Who Must Comply With 42 CFR Part 2? Full Answer

42 CFR Part 2 is one of the most misunderstood privacy rules in American healthcare. Providers assume it applies to them when it does not, and organizations that are squarely covered sometimes have no idea. Because the penalties for wrongful disclosure now align with HIPAA enforcement, getting the applicability question right matters for every clinic, health system, and communication vendor that touches substance use disorder (SUD) information.

Here is the one-sentence answer: 42 CFR Part 2 applies to any individual or entity that is both a "program" (it holds itself out as providing, and actually provides, substance use disorder diagnosis, treatment, or referral for treatment) and "federally assisted" as defined in 42 CFR 2.12, plus anyone who lawfully receives Part 2 records downstream.

Everything else in this article unpacks that sentence, because both halves of the test, the program test and the federal assistance test, have precise regulatory definitions in 42 CFR 2.11 and 42 CFR 2.12 that trip people up.

The Two-Part Test: Program Plus Federal Assistance

Part 2 does not attach to a type of data in the abstract. It attaches to records created or received by a covered program. To be covered, an organization (or a unit or individual within one) must satisfy both prongs.

Prong 1: Are you a "program"?

Under 42 CFR 2.11, a program is one of the following:

A specialized SUD entity. An individual or entity, other than a general medical facility, that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment. Think standalone addiction treatment centers, opioid treatment programs, detox facilities, and SUD counseling practices.
An identified SUD unit inside a general medical facility. For example, a hospital's dedicated addiction medicine unit or SUD ward.
SUD-focused medical personnel in a general medical facility. Staff or units whose primary function is SUD diagnosis, treatment, or referral, and who are identified as such providers.

The phrase "holds itself out" is doing real work here. Advertising SUD services, listing addiction treatment on a website, holding specialized licenses or certifications, or being known in the community as an SUD provider all point toward holding out. A primary care physician who occasionally screens for alcohol misuse as part of general practice generally is not a program. A physician who advertises medication-assisted treatment and maintains a buprenorphine panel very likely is.

Prong 2: Are you "federally assisted"?

This is where most people underestimate the rule's reach. Under 42 CFR 2.12(b), a program is federally assisted if any of the following applies:

It is conducted in whole or in part by any department or agency of the United States.
It is licensed, certified, registered, or otherwise authorized by the federal government. This includes certification as an opioid treatment program by SAMHSA and registration with the Drug Enforcement Administration to dispense controlled substances used in SUD treatment.
It is supported by federal funds in any form, even indirectly. Federal grants, contracts, and funding that passes through a state or local government to the program all count.
It is allowed tax-exempt status by the Internal Revenue Service, or contributions to it are tax deductible.
It participates in federally supported programs such as Medicare or Medicaid.

Because DEA registration, tax-exempt status, and Medicare or Medicaid participation are nearly universal among treatment providers, the federal assistance prong is satisfied far more often than not. In practice, the applicability question usually turns on the program prong, not this one.

Quick Reference: Covered or Not Covered

Organization	Program prong	Federal assistance prong	Part 2 status
Licensed opioid treatment program (methadone clinic)	Yes, holds itself out	Yes, SAMHSA certified and DEA registered	Covered
Standalone addiction treatment center accepting Medicaid	Yes	Yes	Covered
Hospital addiction medicine unit	Yes, identified unit	Yes, Medicare participation	Covered (that unit)
Primary care doctor who advertises buprenorphine treatment	Likely yes	Yes, DEA registration	Likely covered
Emergency department treating an overdose incidentally	No, not held out as SUD care	Yes	Not covered for that encounter
General therapist who occasionally discusses drinking	No	Varies	Not covered
Health plan or care coordinator receiving Part 2 records	Not a program	N/A	Covered as a lawful holder

The emergency department row deserves emphasis. Under the applicability provisions of 42 CFR 2.12, records of SUD treatment provided incidentally, such as emergency care for an overdose in a general ED, are not Part 2 records so long as the treating unit does not hold itself out as an SUD program. The same information in the hands of the hospital's addiction medicine service would be protected.

Who Is NOT Required to Comply

Just as important as knowing who is covered is knowing who is not:

General medical providers who do not hold themselves out as SUD providers, even when SUD information appears in their charts. That information is still protected by HIPAA under 45 CFR Part 164, just not by Part 2.
Emergency personnel treating SUD conditions incidentally.
The Veterans Health Administration, which follows its own confidentiality statutes rather than Part 2, though information exchanged with the Armed Forces has special rules.
Programs with no federal assistance of any kind, a category that is theoretically possible but rare in practice, since even IRS tax-exempt status triggers coverage.
Employers, schools, and courts that learn of a person's SUD status through channels other than a Part 2 program's records.

