42 CFR Part 2 and Texting: Confidentiality Rules
42 CFR Part 2 is the federal regulation that protects the confidentiality of substance use disorder (SUD) treatment records, and it is stricter than HIPAA in ways that directly shape how treatment programs can text their patients. Where HIPAA permits disclosures for treatment, payment, and operations without patient authorization, Part 2 has historically required specific patient consent for most disclosures, and it restricts how records can be used against patients in legal proceedings. Any program that texts appointment reminders, check-ins, or recovery support to SUD patients needs to understand this regime, including the significant 2024 final rule that moved Part 2 closer to HIPAA. This article is general information, not legal advice.
Key takeaways:
- Part 2 protects records that would identify a person as having a substance use disorder, held by federally assisted programs, under authority of 42 USC 290dd-2.
- It is stricter than HIPAA: even acknowledging that someone is a patient of an SUD program can be a prohibited disclosure without consent.
- The 2024 final rule, implementing the CARES Act, aligned Part 2 consent with HIPAA by allowing a single consent for future treatment, payment, and operations uses, with new limits on legal use of records.
- For texting, the mere existence of a message from an identifiable treatment program can reveal protected status, so program identification in messages requires care.
- Platforms serving SUD programs need a signed BAA (and qualified service organization terms where applicable), plus consent tracking that meets Part 2's documentation standards.
What Part 2 is and where it comes from
Part 2 implements a federal statute, 42 USC 290dd-2, first enacted in the 1970s on a simple premise: people will not seek addiction treatment if seeking it can be used against them. The regulations at 42 CFR Part 2 are administered by the Substance Abuse and Mental Health Services Administration (SAMHSA) within HHS, and they apply to "Part 2 programs": federally assisted programs that hold themselves out as providing SUD diagnosis, treatment, or referral.
Federal assistance is read broadly. Programs that receive federal funds, are licensed or certified by the federal government, are tax-exempt, or are authorized to prescribe controlled substances for SUD treatment generally qualify. In practice, most specialty SUD treatment providers, opioid treatment programs, and many behavioral health organizations with SUD services are covered.
What is protected: records, in any form, that would identify a person, directly or indirectly, as having or having had a substance use disorder, when those records originate from a Part 2 program. A crisp way to remember the difference from HIPAA: HIPAA protects what your records say; Part 2 also protects the fact that records exist at all.
How Part 2 is stricter than HIPAA
The regimes overlap, but Part 2 tightens several screws:
| Issue | HIPAA | Part 2 |
|---|---|---|
| Disclosures for treatment, payment, operations | Permitted without authorization | Historically required written consent; 2024 rule allows a single broad consent |
| Acknowledging patient status | Limited directory disclosures allowed | Identifying someone as an SUD patient is itself protected |
| Use in legal proceedings | Subpoena processes apply | Records generally shielded absent a special court order; 2024 rule strengthened limits on use in proceedings |
| Redisclosure | Not separately flagged | Recipients historically bound by notice prohibiting redisclosure |
| Law enforcement | Permitted disclosures exist | Sharply restricted without court order |
The consequences for communication design are real. A voicemail, postcard, or text that names "Riverside Addiction Recovery Center" reveals protected status to anyone who sees the phone screen. Under Part 2, that identification is part of what the rule guards.
The 2024 final rule: alignment with HIPAA, not surrender to it
Section 3221 of the CARES Act of 2020 directed HHS to align Part 2 more closely with HIPAA, and HHS finalized the implementing rule in February 2024, with compliance required by February 2026. The headline changes:
- Single consent for TPO. Patients may sign one consent permitting future uses and disclosures for treatment, payment, and healthcare operations, after which recipients that are covered entities or business associates may redisclose per HIPAA rules, a major workflow simplification.
- Stronger legal shields. Records and testimony obtained in violation of Part 2 face new limits on use in civil, criminal, administrative, and legislative proceedings against the patient.
- Breach notification. HIPAA-style breach notification obligations now extend to Part 2 records.
- Aligned penalties. Enforcement moved from the old criminal-only posture to the HIPAA civil and criminal penalty structure under the HITECH framework, enforced through HHS.
- Patient rights alignment. Complaint rights and accounting-of-disclosures concepts were brought closer to HIPAA's.
What did not change: Part 2 still exists as a distinct regime, SUD counseling notes retain special handling, and consent revocation must still be honored. Programs cannot simply treat Part 2 records as ordinary HIPAA data.
