42 CFR Part 2 Consent Requirements Explained

Consent is the engine of 42 CFR Part 2. The federal regulation protecting substance use disorder (SUD) treatment records is built on a simple default: records held by a Part 2 program do not move without the patient's written permission. Everything else in the regulation (the exceptions, the redisclosure limits, the court order provisions) orbits around that consent requirement.

Which makes the consent form itself the highest-stakes document in Part 2 compliance. A form missing a required element is not a valid consent, and a disclosure made under an invalid consent is an unauthorized disclosure.

Here is the one-sentence definition: under 42 CFR 2.31, a valid Part 2 consent is a written authorization that identifies the patient, who may disclose, what may be disclosed, to whom, and for what purpose, includes required statements about revocation and redisclosure, carries an expiration, and is signed and dated by the patient or their legal representative.

This guide walks through each required element, the single TPO consent created by the 2024 final rule, revocation mechanics, and the redisclosure notice under 42 CFR 2.32.

The Required Elements of a Valid Consent (42 CFR 2.31)

Section 2.31 of the regulation lists the contents every written Part 2 consent must include. Following the February 2024 final rule, these elements were deliberately aligned with the HIPAA authorization requirements at 45 CFR 164.508, so organizations subject to both frameworks can use a single well-drafted form. A valid consent must contain:

1. The name of the patient. The individual whose records are being disclosed must be identified.
2. Who is permitted to make the disclosure. The name or general designation of the Part 2 program, entity, or class of entities authorized to disclose the records. A general designation (for example, "all my past and present SUD treatment providers") is permitted, which matters for patients with treatment histories across multiple programs.
3. What may be disclosed. A description of how much and what kind of information the consent covers. This can range from a narrow slice (attendance verification only) to the full record, but the form must say which.
4. To whom the disclosure may be made. The name of the person or entity receiving the records, or, where the regulation permits, a general designation of recipients. Under the 2024 final rule, a consent for treatment, payment, and healthcare operations may describe recipients in general terms rather than naming each one, which is what makes the single TPO consent workable.
5. The purpose of the disclosure. Why the records are being shared. For a TPO consent, the stated purpose can be treatment, payment, and healthcare operations broadly.
6. A statement of the right to revoke. The form must tell the patient they may revoke the consent in writing at any time, except to the extent the program has already acted in reliance on it, and describe how to revoke.
7. An expiration date, event, or condition. Every consent must state when it expires. This does not have to be a calendar date; it can be an event or condition related to the purpose (for example, expiration upon revocation for an ongoing TPO consent), but the form cannot be silent on duration.
8. Required statements about redisclosure and consequences. Aligned with the HIPAA authorization model, the form must include statements informing the patient about the potential for records disclosed under the consent to be redisclosed by the recipient, including the point that records disclosed to a recipient not covered by federal privacy law may no longer be protected, and, for TPO consents, that redisclosure by HIPAA covered entities and business associates is permitted as the HIPAA Privacy Rule allows.
9. The signature of the patient. Or, where applicable, the signature of a person authorized to sign for the patient (such as a parent or legal guardian for a minor where state law gives the guardian that authority, or a personal representative for a deceased or incapacitated patient). Electronic signatures are permitted where allowed by applicable law.
10. The date the consent is signed.

Treat that list as a form-review checklist. If any element is missing, the form fails, and disclosures made under it are not authorized by consent.

The Single TPO Consent: One Signature, Ongoing Sharing

The most consequential change the 2024 final rule made to consent practice is the single consent for treatment, payment, and healthcare operations, implementing Section 3221 of the CARES Act.

How it works:

• The patient signs one written consent whose stated purpose covers all future TPO uses and disclosures of their Part 2 records.
• Recipients can be described generally (for example, current and future treating providers, health plans, and business partners involved in the patient's care and payment) rather than individually named.
• Once records are disclosed under that consent to a HIPAA covered entity or business associate, the recipient may redisclose them as permitted by the HIPAA Privacy Rule, with exceptions the regulation preserves (notably the restrictions on use in proceedings against the patient and on SUD counseling notes).
• The consent remains valid until it expires by its own terms or the patient revokes it.

Two important guardrails:

1. Programs generally cannot condition treatment on signing. With narrow exceptions defined in the regulation, a Part 2 program cannot refuse services because a patient declines the TPO consent.
2. SUD counseling notes are excluded. The final rule's separate category for counseling session notes (analogous to HIPAA psychotherapy notes) requires its own dedicated consent. A general TPO consent does not reach them.

For the broader context of what the 2024 rulemaking changed beyond consent, see our plain-language summary of the 42 CFR Part 2 final rule changes.