If your organization falls outside Part 2, remember that HIPAA, state confidentiality laws, and professional ethics rules almost certainly still apply to the same information. For a side-by-side breakdown of how the two federal frameworks differ, see our comparison of 42 CFR Part 2 versus HIPAA.

Lawful Holders: Compliance Follows the Record

Part 2 obligations do not stop at the program's door. Anyone who receives Part 2 records with patient consent, accompanied by the required notice prohibiting redisclosure, becomes a "lawful holder" and takes on Part 2 duties with respect to those records. Common lawful holders include:

Health plans and managed care organizations that receive records for payment or care coordination
Accountable care organizations and health information exchanges
Third-party billing companies and other contractors of Part 2 programs
Researchers and auditors who receive records under Part 2's specific pathways
Technology vendors, including messaging platforms, that store or transmit Part 2 records on a program's behalf

A lawful holder may generally use and redisclose the records only as permitted by the patient's consent or by a specific Part 2 exception. The 2024 final rule, implementing Section 3221 of the CARES Act, aligned Part 2 more closely with HIPAA. It allows a single patient consent for all future uses and disclosures for treatment, payment, and health care operations, permits redisclosure by HIPAA covered entities and business associates consistent with the HIPAA Privacy Rule once that consent is in place, and aligned enforcement and penalties with HIPAA, with the HHS Office for Civil Rights (OCR) responsible for enforcement.

Why This Matters for Text Messaging

Applicability is not an academic question for organizations that communicate with patients by SMS. If your organization is a Part 2 program, appointment reminders, outreach messages, and two-way conversations can reveal protected information, sometimes just by identifying the sender. A text from a named addiction clinic implicitly discloses that the recipient has a relationship with an SUD provider. The rules for what you can say, to whom, and with what consent are covered in detail in our guide to 42 CFR Part 2 texting rules.

Practical steps for covered programs and lawful holders:

Inventory whether your organization, or any unit within it, meets the two-part test.
Obtain written patient consent that covers electronic communications before texting.
Use neutral sender identification where feasible so message headers do not disclose SUD treatment.
Ensure vendors that touch Part 2 records sign appropriate agreements and understand redisclosure limits, the same discipline healthcare teams already apply when they choose an SMS platform that supports HIPAA compliance.
Train front-line staff, since the person sending the message is the point of compliance failure or success.

This article is general information, not legal advice. Requirements vary by jurisdiction and change over time, so confirm your own obligations with qualified counsel or the relevant regulator.

Frequently Asked Questions

Does 42 CFR Part 2 apply to all doctors who treat addiction?

No. A clinician is covered only if they hold themselves out as providing SUD diagnosis, treatment, or referral and are federally assisted under 42 CFR 2.12. A general practitioner who addresses substance use as an ordinary part of primary care, without advertising or specializing in SUD treatment, is generally not a Part 2 program, though HIPAA still protects the records.

Is a hospital automatically covered by Part 2?

Not as a whole. In a general medical facility, Part 2 covers identified units that provide SUD services and medical personnel whose primary function is SUD care. Records created elsewhere in the hospital, including emergency treatment of an overdose that is incidental to general care, are typically outside Part 2, although they remain protected by HIPAA.

What does "federally assisted" actually mean?

Under 42 CFR 2.12(b), it includes being run by a federal agency, being licensed, certified, or registered by the federal government (including DEA registration and SAMHSA opioid treatment program certification), receiving federal funds directly or indirectly, holding IRS tax-exempt status, or participating in Medicare or Medicaid. Because these categories are so broad, most treatment providers qualify.

Who enforces 42 CFR Part 2, and what are the penalties?

Following the CARES Act and the 2024 final rule, Part 2 enforcement is aligned with HIPAA. The HHS Office for Civil Rights enforces the rule, and violations are subject to the same civil and criminal penalty structures that apply to HIPAA violations, replacing the older criminal-only enforcement scheme.

If my organization receives Part 2 records but is not a treatment program, do the rules apply to us?

Yes. Recipients of Part 2 records under a patient's consent become lawful holders and must honor the prohibition on redisclosure except as the consent or a specific regulatory exception permits. This includes health plans, billing contractors, and technology vendors that store or transmit the records.

Communicate With Part 2 Patients the Right Way

FRANSiS helps behavioral health and SUD treatment teams reach patients by two-way SMS with consent tracking, neutral sender practices, and workflows built for sensitive populations, with a signed BAA included and an AI Powered Helper that drafts compliant replies for staff review. Talk to our team about texting under 42 CFR Part 2.