42 CFR Part 2 vs HIPAA: The Stricter Rules for Substance Use Records

42 CFR Part 2 is stricter than HIPAA in three ways that survived the 2024 rewrite, written consent for most disclosures, no use of the records against the patient in court, and every vendor bound in writing.

Compliance has been mandatory since February 16, 2026, and OCR now takes complaints. Practices that run a substance use program alongside general counseling tend to assume a HIPAA program covers it. The 2024 rule made that assumption closer to true than it used to be, and left it wrong in exactly the places where an IT provider has to build something.

VJNetworks has managed systems holding protected health information since 2008, signs a Business Associate Agreement with every healthcare client, and supports behavioral health practices through our healthcare IT program. This is written for the outpatient program, the group practice with an SUD track, and the OASAS-certified provider in Rockland, Westchester, or Bergen that has to answer to both rulebooks at once. What follows is the rule as written, where it differs from HIPAA, and what each difference means for the software, the vendors, and the paperwork. It is not legal advice. It is the version your attorney and your IT provider should both be able to sign off on.

One date first. The final rule was published February 16, 2024, took effect April 16, 2024, and set compliance for February 16, 2026. On that day HHS’s Office for Civil Rights began accepting complaints and breach notifications for substance use records, which HHS describes as the first time civil enforcement mechanisms have been available for Part 2. Every difference below is now enforceable the way HIPAA is. Same office, same penalty schedule, same portal.

Who Part 2 Actually Applies To

A Part 2 program is a person or unit that holds itself out as providing substance use disorder diagnosis, treatment, or referral, and is federally assisted. Federal assistance is broad. Medicare participation is named in the rule. So is a DEA registration to dispense controlled substances for SUD treatment, tax-exempt status, and federal financial assistance in any form, which is where most Medicaid-funded programs land.

Two things follow from that definition. A general medical practice is outside the rule unless it has an identified unit, or staff, whose primary function is SUD care. A private practitioner who advertises SUD treatment and provides it is inside. The therapist who occasionally sees a client with a drinking problem, and does not hold the practice out as an SUD provider, is generally on the HIPAA side of the line. That is a question for your attorney rather than your IT company. Get the answer in writing, somewhere you can find it.

In New York the federal test often does not matter. OASAS regulation 14 NYCRR 815.4 requires every provider it certifies, funds, or authorizes to comply with 42 CFR Part 2 and HIPAA, to adhere strictly to Part 2 confidentiality, and to keep a policy that puts an end date on every release form. Part 822.8 says patient records may only be disclosed consistent with HIPAA and Part 2. Certified means bound, whatever the federal-assistance analysis says.

Where Part 2 Stays Stricter, Line by Line

Read the right-hand column as the work list. Nothing in it is a server purchase. Almost all of it is a form, a contract, a template, or a setting inside software you already own. Budget for configuration and paperwork, not for a systems project.

Consent. One Form Now, Still a Form

The biggest change in the 2024 rule is the single consent. Under 42 CFR 2.31, a patient can sign once for all future treatment, payment, and health care operations. The recipient can be described as “my treating providers, health plans, third-party payers, and people helping to operate this program.” The purpose can read, simply, “for treatment, payment, and health care operations.” The expiration can be “end of the treatment” or “none.” That is a great deal closer to HIPAA than the old regime, where a program needed a fresh, specific consent for nearly every disclosure.

Closer is not the same. The form still has ten required elements, including the patient’s name, who may disclose, what information, to whom, for what purpose, the right to revoke, an expiration, a signature, a date, and two statements HIPAA never asks for. One says the records may be redisclosed by the recipient and lose Part 2 protection. The other explains the consequences of refusing to sign. A TPO consent to a covered entity has to state that the records may be redisclosed under HIPAA except for use in civil, criminal, administrative, or legislative proceedings against the patient. And SUD counseling notes, the clinician’s notes from a private counseling session kept apart from the rest of the record, need their own consent that cannot be combined with any other consent, and treatment cannot be conditioned on signing it.