Revocation: How Patients Take Consent Back

A Part 2 consent is always revocable. The mechanics:

• Written revocation. The patient may revoke consent in writing at any time. Programs should make the process simple and documented.
• Prospective effect. Revocation stops future disclosures. It does not invalidate disclosures the program already made in good-faith reliance on the consent while it was in force.
• Operational duty. Once revoked, the program must stop disclosing under that consent, which means revocations need to reach every workflow that relies on the consent: records requests, health information exchange feeds, billing submissions, and patient communication systems.

That last point is where compliance programs most often stumble. A revocation logged in the EHR but never propagated to, say, an outreach platform is a live violation waiting to happen.

The Redisclosure Notice: 42 CFR 2.32

Consent gets records out the door; Section 2.32 controls what travels with them. Each disclosure made with patient consent must be accompanied by a written notice informing the recipient that the records are protected by federal confidentiality rules (42 CFR Part 2) and restricting further use and disclosure.

The regulation prescribes the substance of this notice: it must convey that the federal rules prohibit further disclosure of the records except as permitted (for TPO consents, as permitted by HIPAA and the consent itself), and that the records cannot be used to investigate or prosecute the patient absent patient consent or a qualifying court order. The final rule provides updated notice language reflecting the TPO redisclosure framework; programs should use the current regulatory text as their template rather than pre-2024 boilerplate.

Practical implication: every channel through which your program releases records, from fax cover sheets to HIE transmittals to secure email templates, needs the 2.32 notice built in.

Consent and Patient Communication

Consent under Part 2 is not only about records requests. It shapes how programs communicate with patients day to day, because even a routine text message can reveal a person's connection to SUD treatment. Messaging workflows for Part 2 populations should be designed around documented permission, discreet content, and clean revocation handling, principles we cover in detail in our guide to 42 CFR Part 2 texting rules.

It is also worth keeping the two consent universes distinct in your head. SMS marketing law (the TCPA) has its own consent hierarchy of express and express written consent that governs whether you may text someone at all, explained in our primer on SMS consent types. Part 2 consent governs what information about a patient's treatment may be disclosed and to whom. A compliant program for an SUD population needs both: TCPA-grade consent to send the message, and Part 2 discipline over what the message and the underlying data flows reveal.

Common Consent Form Failures to Audit For

1. Missing expiration. Forms drafted casually often omit the expiration date, event, or condition. Silence invalidates the form.
2. Stale pre-2024 language. Forms that lack the redisclosure statements or that do not reflect the single TPO consent option should be retired; the compliance date for the final rule was February 16, 2026.
3. Vague information descriptions. "Any and all information" without the required framing of amount and kind invites challenge; describe scope deliberately.
4. No revocation pathway. The form states the right to revoke but the organization has no documented intake process for revocations.
5. Counseling notes swept into general consent. Session-note disclosures need their own consent instrument.
6. Missing 2.32 notice on outbound disclosures. The consent is valid, but records leave without the accompanying confidentiality notice.

This article is general information, not legal advice. Requirements vary by jurisdiction and change over time, so confirm your own obligations with qualified counsel or the relevant regulator.

Frequently Asked Questions

What must a 42 CFR Part 2 consent form include?

Under 42 CFR 2.31, the form must include the patient's name, who may disclose, a description of what information may be disclosed, the recipients, the purpose, a statement of the right to revoke, an expiration date, event, or condition, the required statements about redisclosure, and the patient's (or authorized representative's) signature and date. Missing any required element makes the consent invalid.

Can one consent form cover all future disclosures?

For treatment, payment, and healthcare operations, yes. Since the 2024 final rule implementing the CARES Act, a patient may sign a single TPO consent covering all future uses and disclosures for those purposes, with generally designated recipients, valid until it expires or is revoked. Disclosures for other purposes, and SUD counseling notes, still require their own consent.

Can a patient revoke a Part 2 consent?

Yes, at any time, in writing. Revocation is prospective: it stops future disclosures but does not undo disclosures already made in reliance on the consent while it was valid. Programs must have a working process to capture revocations and halt dependent disclosures across all systems.

What is the redisclosure notice under 42 CFR 2.32?

It is a written statement that must accompany every disclosure made with patient consent, informing the recipient that the records are protected by 42 CFR Part 2, restricting further disclosure except as permitted, and noting that the records cannot be used to investigate or prosecute the patient without consent or a qualifying court order.

Do minors sign their own Part 2 consent?

It depends on state law. Where a minor may lawfully consent to SUD treatment on their own under applicable state law, the minor generally signs the Part 2 consent themselves. Where state law requires parental consent for treatment, consent to disclosure generally involves both the minor and the parent or guardian. Programs should map their consent workflow to their state's minor-consent statute.

Build Consent-First Patient Messaging with FRANSiS

FRANSiS gives healthcare organizations a consent-first SMS platform: opt-in tracking, instant opt-out and revocation handling, discreet message workflows, and two-way conversations supported by an AI Powered Helper, with a signed BAA included and HIPAA compliance supported. Contact the FRANSiS team to see how it fits your program's Part 2 obligations.