42 CFR Part 2: A Compliance Guide for HealthTech Vendors Handling SUD Records

Short answer: 42 CFR Part 2 is the federal rule that protects the confidentiality of substance use disorder (SUD) treatment records from federally assisted programs. A February 2024 HHS final rule aligned it more closely with HIPAA, adding a single consent for treatment, payment and health care operations, HIPAA breach notification and HIPAA-style penalties. Compliance was required by February 16, 2026.

Related guides:

• HIPAA permitted uses and disclosures
• What is considered PHI under HIPAA?
• HIPAA for HealthTech: a complete guide to compliance

Key takeaways

• Part 2 sits on top of HIPAA, not instead of it. SUD records from a Part 2 program carry extra restrictions that follow the data to many recipients, including vendors.
• The 2024 final rule narrowed the gap. One patient consent can now cover all future treatment, payment and health care operations (TPO) uses, and HIPAA recipients can generally redisclose under HIPAA rules.
• Some protections stayed stricter than HIPAA. Records still cannot be used in legal proceedings against the patient without specific consent or a court order, and SUD counseling notes need their own consent.
• The deadline has passed. As of October 2026, compliance has been required since February 16, 2026, and the HHS Office for Civil Rights (OCR) enforces Part 2.
• Vendors are in scope. The final rule expressly treats business associates as qualified service organizations where they meet the business associate definition, so your BAA alone may not be the whole story.

What is 42 CFR Part 2?

42 CFR Part 2 is the federal regulation, titled "Confidentiality of Substance Use Disorder Patient Records," that limits how SUD treatment records can be used and disclosed. According to HHS, Part 2 programs generally cannot share information that would identify someone as having, or having had, an SUD unless Part 2 permits it.

For a HealthTech team, the practical point is simple. If your platform stores, routes or analyzes data from an SUD treatment program, you may hold records with obligations HIPAA alone does not impose. Whether HIPAA itself applies is covered in who HIPAA applies to. This post focuses on the extra Part 2 layer.

Which programs and records does Part 2 cover?

Part 2 covers records of federally assisted programs that provide SUD diagnosis, treatment or referral for treatment, and it reaches many organizations that later receive those records. HHS describes the scope this way: Part 2 rules "apply to any federally assisted program that provides SUD diagnosis, treatment, or referral for treatment," known as Part 2 programs (HHS Part 2 overview). The exact tests for "program" and "federally assisted" are set out in 42 CFR 2.11 and 2.12, and a covered entity's legal team should confirm them program by program.

The same HHS page explains that some requirements also apply to recipients of Part 2 records, including:

• Health care providers that receive Part 2 records
• Qualified service organizations (QSOs), meaning outside organizations that provide services to a Part 2 program
• HIPAA covered entities and business associates
• Intermediaries
• Investigative agencies

In our experience, the platforms most likely to touch Part 2 records are EHRs and practice management tools for SUD treatment programs, behavioral health and telehealth platforms, care coordination tools, and billing vendors. A general-purpose SaaS tool can also be in scope if a Part 2 program puts SUD records into it. Because coverage depends on where a record came from, data provenance matters in the vendor steps below.

What did the 2024 Part 2 final rule change?

The 2024 final rule, published in the Federal Register on February 16, 2024 at 89 FR 12472, aligned Part 2 with HIPAA while keeping its core protections. HHS issued it through OCR and the Substance Abuse and Mental Health Services Administration (SAMHSA), and it took effect on April 16, 2024.

The main changes, as summarized in the HHS final rule fact sheet:

Area	What the final rule did
Consent for TPO	A patient may give a single consent for all future uses and disclosures for treatment, payment and health care operations
Redisclosure	Covered entities and business associates that receive records under that consent may redisclose them as HIPAA permits
Legal proceedings	Records and testimony still cannot be used in civil, criminal, administrative or legislative proceedings against the patient without specific consent or a court order
SUD counseling notes	A new category of notes kept separately by an SUD clinician, which need separate consent, similar to HIPAA psychotherapy notes
Breach notification	HIPAA Breach Notification Rule requirements now apply to breaches of Part 2 records
Penalties	Part 2's criminal penalties were replaced with the civil and criminal enforcement authorities that apply to HIPAA violations
Complaints	Patients may file complaints about Part 2 violations directly with the HHS Secretary
Patient notice	The Part 2 Patient Notice was aligned with the HIPAA Notice of Privacy Practices
Segregation	Segregating or segmenting Part 2 records is not required

Two details from the Federal Register preamble matter for vendors. First, each disclosure made with written consent must be accompanied by a copy of the consent or a clear explanation of its scope. Second, patients gained a right to a list of disclosures made by an intermediary for the past three years, which matters if your product brokers records between organizations.

When did Part 2 compliance become mandatory?

Compliance became mandatory on February 16, 2026. The Federal Register notice states that persons subject to the regulation "must comply with the applicable requirements of this final rule by February 16, 2026" (89 FR 12472).

Several related milestones, all from HHS:

1. December 2, 2022: the proposed rule was published.
2. April 16, 2024: the final rule took effect.
3. August 25, 2025: the HHS Secretary delegated Part 2 administration and enforcement authority to the OCR Director.
4. February 16, 2026: compliance was required, and anyone can file a Part 2 complaint from that date.

The same date applied to notices. HHS's model notices page says that as of February 16, 2026, HIPAA covered entities must include information about SUD patient records in their Notices of Privacy Practices, and federally assisted SUD treatment programs must provide a new patient notice. If your product generates or hosts patient notices for customers, check that your templates were updated.

How is Part 2 different from HIPAA?

Part 2 is narrower than HIPAA in what it covers but stricter in how covered records can be used, especially around consent and legal proceedings. HIPAA lets a covered entity use and disclose PHI for its own treatment, payment and health care operations, and obtaining consent for those purposes is optional (HHS Privacy Rule summary). Part 2 still starts from written patient consent.

