42 CFR Part 2 Final Rule: What Changed & When

For decades, 42 CFR Part 2, the federal regulation protecting substance use disorder (SUD) treatment records, operated on rules so strict that they often walled SUD records off from the rest of a patient's care. Providers, health systems, and patient advocates all agreed on the problem, even when they disagreed on the fix: the consent framework written for the paper era made coordinated, integrated treatment harder than it needed to be.

In February 2024, the US Department of Health and Human Services (HHS) published a final rule that delivered the most significant rewrite of Part 2 in the regulation's history. In one sentence: the 2024 final rule aligns 42 CFR Part 2 with HIPAA by allowing a single patient consent to cover all future treatment, payment, and healthcare operations disclosures, while extending HIPAA-style breach notification, penalties, and patient rights to SUD records.

This guide explains where the rule came from, what changed, what did not change, and the dates that matter.

Where the Final Rule Came From: CARES Act Section 3221

The final rule did not appear out of nowhere. Congress ordered it.

Section 3221 of the Coronavirus Aid, Relief, and Economic Security (CARES) Act, enacted in March 2020, amended the underlying SUD confidentiality statute, 42 U.S.C. 290dd-2. Congress directed HHS to revise Part 2 to permit broader information sharing for treatment, payment, and healthcare operations (TPO) after a patient consents once, and to strengthen protections and penalties in exchange, borrowing heavily from HIPAA's architecture.

HHS, acting through the Office for Civil Rights (OCR) and the Substance Abuse and Mental Health Services Administration (SAMHSA), proposed implementing regulations in late 2022 and published the final rule in the Federal Register in February 2024. The rule became effective in April 2024, and regulated entities were given a compliance window ending on February 16, 2026, by which date Part 2 programs must conform their practices, forms, and notices to the new requirements.

The Headline Change: Single Consent for TPO

Under the old framework, Part 2 generally required a fresh, specific written consent for each type of disclosure, naming each recipient. A patient in integrated care could face a stack of consent forms, and providers outside the SUD program often could not see critical information (medications, treatment history, overdose risk) when it mattered most.

The final rule replaces that model for TPO purposes:

One consent, given once. A patient may sign a single written consent that covers all future uses and disclosures of their Part 2 records for treatment, payment, and healthcare operations.
Redisclosure by covered entities. Once records are disclosed under that TPO consent to a HIPAA covered entity or business associate, the recipient may redisclose them as the HIPAA Privacy Rule permits, with certain exceptions that continue to protect patients.
Revocable at any time. The patient can revoke the consent in writing at any point, prospectively.

This is the change with the largest day-to-day impact: it lets SUD records move through integrated care and billing workflows in a way that finally resembles the rest of medicine, while keeping the patient's initial written consent as the gate. The consent form itself still must contain the required elements of 42 CFR 2.31, which we itemize in our guide to Part 2 consent requirements.

Everything Else That Changed

Penalties Aligned with HIPAA

Before the rule, Part 2 violations were subject to a criminal penalty regime separate from HIPAA, and enforcement was historically rare. The final rule, implementing the CARES Act, aligns Part 2 enforcement with the civil and criminal enforcement authorities that apply to HIPAA. Practically, this brings Part 2 under the same kind of tiered civil money penalty structure and enforcement machinery that HHS uses for HIPAA violations, materially raising the compliance stakes for programs and their partners.

Breach Notification Comes to Part 2

The final rule applies the HIPAA Breach Notification Rule framework to breaches of Part 2 records. Programs must now notify affected patients, HHS, and in larger incidents the media, following the same model that HIPAA covered entities have operated under. Before this rule, Part 2 had no breach notification requirement of its own.

New and Strengthened Patient Rights

Patients gained rights modeled on HIPAA:

Accounting of disclosures. Patients may obtain an accounting of certain disclosures of their Part 2 records, paralleling the HIPAA right.
Right to request restrictions. Patients may request restrictions on certain disclosures, including for TPO.
Complaint rights. Patients may file complaints about Part 2 violations directly with HHS, not just with the program.
No conditioning of services. Programs cannot make treatment contingent on signing a TPO consent except in limited circumstances the regulation defines.

Counseling Notes Get HIPAA-Style Protection

The rule creates a category of SUD counseling notes, analogous to HIPAA's psychotherapy notes. Notes a clinician keeps separately that document the content of SUD counseling sessions require their own specific, separate consent for disclosure. The general TPO consent does not unlock them.

Protections in Proceedings Reinforced

The rule maintains and clarifies Part 2's signature protection: records (and testimony relaying their contents) cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against the patient without specific patient consent or a court order meeting Part 2's own standards. The final rule strengthens this by extending the prohibition to testimony derived from the records.