What all this means for texting SUD patients
Texting is one of the highest-value channels in SUD treatment: appointment reminders support retention in treatment, and quick check-ins sustain engagement between visits. Part 2 does not forbid any of it. It shapes the how:
- Consent first, documented properly. Obtain written consent covering text communication, what kinds of messages will be sent, and to which number. Under the 2024 rule, a well-drafted TPO consent can cover routine communication, but the documentation standard remains higher than casual HIPAA practice.
- Mind the sender identity. Message content and sender naming should not broadcast SUD treatment status. Many programs use neutral sender names and message templates that a bystander could not decode, especially for reminders.
- Minimum necessary, aggressively applied. First name, time, and a neutral reference ("your appointment Thursday at 2") travel safely; program names, medication names, and clinical language often should not.
- Honor revocation instantly. STOP and consent withdrawal must stop messages across every workflow, immediately.
- Choose infrastructure built for the standard. A platform serving Part 2 programs should sign a BAA, function under qualified service organization terms where the program requires them, encrypt messages in transit (TLS 1.3) and at rest (256-bit AES), and keep audit logs that can demonstrate exactly what was sent, when, and under what consent.
Our guides to behavioral health SMS outreach and appointment reminders for therapy and behavioral health cover the program-design side of this channel in depth.
Designing message templates that respect Part 2
A useful drafting exercise: imagine every message displayed on a lock screen at a family dinner. Templates that pass:
Hi Jordan, this is a reminder about your appointment Thursday at 2:00 PM. Reply C to confirm or R to reschedule.
Jordan, you have a visit tomorrow at 10:00 AM at our Main Street office. Reply with questions.
Templates that fail: anything naming the program's SUD identity, medications like methadone or buprenorphine, counseling group names, or recovery milestones. The failing versions are not just risky; under Part 2 they can constitute unauthorized disclosures all by themselves.
An AI Powered Helper works well inside these constraints when the platform enforces approved content: it can confirm, reschedule, answer logistics questions, and escalate anything clinical or sensitive to staff, keeping the automated layer inside the template discipline the regulation demands. FRANSiS supports this model for behavioral health organizations, with HIPAA compliance supported, a signed BAA included, and escalation paths designed for sensitive programs. Broader solution context lives on our healthcare solutions page.
Frequently asked questions
What is 42 CFR Part 2 in plain language?
It is the federal regulation protecting the confidentiality of substance use disorder treatment records from federally assisted programs. It implements 42 USC 290dd-2 and is stricter than HIPAA: even revealing that someone is a patient of an SUD program is protected, and most disclosures require patient consent.
Who has to follow Part 2?
Federally assisted programs that hold themselves out as providing SUD diagnosis, treatment, or referral, plus those who receive Part 2 records, including third-party payers and, under consent-based redisclosure, downstream covered entities and business associates. Federal assistance is interpreted broadly, covering funding, licensure, tax-exempt status, and controlled substance registration.
How did the 2024 final rule change Part 2?
Implementing the CARES Act, the rule allows a single patient consent for future treatment, payment, and operations disclosures, aligns breach notification and penalties with HIPAA through the HITECH structure, and strengthens protections against use of records in proceedings against patients. Compliance is required by February 2026. Part 2 remains a distinct, stricter regime.
Can substance use treatment programs text their patients?
Yes, with documented consent, carefully neutral message content, instant honoring of revocation, and a platform governed for the standard: signed BAA, qualified service organization terms where required, encryption, and audit logs. The channel is valuable for retention; the design work is about not revealing protected status in the process.
Does a text reminder from a treatment program violate Part 2?
It can, if the message or sender identity reveals SUD treatment status without consent covering that disclosure, for example a lock-screen notification naming an addiction clinic. Neutral templates, documented consent, and controlled sender naming keep reminders inside the rule.
Conclusion
Part 2 exists because confidentiality is treatment infrastructure: people enter and stay in recovery when seeking help cannot be used against them. For communication teams, the regulation reads as a design brief rather than a barrier: get real consent, write templates a bystander cannot decode, honor revocation instantly, and run it all on infrastructure that can prove what it did. The 2024 alignment rule simplified the paperwork; the discipline is still the point.
Building compliant texting for a behavioral health or SUD program? Contact the FRANSiS team to see consent-tracked, audit-logged messaging with a signed BAA included and an AI Powered Helper that stays inside your approved templates.
