42 CFR Part 2 is the federal confidentiality rule for substance use disorder patient records.
It applies to "federally assisted" SUD programs, runs alongside HIPAA rather than replacing it, and after the 2024 final rule it borrows HIPAA's mechanics: one written consent covers treatment, payment, and health care operations until the patient revokes it, with SUD counseling notes as the standing exception requiring separate consent.
What 42 CFR Part 2 is — and how it sits next to HIPAA
42 CFR Part 2 is the federal regulation titled "Confidentiality of Substance Use Disorder (SUD) Patient Records."
It governs the records of people seeking and receiving treatment from SUD programs, and it applies in addition to HIPAA, not instead of it: a Part 2 program may also be a HIPAA covered entity, but the SUD-specific consent rules in Part 2 still apply to its SUD records.
The current version is the 2024 final rule, published in the Federal Register on February 16, 2024 (89 FR 12472).
HHS described it as the rule implementing section 3221 of the CARES Act, "making certain other modifications to increase alignment with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule."
It took effect on April 16, 2024, and the compliance date was February 16, 2026 — a date that has now passed, so the 2024 rule is not upcoming compliance work.
It is the rule in force.
A Federal Register search in September 2026 found no later rule delaying or amending it.
One piece is still pending by design: the compliance date for the accounting-of-disclosures provision at §2.25 is tolled until HIPAA's parallel provision at 45 CFR 164.528 is revised to address accounting for treatment, payment, and operations disclosures made through an electronic health record.
Until that federal revision happens, that one duty sits on hold.
Regulatory content — verify against the rule text
Who is covered: the "federally assisted" SUD program test
Part 2 does not attach to a profession or a licence — it attaches to a program.
A "program" under 42 CFR 2.11 is: a person, other than a general medical facility, that "holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment"; an identified unit within a general medical facility that does the same; or medical personnel or other staff in a general medical facility "whose primary function is the provision of substance use disorder diagnosis, treatment, or referral for treatment and who are identified as such providers."
On top of being a program, the entity must be "federally assisted."
The routes listed at 42 CFR 2.12(b) include: being a participating provider in the Medicare program; holding an authorization to conduct maintenance treatment or withdrawal management; holding a DEA registration, "to the extent the controlled substance is used in the treatment of substance use disorders"; and receiving federal funding.
Any one of these routes brings a program under the rule.
Two boundaries follow from the definitions.
First, the rule reaches inside general medical facilities only through identified SUD units or staff whose primary function is SUD care — a generalist working elsewhere in the hospital is not pulled in by the building.
Second, the "part 2 program director" named in 2.11 — "the person designated as director or managing director, or person otherwise vested with authority to act as chief executive officer of the part 2 program" — is the rule's term for whoever is answerable for the program.
It is not a clinical-licence requirement, and it is not the same post as the clinical director roles some states define.
The levels-of-care guide covers how settings and their staffing rules differ.
The single consent for treatment, payment, and health care operations
The 2024 rule's headline consent change is at 42 CFR 2.33(a)(2): "When the consent provided is a single consent for all future uses and disclosures for treatment, payment, and health care operations, a part 2 program, covered entity, or business associate may use and disclose those records for treatment, payment, and health care operations as permitted by the HIPAA regulations, until such time as the patient revokes such consent in writing."
One signature covers the routine flows, and it stays in force until the patient revokes it — in writing, not verbally.
Redisclosure follows HIPAA's mechanics too, with one carve-out.
Under 2.33(b)(1), a recipient that is a covered entity or business associate "may further disclose those records in accordance with the HIPAA regulations, except for uses and disclosures for civil, criminal, administrative, and legislative proceedings against the patient."
Records that have moved downstream under the single consent cannot simply ride further into legal proceedings against the patient who signed.
Payment is one of the three covered purposes, so the consent conversation and the billing conversation are linked: records move for payment under the same consent that covers treatment.
Who can actually bill is a separate question with its own federal test — the diagnosis and billing guide covers the Medicare enrollment rules for counselors.
SUD counseling notes: the exception that still needs separate consent
The single consent has a standing exception aimed directly at counseling work.