From the IT side, a consent is a data object with a lifecycle. It gets created, attached to a record, honored, revoked, and produced on demand. Section 2.25 gives patients the right to an accounting of every consented disclosure in the three years before they ask. The separate accounting of TPO disclosures made through an EHR has a compliance date that HHS has tolled until it revises the matching HIPAA provision, but the consent-based accounting is live. So the questions for the EHR are concrete. Where does the signed consent live. Is it linked to the disclosures it authorized. Can the front desk see whether a consent has been revoked before they fax anything. Can you produce, three years from now, the consent that covered a specific release.

The vendor answers are thinner than the marketing. SimplePractice added Part 2 language to its default Notice of Privacy Practices only for accounts created on or after May 27, 2026, and older accounts have to edit their own. TherapyNotes published NPP guidance in February 2026 and likewise leaves existing customers to update their own notice. Neither publishes a consent-scoping feature. ICANotes markets Part 2 compliance and fields that are not shared outside the treatment team without consent. Kipu’s published agreement carries the Part 2 acknowledgments in its text. Qualifacts says CareLogic adheres to Part 2. The two platforms my team has direct experience supporting in this space are AccuCare and PointClickCare, and with any of these the useful question is not whether the vendor says “Part 2 compliant.” It is whether you can show me the consent record, the revocation flag, and the disclosure log inside the product.

The Notice That Has to Travel With the Record

Section 2.32 has two requirements for every consented disclosure. A copy of the consent, or a clear explanation of its scope, goes with the record. So does a written statement. The long form opens with “This record which has been disclosed to you is protected by Federal confidentiality rules (42 CFR part 2).” It tells the recipient they may not use or disclose the record in any proceeding against the patient. It adds that a general authorization for release of medical information is not enough to redisclose it. The short form is one sentence. “42 CFR part 2 prohibits unauthorized use or disclosure of these records.”

That statement has to be on the fax cover sheet, in the portal export, in the email template, and in the records-release packet, without exception. In practice it is a template problem, and template problems get solved once and then forgotten, which is exactly what you want. Build it into whatever produces outbound records and stop relying on a person to remember it.

Court Orders, Subpoenas, and Why Your Vendors Are in It

This is the difference practices underestimate. Section 2.12(d)(1) bars the introduction of a Part 2 record, or testimony about it, into evidence in any criminal prosecution or civil action before a federal or state court, absent patient consent or a court order under subpart E. That bar follows the record. It applies to any person who obtains it from a Part 2 program, a covered entity, a business associate, an intermediary, or another lawful holder. Under section 2.64 a court can only enter such an order on a finding of good cause, which requires that other ways of getting the information are unavailable or would not be effective, and that the public interest outweighs the injury to the patient and to the treatment relationship.

A subpoena is not a court order under subpart E. That one sentence has kept a lot of records in the drawer where they belonged, and it is the sentence the front desk needs to know before the process server arrives. Route every legal request to counsel. Do not let anyone with export rights in the EHR answer one.

The part that reaches your vendors is in the definition of a qualified service organization, below. A vendor that holds the records has agreed, in writing, to resist efforts to reach them in judicial proceedings. Whoever runs your backup and disaster recovery is in that chair. So is your EHR host. So is whoever runs your email.

QSOA Versus BAA. The Contract Your IT Provider Has to Sign

HIPAA has business associates. Part 2 has qualified service organizations, and the two are not interchangeable. Under section 2.11 a QSO is a person who provides services to a Part 2 program. The rule lists data processing first. To qualify, the vendor has to sign a written agreement with two acknowledgments. That in receiving, storing, processing, or otherwise dealing with any patient records it is fully bound by Part 2. And that, if necessary, it will resist in judicial proceedings any efforts to obtain access to patient identifying information. The 2024 rule added that a QSO includes anyone who meets the HIPAA definition of a business associate for a Part 2 program that is also a covered entity. Communications between the program and a QSO do not need patient consent. That is what makes the arrangement work.

