42 CFR Part 2: the federal rule that guards addiction records, in plain language.
Part 2 is the reason a treatment program cannot confirm you are a patient, cannot hand your record to a court without a special order, and generally cannot share it at all without your signature. Here is what it covers, what it does not, and what changed in 2024.
Authored by the MLJ Clinical Team. Reviewed under board-certified psychiatric oversight. Last updated September 2026.
Key Takeaways- Part 2 applies to federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment, or referral; most licensed programs qualify.
- It protects the record and the fact of being a patient: a program known for addiction treatment may not confirm you are there without your written consent.
- Disclosure generally requires a written consent with specific required elements, and anyone who receives the record is bound by a redisclosure limit.
- Your record cannot be used in criminal, civil, or administrative proceedings against you without your consent or a court order that meets Part 2's own standards.
- The 2024 final rule, fully in force since February 2026, lets you sign one consent for treatment, payment, and operations, and aligns breach notification and enforcement with HIPAA.
Who Part 2 applies to.
The rule's full name is Confidentiality of Substance Use Disorder Patient Records, and it lives at Title 42, Part 2 of the Code of Federal Regulations. It was written in the 1970s on a simple premise: if people believed that entering treatment would create a record that could cost them a job, a custody case, or a criminal defense, they would not enter treatment. The regulation exists to make that record harder to reach than any other kind of medical file.
Part 2 covers what the rule calls a "Part 2 program." Two tests have to be met. First, the program must hold itself out as providing substance use disorder diagnosis, treatment, or referral for treatment; a general hospital does not qualify simply because a patient there happens to have an alcohol problem, but a residential addiction program plainly does. Second, the program must be federally assisted. That phrase is broader than it sounds. Receiving federal funds counts, but so does participating in Medicare or Medicaid, holding a federal registration to dispense controlled substances for treating substance use, or being recognized as tax-exempt by the IRS. Because of that breadth, the majority of licensed treatment providers in the United States meet the definition. Ask any program you are considering whether it is a Part 2 program; the answer should be immediate and specific. We answer it on every admissions call.
Part 2 is federal. California adds its own confidentiality provisions for alcohol and drug treatment records, and state-licensed programs like ours operate under both; where they differ, the more protective rule generally governs.
What counts as a protected record.
Most people imagine a chart: notes, diagnoses, medication lists. Part 2 protects all of that, but it starts earlier. The rule protects "patient identifying information," which includes any information that would identify you as having or having had a substance use disorder, or as having applied for or received treatment. The fact of your presence is itself a record.
The practical consequence is spelled out in the regulation. A program that is publicly identified as a place where only substance use disorder services are provided may acknowledge that a specific person is a patient only with that person's written consent. Someone who calls a Part 2 program and asks for you by name will be told nothing, not because the staff member is being coy, but because confirming or denying would itself be a disclosure. The same logic applies to the program's own records of who has applied, who has been referred, and who has been discharged.
The 2024 rule added a category that will be familiar to anyone who knows HIPAA. Notes that a clinician keeps of the content of a counseling session, and holds separately from the rest of the record, are now treated the way HIPAA treats psychotherapy notes: they require their own separate consent and are not swept in by a general release. That distinction matters in individual therapy, where the most sensitive material tends to surface.
How consent works.
The default under Part 2 is that nothing leaves the program without your written consent. That is a stronger position than HIPAA, which allows a provider to share information for treatment, payment, and health care operations without asking. Under Part 2, even routine disclosures of that kind historically required a signed consent.
A valid Part 2 consent is not a signature on a blank form. The regulation lists what it must contain: your name; the name or general designation of the program permitted to disclose; the name of the person or entity that may receive the information; how much and what kind of information may be shared; the purpose of the disclosure; a statement that you may revoke the consent at any time except to the extent action has already been taken on it; the date, event, or condition on which it expires; your signature; and the date. A consent missing one of these elements is not a consent under Part 2, and a program that acts on it has made an unauthorized disclosure.
The 2024 final rule changed the shape of consent in one significant way. You may now sign a single consent that covers all future uses and disclosures for treatment, payment, and health care operations, rather than a separate form each time your record needs to move between your insurer, a lab, and a referring physician. The rule was described in detail by the HHS Office for Civil Rights in its fact sheet on the Part 2 final rule. You do not have to sign that broad consent. You can still consent narrowly, one recipient at a time, and many of our clients do. What the rule offers is a choice, and we walk through it with you rather than defaulting to the widest option.
The redisclosure limit.
The feature of Part 2 that has no real equivalent elsewhere in health privacy law is what happens after a disclosure. Under HIPAA, once information leaves a covered entity and reaches someone who is not one, the rule's grip largely ends. Part 2 instead attaches a condition to the record itself. Every disclosure made with your consent must be accompanied by a written notice that the information is protected by federal law and that the recipient may not further disclose it except as the regulation permits. The person who receives it is bound.