Safe Harbor for Investigative Agencies

The rule adds a limited safe harbor for investigative agencies that unknowingly receive Part 2 records without the required court order, if they acted with reasonable diligence. This addresses a long-standing point of friction without weakening the core proceedings protection.

What Did Not Change

The final rule modernized Part 2, but it did not dissolve it into HIPAA. Key distinctions survive:

Still true after the final rule	Why it matters
Written consent is still required before TPO disclosures	HIPAA needs no authorization for TPO; Part 2 still needs one signed consent
Part 2's scope still turns on federally assisted SUD programs	General medical records about substance use outside a Part 2 program remain HIPAA-only
Redisclosure notice still required (42 CFR 2.32)	Disclosures with consent must carry the confidentiality notice
Court order requirements for proceedings remain	Records stay shielded from use against patients
Consent must still contain the 2.31 required elements	Forms cannot be reduced to a generic HIPAA authorization

For a fuller side-by-side of how the two frameworks now compare, see our breakdown of 42 CFR Part 2 vs. HIPAA.

The Dates That Matter

March 2020: CARES Act enacted; Section 3221 amends 42 U.S.C. 290dd-2 and directs HHS to revise Part 2.
November-December 2022: HHS issues the notice of proposed rulemaking.
February 2024: Final rule published in the Federal Register (February 16, 2024).
April 2024: Final rule effective date (April 16, 2024).
February 16, 2026: Compliance date. Part 2 programs were required to be in full conformance by this date, which has now passed. If your program has not updated its consent forms, patient notices, breach response plan, and staff training, that work is overdue, not upcoming.

A Compliance Checklist for Part 2 Programs

With the compliance date behind us, here is what conforming programs should already have in place:

Updated consent forms containing all 42 CFR 2.31 elements, including the option for a single TPO consent and the required statements about revocation and redisclosure.
A revised Patient Notice (the Part 2 counterpart to HIPAA's Notice of Privacy Practices) reflecting the new rights and uses.
Breach notification procedures integrated with the organization's HIPAA breach response plan.
Segmentation for SUD counseling notes, with separate consent workflows.
Accounting-of-disclosures capability in records systems.
Retrained staff, especially front-desk, intake, billing, and communications teams who touch consent and disclosures daily.
Reviewed vendor agreements, ensuring business associates and communication platforms handle Part 2 data under appropriate safeguards.

That last item includes patient messaging. Texting patients of an SUD program implicates Part 2 directly, because even a routine reminder can reveal a person's connection to treatment. Our guide to 42 CFR Part 2 texting rules covers how to run SMS programs for these populations carefully.

This article is general information, not legal advice. Requirements vary by jurisdiction and change over time, so confirm your own obligations with qualified counsel or the relevant regulator.

Frequently Asked Questions

What is the 42 CFR Part 2 final rule in plain language?

It is the February 2024 HHS regulation, required by Section 3221 of the CARES Act, that modernized federal confidentiality protections for substance use disorder treatment records. Its centerpiece: patients can now sign one consent covering all future treatment, payment, and healthcare operations disclosures, and in exchange, Part 2 records gained HIPAA-style breach notification, penalties, and patient rights.

When did the 42 CFR Part 2 final rule take effect?

The rule was published in the Federal Register on February 16, 2024 and became effective on April 16, 2024. The compliance date, the deadline by which Part 2 programs had to fully conform their forms, notices, and practices, was February 16, 2026.

Does the final rule mean Part 2 records are now treated exactly like HIPAA records?

No. The frameworks are closer but not identical. Part 2 still requires a signed written consent before TPO disclosures (HIPAA does not), still mandates a redisclosure notice with consented disclosures, still requires a special court order before records can be used in proceedings against a patient, and still applies only to federally assisted SUD programs.

Can patients revoke the single TPO consent?

Yes. The consent must inform patients of their right to revoke, and a patient may revoke it in writing at any time. Revocation operates prospectively: it stops future disclosures but does not undo disclosures already lawfully made in reliance on the consent.

What are SUD counseling notes under the final rule?

They are notes a clinician voluntarily maintains separately from the rest of the record documenting the content of SUD counseling sessions, modeled on HIPAA's psychotherapy notes. Disclosing them requires a specific consent dedicated to those notes; the general TPO consent does not cover them.

Keep Patient Communication Aligned with the New Rules

FRANSiS helps healthcare organizations run patient texting programs built around consent, discretion, and control, with a signed BAA included and HIPAA compliance supported. Two-way conversations are managed with an AI Powered Helper so sensitive populations get timely, careful communication. Contact the FRANSiS team to discuss messaging for your program.