be accompanied by a written statement informing the recipient that the information is protected by Part 2, that the recipient is generally prohibited from making any further disclosure unless permitted under Part 2, and that violation can result in criminal penalties.
The 2024 Final Rule allows a single consent to authorize disclosures for all future TPO purposes — a major operational change. Practices subject to Part 2 should refresh consent forms to take advantage of the broader TPO authorization while preserving the redisclosure notice on every outbound transmission.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- Regulation42 CFR Part 2 2024 Final Rule HIPAA AlignmentThe 2024 Final Rule's substantive alignment of Part 2 with HIPAA for TPO consent, breach notification, accounting, civil and criminal enforcement, and a single patient notice.
- Regulation42 CFR Part 2: Confidentiality of Substance Use Disorder RecordsHeightened federal confidentiality protections for records held by federally assisted SUD programs, with prior-written-consent and segregation requirements that differ from HIPAA.
- RegulationHIPAA Authorization Requirements (45 CFR 164.508)Required elements and statements for a valid HIPAA authorization, plus the prohibition on combining authorizations with other documents in most circumstances.
- ComplianceBehavioral Health Compliance: 42 CFR Part 2 + HIPAA TogetherHow SAMHSA's 42 CFR Part 2 framework for substance use disorder records overlays HIPAA after the 2024 final rule alignment, and what behavioral health practices must document.
- Regulation42 CFR Part 2 Medical Emergency Exception (42 CFR 2.51)Permitted disclosures to medical personnel to the extent necessary to meet a bona fide medical emergency posing an immediate threat to the patient's or another's health.
- Glossary42 CFR Part 2 (SUD Records)Federal regulation providing heightened confidentiality protection for substance use disorder treatment records.
- Regulation42 CFR Part 2 Court Order Exception (42 CFR 2.61-2.67)The narrow exception permitting disclosure of Part 2 records pursuant to a court order issued after specific good cause findings.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.