Look at what the standard BAA is missing. It binds the vendor to HIPAA. It does not bind the vendor to Part 2, and it says nothing about resisting a court. HHS’s own materials do not say a BAA alone satisfies Part 2, and the definition above makes it hard to read one that way. The cleanest evidence of how this is handled in practice is the OASAS template. It is a single Qualified Service Organization and Business Associate Agreement. It states that it constitutes a QSOA under 42 CFR Part 2, and it requires the vendor to resist any effort in judicial proceedings to obtain access to the protected information. One document, both sets of obligations.

Who needs one. Your EHR vendor. The company hosting or backing up the EHR if that is someone else. Your email and file platform, where Microsoft and Google sign a BAA by default and the Part 2 acknowledgments are yours to obtain. Your billing service, your transcription or AI scribe, your answering service, and your IT provider. VJNetworks signs a BAA with every healthcare client, and for a Part 2 program the agreement carries the Part 2 acknowledgments as well. HHS also states that a QSO may submit a breach report on the program’s behalf, which is a useful thing to have already agreed in writing before anyone needs it. Ask each vendor for the two acknowledgments before the first backup runs. A provider that hesitates over the resist clause is telling you something. We wrote separately about what HIPAA actually requires from your IT provider, and the vendor test in that post is the HIPAA half of this one.

Exchanges are the same conversation with more parties. The SHIN-NY privacy policies, revised January 2025, state that protected health information subject to Part 2 shall not be disclosed without affirmative consent unless Part 2 specifically allows it. New Jersey’s exchange runs a statewide electronic consent management system that lets patients create, edit, and revoke consent for the same purpose. If your program participates in either, the consent form has to name the intermediary, and the rule limits a general designation to participants with a treating relationship to the patient.

Security Under 2.16. What the Rule Says About Your Systems

Section 2.16 is short and specific. A program must have formal policies and procedures to protect against unauthorized use and disclosure and against reasonably anticipated threats to the security of patient identifying information. For paper, that covers transfer, removal, destruction including sanitizing the media, storage in a secure room, locked file cabinet, safe, or similar container, and access to workstations and rooms. For electronic records, it covers creating, receiving, maintaining, and transmitting them, destroying them including sanitizing the media so the information is non-retrievable, using and accessing them, and de-identifying them to the HIPAA standard at 45 CFR 164.514(b). The rule’s definition of a record expressly includes billing information, emails, voice mails, and texts.

Notice what is absent. There is no encryption mandate, no MFA mandate, and no training mandate in 2.16 itself. The preamble says HHS anticipates programs will train their workforce on the changes, and OASAS block-grant requirements call for employee education on confidentiality, but the text of 2.16 is a policies-and-procedures requirement. What gives it teeth is 2.16(b), which applies the HIPAA breach notification rule to Part 2 records. Add the fact that nearly every Part 2 program is also a HIPAA covered entity. That brings the full Security Rule with it, the risk analysis, the addressable encryption, and the proposed 2025 rewrite that would make MFA and encryption mandatory outright. We covered that rewrite and the controls insurers already require in our healthcare cybersecurity program. The Part 2 additions are narrower and more physical. Where are the paper files. Who has the key. How is a retired laptop wiped, and where is the certificate. Which texts and voicemails are records, and are they inside the backup and the retention policy or sitting on a personal phone.

The 2024 rule also removed a myth that cost programs real money. Section 2.12(d)(2)(i)(C) now states that a program or covered entity receiving records under a single TPO consent is not required to segregate or segment them. You do not need a second EHR. What you need is the ability to say which records are Part 2 and which consent covers them, and the ONC certification criteria for security tags on summary-of-care documents exist so a certified EHR can mark a record as restricted, at the document, section, or entry level, when it leaves. For a small program that means one thing to verify. Does your EHR carry the restriction when it exports, or does the record go out clean.