Part 2 now defines "SUD counseling notes": "notes recorded (in any medium) by a part 2 program provider who is a SUD or mental health professional documenting or analyzing the contents of conversation during a private SUD counseling session or a group, joint, or family SUD counseling session and that are separated from the rest of the patient's SUD and medical record."
For a counselor, that describes the process notes of your own sessions — kept apart from the main chart.
The definition then fences the category off from routine documentation.
"SUD counseling notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date."
Medication orders, session times, test results, and progress summaries live in the regular record under the ordinary consent rules.
What is inside the category cannot ride on the broad consent.
HHS's Office for Civil Rights is explicit that SUD counseling notes "cannot be used or disclosed based on a broad TPO consent" — they need their own, specific consent before the program can use or disclose them.
The definition's exclusions are the practical boundary
Breaches, penalties, and patient complaints
The 2024 rule imported HIPAA's enforcement machinery.
On breaches, 42 CFR 2.16(b) provides that the HIPAA breach-notification provisions — 45 CFR part 160 and subpart D of 45 CFR part 164 — "shall apply to part 2 programs with respect to breaches of unsecured records in the same manner as those provisions apply to a covered entity with respect to breaches of unsecured protected health information."
A breach of SUD records triggers the same notification duties a covered entity faces.
On penalties, 42 CFR 2.3(a) provides that anyone who violates the underlying statute, 42 U.S.C.
290dd-2(a)–(d), "shall be subject to the applicable penalties under sections 1176 and 1177 of the Social Security Act, 42 U.S.C.
1320d-5 and 1320d-6" — the HIPAA civil and criminal penalty provisions.
The rule does not publish a fine schedule of its own, and this article does not quote dollar amounts.
Patients also hold a complaints channel that the program cannot contract away.
A Part 2 program must have a complaint process, and patients may complain to the Secretary.
Under 42 CFR 2.4(d), "A part 2 program may not require patients to waive their right to file a complaint … as a condition of the provision of treatment, payment, enrollment, or eligibility" — so an enrollment packet that demanded such a waiver would contradict the rule.
What the rule means in day-to-day counseling work
In practice the rule shows up in five places.
Consent: one written TPO consent covers the routine uses, and its scope ends where revocation begins — in writing.
Documentation: the counselor's own session notes sit in a defined category of their own, separated from the record, protected by the separate-consent requirement.
Redisclosure: once records flow downstream under the single consent, the HIPAA-style rules govern — except for proceedings against the patient, which stay off-limits.
Breaches: notification duties apply with HIPAA-grade consequences.
And complaints: the patient always has a channel, to the program and to the Secretary, that no form can waive.
Two clarifications keep the picture sharp.
The rule binds the program, so the policies you follow at work — consent forms, notice language, release workflows — are the employer's implementation of Part 2, and questions about a specific disclosure route to that compliance function, not to clinical judgment alone.
And nothing in Part 2 changes your licence: the consent rule governs records, while what you may diagnose or bill comes from the state board and the payer.
Substance abuse counselor roles in dedicated SUD settings can sit inside Part 2 programs — but coverage runs program by program, so the two-part test above is the way to check a specific employer, not the job title.
Verify at the source: read the rule, then your program's policies
The authoritative text of 42 CFR Part 2 is on the eCFR, and HHS's Office for Civil Rights publishes a fact sheet on the 2024 final rule.
As of September 2026 no later federal rule had delayed or amended it, with the single exception of the tolled accounting-of-disclosures provision.
Because the rule attaches to programs rather than licenses, the fastest way to know whether a specific employer is covered is to ask — the compliance officer will know which consent forms govern which records.
For anything that turns on a specific disclosure, confirm with the program's privacy officer and, where the stakes justify it, an attorney.
This article is general career information about a federal regulation, not legal advice, and it is not guidance for anyone seeking treatment. Regulatory requirements change, and application to a specific program or disclosure is a compliance question — confirm with the employer's privacy or compliance officer, the payer, or an attorney before relying on any of it. If you are in crisis, the 988 Suicide & Crisis Lifeline can be reached by call or text.