The 2024 rule adjusted this for one category of recipient. When a Part 2 program discloses records under the new single consent for treatment, payment, and operations to a HIPAA covered entity or its business associate, that recipient may then redisclose the records as the HIPAA Privacy Rule permits. In other words, once your record enters the ordinary health system with your consent, it moves under HIPAA's rules rather than Part 2's. The one carve-out that survives is the important one: the records still cannot be used or disclosed in a civil, criminal, administrative, or legislative proceeding against you without your consent or a qualifying court order, no matter who holds them.
We are candid about the trade-off. The single consent makes care coordination easier and reduces the paperwork that used to slow a discharge summary to your psychiatrist. It also means the records travel more freely once you have signed. Whether that trade is worth it depends on your situation, which is why it is a conversation and not a checkbox. The insurance versus private pay spoke covers how payment path affects the same question.
The exceptions, honestly.
No confidentiality rule is absolute, and a page that pretended otherwise would not be worth your trust. Part 2 permits disclosure without consent in a small number of defined situations.
The first is a bona fide medical emergency, where information may be shared with medical personnel to the extent needed to treat a condition that poses an immediate threat to health. If you have a seizure during detox and are transferred to a hospital, the receiving physicians can be told what they need to know, and the program must document what was disclosed and to whom. The second is child abuse and neglect: Part 2 does not restrict reports that state law requires. The third is a crime committed on the program's premises or against program staff; the program may report it and give limited identifying information. The fourth is disclosure for research, audit, and evaluation, under conditions designed to keep individual identities out of the results. The fifth is a court order, and here Part 2 is unusually protective. A subpoena alone is not enough. A court must make a specific finding of good cause under the regulation's own criteria, weighing the public interest and need for disclosure against the injury to you, to the treatment relationship, and to treatment services generally, and the order must limit disclosure to what is essential.
That is the whole list. Part 2 does not have a general exception for employers, licensing boards, family members, or law enforcement asking nicely. Each of those requires your consent or a qualifying order. If someone tells you a treatment program had to give up your record because a lawyer sent a letter, they are describing either a different kind of record or a violation.
What the 2024 final rule changed.
In February 2024, HHS published a final rule implementing changes that Congress directed in the CARES Act of 2020. The stated goal was to bring Part 2 into closer alignment with HIPAA so that addiction records could be integrated into ordinary care without losing their special protection against use in legal proceedings. The rule took effect in April 2024 with a two-year compliance window; that window closed on February 16, 2026, so every Part 2 program is now expected to operate under the revised rule. The table summarizes the changes most relevant to a person in treatment.
| Area | Before the rule | Under the 2024 rule |
|---|---|---|
| Consent for routine sharing | Separate consent generally needed for each disclosure, including to insurers and other providers. | One consent may cover all future treatment, payment, and operations disclosures; you may still choose narrower consents. |
| Redisclosure by HIPAA entities | Recipients bound by Part 2's limits regardless of who they were. | Covered entities receiving records under the single consent may redisclose per HIPAA, except for use in proceedings against you. |
| Counseling notes | No distinct category. | Separately kept SUD counseling notes require their own consent, like HIPAA psychotherapy notes. |
| Breaches | No Part 2-specific breach notification duty. | HIPAA breach notification requirements apply to Part 2 records. |
| Enforcement and complaints | Criminal penalties only; no formal complaint route to HHS. | Civil and criminal enforcement aligned with HIPAA; you may file a complaint with HHS. |
| Use in legal proceedings | Prohibited without consent or court order. | Still prohibited, and the prohibition now expressly follows records into the hands of covered entities. |
The rule also aligned the patient notice that programs must give with HIPAA's notice of privacy practices, so you should receive one document that describes both sets of rights. If a program hands you a Part 2 notice that reads as if nothing changed after 2017, ask why.
What this means for you here.
On the day you arrive, before any clinical work begins, you will sit with a member of the team and decide who may know what. That conversation produces the consents that govern your entire stay. If you want your spouse to receive updates, you name them and describe what they may be told; the family confidentiality spoke explains how that typically evolves. If you want your outside psychiatrist to receive your discharge summary, you name them. If you want your insurer billed, you sign the consent that permits it, as narrow or as broad as you choose. If you name no one, no one is told.
Part 2 governs the record. It does not, on its own, control the number of people who see you in the residence, and this is where a six-bed home does work that the regulation cannot. The law makes the file hard to reach; the building makes the person hard to notice. We think you need both, and we have built for both.
- Privacy in treatment — the hub that places Part 2 alongside HIPAA and what a residence adds.
- Family confidentiality — how the consents described here play out with a spouse or parent.
- Insurance vs. private pay — how the payment consent affects what your insurer, and your household, sees.
- Can my employer find out? — Part 2 stops the program from telling; this covers the rest of the path.
- Residential treatment — what a stay looks like once the consents are signed.
This guide is educational and is not a substitute for medical or legal advice. If someone is in immediate danger, call 911.