Topic	HIPAA	42 CFR Part 2 (after the 2024 rule)
What it protects	PHI held by covered entities and business associates	SUD records from federally assisted Part 2 programs, and those records in the hands of recipients
TPO uses	Permitted without consent; consent is optional	Requires written patient consent, though one consent can cover all future TPO uses
Legal proceedings against the patient	Governed by HIPAA's disclosure rules	Barred without specific consent or a court order, and that consent cannot be combined with other consents
Special notes	Psychotherapy notes	SUD counseling notes, which need separate consent
Breach notification	HIPAA Breach Notification Rule	HIPAA Breach Notification Rule requirements apply
Penalties and enforcement	HIPAA civil and criminal enforcement, by OCR	The same HIPAA civil and criminal enforcement authorities, by OCR
Complaints	Filed with OCR	Filed with the HHS Secretary through OCR, and may also be filed with the program

Sources: HHS fact sheet, HHS Part 2 overview, 89 FR 12472.

The legal proceedings rule surprises many teams: even after records move into a HIPAA environment under a TPO consent, they cannot be used against the patient without specific consent or a court order. Reflect that in how you handle subpoenas for customer data.

What must a HealthTech vendor do to support Part 2 compliance?

A vendor handling Part 2 records needs to know where they are, contract for them correctly, enforce consent rules in the product and plan for breaches. The final rule expressly includes business associates as QSOs where they meet the business associate definition, so a typical HealthTech vendor should expect Part 2 terms alongside its BAA.

1. Map where Part 2 records live. Ask customers whether they operate a Part 2 program, tag those tenants and data sources, and record which services, backups, logs and analytics pipelines receive the data.
2. Update contracts. Review your business associate agreement and add Part 2 language, often as a QSO agreement or addendum, covering permitted uses, safeguards, redisclosure limits and resistance to legal process. Have counsel confirm the structure.
3. Make consent visible in the data. Store the type and scope of each patient consent (TPO, specific recipient, SUD counseling notes, legal proceedings) with the record, so your product can block disclosures a consent does not cover.
4. Label outgoing disclosures. The final rule requires consented disclosures to be accompanied by a copy of the consent or a clear explanation of its scope, and HHS guidance notes a statement that Part 2 prohibits unauthorized use or disclosure. Build this into exports, APIs and record-sharing features.
5. Treat SUD counseling notes separately. Keep them in a distinct record type with stricter access and no inclusion in broad TPO exports.
6. Secure the records. The final rule keeps the requirement that Part 2 programs and lawful holders have policies and procedures to secure records. Apply your HIPAA Security Rule controls, such as access control, encryption and audit logging, and document that they cover Part 2 data.
7. Route legal requests to counsel. Flag any subpoena, warrant or law enforcement request touching Part 2 tenants, because use against the patient requires specific consent or a court order.
8. Prepare breach response. HIPAA breach notification requirements now apply to Part 2 records. Make sure your incident runbook and BAA notice terms cover them; see our HIPAA Breach Notification Rule guide.

If you act as an intermediary, for example a health information exchange or care coordination platform, plan for patients' right to a three-year list of your disclosures.

Which Part 2 mistakes do vendors make most often?

The most common mistake is assuming the BAA already covers everything, when Part 2 adds consent, notice and legal-proceeding rules a BAA usually does not address. In our experience, other frequent gaps include:

• No tenant-level flag. The vendor cannot say which customers are Part 2 programs or which data is in scope.
• Consent stored as a PDF only. A scanned consent form that the product cannot read cannot stop a disclosure outside its scope.
• Analytics and AI pipelines skipped. Part 2 data copied into a warehouse or model training set without checking whether the consent and contract permit it.
• Over-segmenting. Building complex data segregation because teams assume it is mandatory, when HHS says segregation is not required. Tagging and access rules are usually enough.

How SecureSlate helps

SecureSlate helps HealthTech vendors run Part 2 compliance as part of their existing HIPAA program instead of a separate spreadsheet. HIPAA is built in, with multi-framework control mapping to SOC 2, ISO 27001 and HITRUST, and 42 CFR Part 2 can be set up as a custom framework with custom controls such as tenant tagging, consent enforcement, disclosure notices and legal-request escalation. Agentless read-only cloud integrations and the device agent collect evidence for the security controls that protect Part 2 data, and access reviews show who can reach it. Vendor risk management tracks the subprocessors that touch Part 2 records, risk management records Part 2 risks, and audit management keeps evidence ready for customer reviews. The trust center and security questionnaire automation help you answer buyers' Part 2 questions consistently.

Start your free SecureSlate trial

FAQ

Does 42 CFR Part 2 apply to my SaaS company?

It can. Part 2 restrictions follow records from a Part 2 program to recipients, including qualified service organizations and business associates. If a customer is a federally assisted SUD program and puts its records in your product, expect Part 2 obligations.

Is a BAA enough for Part 2 compliance?

Usually not on its own. Part 2 adds consent, disclosure notice and legal-proceeding rules that a standard BAA may not cover, so have counsel review your agreements.

What is the 42 CFR Part 2 final rule compliance date?

February 16, 2026. The final rule took effect on April 16, 2024, and regulated persons had until February 16, 2026 to comply with its requirements.

Do Part 2 records have to be stored separately from other PHI?

No. HHS states that segregating or segmenting Part 2 records is not required. You still need to identify them so consent limits can be enforced.

Who enforces Part 2 and what are the penalties?

OCR enforces Part 2. The 2024 rule replaced Part 2's criminal penalties with the civil and criminal enforcement authorities that apply to HIPAA violations, using the HIPAA Enforcement Rule process.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.