42 CFR Part 2 after the 2024 final rule: what changed in practice

For almost fifty years, substance use disorder records lived under a stricter regime than the rest of the chart. The 2024 final rule, required by section 3221 of the CARES Act, pulled 42 CFR Part 2 much closer to HIPAA. Programs had until February 16, 2026 to comply. It is now enforced by the HHS Office for Civil Rights.

Much of the commentary on the rule focused on what got easier. That is real — care coordination is less painful than it was. But the rule also added obligations, and it preserved the protections that matter most to patients. Here is what changed, what did not, and what a documentation workflow needs to handle now.

Who Part 2 applies to#

Part 2 applies to federally assisted programs that hold themselves out as providing SUD diagnosis, treatment or referral for treatment — and to anyone who receives Part 2 records from them. A general medical practice that happens to treat a patient's alcohol use disorder is usually not a Part 2 program. A specialty SUD clinic, an opioid treatment program, or an identified SUD unit inside a larger organization usually is. Many CCBHCs and CMHCs run at least one Part 2 program alongside services that are not.

What changed#

One consent for treatment, payment and health care operations

A patient can now sign a single consent for all future uses and disclosures for treatment, payment and health care operations (TPO). Before, programs typically needed a consent that named each recipient. Recipients that are HIPAA covered entities or business associates may then redisclose the records as HIPAA permits — with one major exception covered below.

SUD counseling notes

The rule creates a new category, SUD counseling notes, modeled on HIPAA psychotherapy notes: a clinician's notes analyzing the conversation in a counseling session, kept separate from the rest of the record. They require their own consent and cannot be bundled into the TPO consent. If your clinicians keep process notes, they need a place to keep them that is genuinely separate.

Breach notification and penalties

HIPAA's breach notification requirements now apply to Part 2 records, and violations are subject to HIPAA's civil and criminal penalty structure. Patients can file complaints with HHS. Enforcement moved from the U.S. Attorney's offices to OCR. In practice, this means Part 2 programs should expect the same audit posture they already know from HIPAA.

Notices on every disclosure

Each disclosure made with patient consent must be accompanied by a copy of the consent or a clear explanation of its scope, plus the required notice prohibiting redisclosure. The rule permits an abbreviated notice — "42 CFR part 2 prohibits unauthorized use or disclosure of these records." — which is short enough to fit into electronic exchange fields.

Notice of Privacy Practices

Part 2 programs must provide a patient notice that aligns with the HIPAA Notice of Privacy Practices, and covered entities that receive Part 2 records needed to update their NPPs by the same February 16, 2026 date.

What did not change#

The core protection survived, and in some ways got sharper. Part 2 records — and testimony about their contents — cannot be used or disclosed in civil, criminal, administrative or legislative proceedings against the patient without the patient's specific written consent or a court order that meets Part 2's standards, accompanied by a subpoena. That limit follows the records even after a HIPAA entity receives them under a TPO consent.

• Consent is still required for most disclosures outside of the narrow exceptions (medical emergencies, research, audits and evaluations, qualified service organizations).
• Patients can still revoke consent in writing, and revocation must be honored going forward.
• Programs must still segment what the consent permits from what it does not. 'Segmentation not required' applies only to TPO recipients who receive records under a valid TPO consent.
• State law may be stricter, and when it is, it still governs.

Where documentation workflows break#

In most organizations, the problems are rarely about knowing the rule. They are about where records go once they exist. Four failure points come up again and again:

AI scribes and Part 2#

An ambient documentation vendor that processes Part 2 records on a program's behalf is typically acting as a qualified service organization as well as a HIPAA business associate. That means two things in writing: a BAA and a qualified service organization agreement (QSOA) in which the vendor agrees to be bound by Part 2 and to resist judicial efforts to obtain records except as Part 2 permits.

It also means the vendor's own architecture has to respect the rule. Questions worth asking any vendor, including us:

• Can Part 2 status be set per program, per location or per client, and does the flag follow the note into the EHR?
• Are SUD counseling notes stored separately with their own access controls and consent?
• Does every export and EHR push carry the redisclosure notice automatically?
• Is audio retained? Is the transcript? For how long, and who decides?
• Is any customer data used to train models? (Ours: never.)
• Is there a disclosure log your compliance team can query?

How Margent handles it#

Part 2 is a first-class setting in your note rules: a program, a location or an individual client can carry the flag. When it is on, Margent captures Part 2 consent on the session before recording and writes consent and changes to an append-only audit log. Attaching the abbreviated notice to every export and keeping an accounting of disclosures are next on our roadmap. We sign a BAA and a QSOA before any client information is processed, live audio isn't stored by Margent, and Margent doesn't train models on customer data.