Not every provider treating substance use is a Part 2 program

Part 2 exists for a specific historical reason: Congress concluded that fear of disclosure was deterring people from seeking substance use treatment, and that stronger confidentiality would improve access. That purpose still shapes how the rule is interpreted.

Does it apply to you?

This is the threshold question and the one most often answered wrongly.

Part 2 applies to Part 2 programs: federally assisted programmes that hold themselves out as providing, and do provide, substance use disorder diagnosis, treatment or referral for treatment. Both halves matter — the federal assistance element is broad, and the holding-out element is what distinguishes a specialty programme from a general practice.

The practical consequences of that definition:

• A specialty addiction treatment programme is a Part 2 program.
• A general mental health practice that treats substance use among other things, without holding itself out as a substance use programme, generally is not — its records are protected by HIPAA and state law, not Part 2.
• An identified unit within a larger organisation that holds itself out as providing substance use treatment can be a Part 2 program even where the wider organisation is not.
• A clinician within a general practice who specialises in and advertises substance use treatment may bring themselves within it.

How the protections differ from HIPAA

Historically the differences were substantial: consent was required for essentially every disclosure including treatment, payment and operations; each disclosure generally required its own consent; redisclosure by recipients was prohibited; and the records had unusually strong protection against use in legal proceedings.

That last protection is the one that most distinguishes Part 2 and it substantially remains. Part 2 records generally cannot be used in criminal investigations or proceedings against the patient without a court order meeting specific criteria — a subpoena alone is not sufficient. This is a meaningfully higher bar than HIPAA applies.

What the 2024 rule changed

A final rule implementing CARES Act provisions moved Part 2 substantially toward HIPAA. The main directions of travel:

• Single consent for treatment, payment and operations. A patient may give one prior consent covering all future TPO uses and disclosures, rather than consent per disclosure — the change with the largest day-to-day effect on care coordination.
• Breach notification aligned with HIPAA.
• Penalties aligned with HIPAA, replacing the prior criminal-penalty structure.
• Patient rights expanded, including accounting of disclosures and the ability to request restrictions.
• Redisclosure protections retained, with notice requirements.

Implementation timelines and specific compliance dates for these provisions are worth confirming directly against current HHS guidance rather than relying on a summary — this area has moved more than once, and a page is a poor substitute for the current rule text.

Redisclosure

The provision that catches recipients rather than programmes. Information disclosed under Part 2 generally cannot be redisclosed by the recipient except as permitted, and disclosures must carry a notice to that effect.

The practical consequence for a general practice: if you receive records from a Part 2 program, those records carry restrictions in your hands that your other records do not. Forwarding them to a third party — even one you would ordinarily share with — may not be permitted. The notice accompanying them is not boilerplate.

Segregating records

Organisations that operate a Part 2 program alongside other services face a genuine design problem: Part 2 records need different handling from the rest, in systems generally built to unify records rather than partition them.

Approaches vary from full system separation to access controls and flags within one record. Each has real drawbacks — separation harms care coordination, integration risks improper disclosure. What does not work is treating everything as Part 2 by default, which over-restricts and tends to collapse under operational pressure precisely when it matters.

Practical points

1. Determine your status explicitly, in writing, with counsel. Not by inference.
2. Consent forms must meet Part 2 requirements where it applies; a HIPAA authorisation is not automatically sufficient.
3. Train on subpoenas. The distinction between a subpoena and a qualifying court order is the point at which staff most often disclose something they should not.
4. State law may go further. Several states impose additional confidentiality requirements on substance use and mental health records.

Why this interacts with audits

One consequence worth connecting explicitly. When a records request arrives — see recoupment — the instruction to send exactly what was asked for and no more is not merely prudent for Part 2 programs. Over-disclosure of substance use records can be a violation in its own right, independent of whatever the reviewer was examining.

A practice that habitually sends the full chart in response to requests has a workflow that is merely inefficient for most records and potentially unlawful for these.

What a Part 2 consent has to contain

Where Part 2 applies, consent is more prescriptive than a HIPAA authorisation and the required elements are specific. A Part 2 consent generally identifies the patient; names the programme making the disclosure; names who may receive the information; describes how much and what kind of information may be disclosed; states the purpose of the disclosure; explains the right to revoke and any exceptions to it; specifies an expiry date, event or condition; and carries the patient's signature and date.

Generic release forms rarely satisfy this. A practice operating a Part 2 programme with general-purpose HIPAA authorisations is likely non-compliant even where everyone involved acted in good faith, and it is a straightforward thing to fix in advance and an awkward one to discover during an investigation.

Prescription monitoring and reporting obligations

Part 2 protections interact with other legal obligations in ways that are not always intuitive — state prescription drug monitoring programmes, mandatory reporting duties, and public health reporting each have their own rules, and the interaction is not uniformly resolved in favour of either. Where an obligation to report appears to conflict with Part 2, that is a counsel question rather than one to resolve by judgement in the moment.

Training is the actual control

Part 2 failures are rarely decisions; they are moments. A front-desk staff member confirming an appointment to a caller who says they are a spouse. An administrator responding helpfully to a subpoena. A clinician forwarding records to a referring provider without checking what they carry.

Each of those is a person being helpful under time pressure, and no policy document prevents it. What does is specific, scenario-based training: here is a call you will receive, here is what you say, here is who you escalate to. Programmes that train on scenarios have materially fewer incidents than programmes with better-written policies.

Verified 29 July 2026. Federal rules cited here (HIPAA, 42 CFR Part 2, Medicare billing requirements) are supplemented and sometimes exceeded by state law, which varies substantially; professional licensing boards impose further obligations. Regulatory requirements in this area have changed repeatedly and continue to develop. Primary references: HHS HIPAA; 42 CFR Part 2; CMS billing guidance. This page is general reference, not legal advice. Decisions with compliance consequences warrant healthcare counsel licensed in your jurisdiction.