Breach Notification and Penalties Now Match HIPAA

Before 2024, a Part 2 violation was a criminal matter, and there was no civil enforcement mechanism at all. The CARES Act changed the statute and the 2024 rule implemented it. Section 2.3 now applies the HIPAA civil and criminal penalty provisions to Part 2 violations, and the HIPAA Enforcement Rule applies to programs and their QSOs in the same manner as to covered entities and business associates. The January 2026 inflation adjustment put the tiers at $145 to $73,011 per violation for a violation the program did not know about, and $73,011 to $2,190,294 for willful neglect left uncorrected, with a $2,190,294 calendar-year cap on identical provisions.

Breach notification runs on the HIPAA clock. Individuals within 60 days of discovery. HHS at the same time for a breach of 500 or more, through the same portal used for HIPAA breaches, which now keeps a separate public list of Part 2 breaches. Smaller breaches are logged and reported within 60 days of the end of the calendar year. Patients can now complain directly to the Secretary. Before February, they could not.

The breaches are already happening to programs this size. NADAP, a New York nonprofit that assesses and refers people to SUD treatment, disclosed an incident detected in January 2026 affecting up to 90,000 individuals, including diagnoses and Social Security numbers. Legacy Treatment Services in New Jersey reported an October 2024 intrusion reaching 41,826 people, with diagnoses, treatment details, and prescription information. American Addiction Centers, which operates Sunrise House in New Jersey, was hit in September 2024 with 410,747 patients affected. And Top of the World Ranch, an Illinois SUD treatment center, paid $103,000 to OCR in February 2026 over a phishing attack on one email account. That last one was a HIPAA Security Rule case. The next one like it can be a Part 2 case too.

The reason the rule exists is the reason the records are worth protecting. HHS’s fact sheet says confidentiality protections address the concern that discrimination and fear of prosecution deter people from entering treatment. The preamble lists what commenters saw happen when records got out. Criminal justice, housing, life insurance, loans, employment, licensure. A stolen diagnosis code is a problem. A stolen SUD treatment history can cost someone a job or a custody case, and an attacker knows the second one is worth more.

The Patient Notice and the Website

Section 2.22 requires the program to tell each patient at admission that federal law protects the confidentiality of substance use disorder records. It also requires a plain-language notice headed “Notice of Privacy Practices of [Name of Part 2 Program].” That notice explains the single TPO consent, the bar on use in proceedings, the patient’s rights, and the program’s duties, breach notification included. A program with a website must prominently post the notice on it. If the first service is delivered electronically, the notice has to go out automatically and at the same time. Programs that are also covered entities may combine it with the HIPAA Notice of Privacy Practices, and OCR publishes a model Part 2 notice to start from.

This is the item most likely to be half done. The EHR vendors updated their default templates for new accounts and told existing accounts to do it themselves. The website is usually managed by someone who has never heard of Part 2. Check both. It takes an afternoon.

Where to Start

In order, because each step depends on the one before it.

1. Decide, in writing with your attorney, whether you are a Part 2 program, and for which units or staff. Everything else keys off that answer.
2. Rebuild the consent form to the ten elements in 2.31, with the single TPO option, the redisclosure and refusal statements, and a separate consent for SUD counseling notes.
3. Put the 2.32 statement on every path a record can leave by. Fax cover, portal export, email template, release packet.
4. List every vendor that holds or touches the records and get the two QSO acknowledgments into each agreement. Your IT provider included.
5. Configure the EHR so consents are stored with dates and revocations, linked to disclosures, and so counseling notes sit in their own area with narrower access.
6. Update the Notice of Privacy Practices to a combined Part 2 notice, post it on the website, and add it to the intake packet.
7. Fold Part 2 into the breach plan. Same 60-day clock, same portal, and decide now whether a QSO reports on your behalf.
8. Train staff on the changes. The SAMHSA-funded Center of Excellence for Protected Health Information publishes complete training packages at no cost.

Eight steps. One of them needs a lawyer, one needs a trainer, and six of them are configuration and paperwork that an IT provider who understands the rule can carry. A risk assessment that reads 2.16 alongside the HIPAA Security Rule is the fastest way to find out which of the eight are already done.

Questions Programs Ask Once They Read the Rule