Flash Points

  • The 42 CFR Part 2 Final Rule compliance deadline was February 16, 2026. If your policies have not been updated, your organization is likely out of compliance right now.
  • The Final Rule now permits a single patient consent to cover all future TPO disclosures. This is a major shift from the prior requirement of consent for each individual use.
  • The Final Rule creates a brand-new record category for SUD counseling notes, requiring specific consent that cannot be covered by a broad TPO consent.

The Department of Health and Human Services (HHS) released the 42 CFR Part 2 Final Rule in February 2024. This updated regulation was intended to continue the harmonization process of 42 CFR Part 2 and HIPAA.

– 42 CFR Part 2 is a federal regulation protecting the confidentiality of substance use disorder (SUD) treatment records, requiring patient consent for disclosure.

– HIPAA refers to the Health Insurance Portability and Accountability Act of 1996, a federal law establishing national standards to protect sensitive patient health information from disclosure without consent.

The Final Rule had a compliance date of February 16, 2026.  If you are reading this and haven’t made any updates to your policies, it’s likely you may be out of compliance.

HHS’s fact sheet provides key details of the changes. Following are three main modifications:

1. Patient consent. The final rule allows for a single consent for all future uses/disclosures for Treatment, Payment, and Health Care Operations (TPO). Also, it allows HIPAA covered entities and business associates receiving records to redisclose the records under HIPAA regulations. This is a change from the prior process of requiring a patient consent for each use and disclosure.

2. Other Uses and Disclosures. The final rule allows the disclosure of Part 2 records without patient consent to public health authorities IF the disclosed records are deidentified. It also restricts the use of records and testimony in civil, criminal, administrative, and legislative proceedings against patients, unless there is patient consent or a court order. This was also previously not allowed.

3. SUD Counseling Notes. The final rule creates a new definition for an SUD clinician or counseling notes. These notes are documentation of the conversation in an SUD counseling session the clinician voluntarily maintains separately from the rest of the patient’s SUD treatment and medical record – requiring specific consent or authorization from an individual that can not be used or disclosed based on a broad TPO consent. This was previously not covered, and it creates this new category of records treated similarly to how we must treat psychotherapy records.

The final rule may be downloaded here, and the complete regulation is available here.

New Release of Information course from Darin Challacombe!

ROI: Sensitive Information and Patient Representatives
The five types of sensitive information defined by HHS and guidance on issues related to patient representatives. Authored by Darin Challacombe, Ph.D., SHRM-CP, a recognized authority on the intricacies of release of information.
More info