Part 2 Consent and the Patient Notice

A Part 2 program may use or disclose a patient's substance use disorder records only as 42 CFR Part 2 permits, and for most disclosures that means written consent. The 2024 rule kept consent at the center but changed what a consent can do, and it rewrote the notice every patient receives. Because a disclosure "may not be made on the basis of a consent which ... on its face substantially fails to conform" to the required elements (42 CFR 2.31(c)), the forms themselves are a compliance risk. What follows is policy readiness, not legal advice.

What must every Part 2 consent contain?

A written consent may be on paper or electronic, and under 42 CFR 2.31(a) it must include:

1. The patient's name.
2. Who is authorized to make the use or disclosure, by name or specific identification, or a class of persons.
3. A description of the information to be used or disclosed, "in a specific and meaningful fashion."
4. The recipients, by name or class. For an intermediary, such as a health information exchange, the consent names the intermediary and either its member participants or a general designation limited to participants with a treating provider relationship with the patient.
5. Each purpose of the use or disclosure. "At the request of the patient" is enough when the patient initiates it; "for treatment, payment, and health care operations" is enough for a single TPO consent.
6. The patient's right to revoke the consent in writing, and how to do it.
7. An expiration date or event. "End of the treatment" or "none" is sufficient for a TPO consent.
8. The patient's signature, or the signature of an authorized person for a minor, a patient adjudicated as lacking capacity, or a deceased patient. Electronic signatures are allowed where no law prohibits them.
9. The date signed.

If the recipient is a HIPAA covered entity or business associate receiving records for treatment, payment or health care operations, the consent must also state that the record may be redisclosed as HIPAA permits, except for uses and disclosures in civil, criminal, administrative and legislative proceedings against the patient (2.31(a)(4)(iii)).

How does the single TPO consent work?

A patient may give one consent "for all future uses and disclosures for treatment, payment, and health care operations," and the recipients may be described as "my treating providers, health plans, third-party payers, and people helping to operate this program" or similar (2.31(a)(4)(i)). It remains in effect until the patient revokes it in writing (2.33(a)(2)). Two statements are required in every TPO consent: that records disclosed under it may be redisclosed by the recipient and no longer protected by Part 2, and what happens to the patient if they refuse to sign (2.31(a)(10)).

The TPO consent does not reach everything. Fundraising requires telling the patient of the right to opt out (2.31(a)(5)(iii)). SUD counseling notes need a separate consent that can be combined only with another counseling-notes consent, and treatment may not be conditioned on it (2.31(b)). A consent to use records in a civil, criminal, administrative or legislative investigation or proceeding may never be combined with any other consent (2.31(d)).

Who signs for a minor?

It depends on state law. If a minor can legally apply for and obtain SUD treatment alone under the state's law, any written consent may be given only by the minor, including consent to disclose to a parent for payment purposes (42 CFR 2.14(a)). Where state law requires parental consent to treatment, the rules differ (2.14(b)). Your consent policy should cite your state's rule and route forms accordingly.

Which statement travels with each disclosure?

Every disclosure made with consent must be accompanied by one of two written statements and by a copy of the consent or a clear explanation of its scope (42 CFR 2.32). The short form, "Statement 2," reads in full: "42 CFR part 2 prohibits unauthorized use or disclosure of these records." The long form explains the redisclosure limits and states that "a general authorization for the release of medical or other information is NOT sufficient." A release-of-information procedure that omits the statement is a gap even when the consent is perfect.

What must the Patient Notice say?

Every program must tell each patient, when they enter the program (or once they can understand, if they lack capacity at first), that federal law protects the confidentiality of SUD patient records, and must provide a plain-language written notice of its legal duties and privacy practices (42 CFR 2.22(a) and (b)). The required content now tracks a HIPAA notice of privacy practices:

• A prescribed header, beginning "Notice of Privacy Practices of [Name of Part 2 Program]," with the three statements about uses and disclosures, rights and complaints, and the right to a copy and to discuss it with a named contact.
• Uses and disclosures permitted without consent, described in enough detail, reflecting any stricter law; at least one example of uses that need consent; a statement that a single TPO consent is possible; a statement that other uses happen only with consent; and the right to revoke.
• The proceedings protection: records may not be used against the patient in civil, administrative, criminal or legislative proceedings without specific written consent or a court order, and a court order must come with a subpoena or similar mandate.
• Separate statements if the program will rely on HIPAA redisclosure by recipients or will fundraise.
• Patient rights: to request restrictions, to restrict disclosures to a health plan for services paid in full, to an accounting of disclosures for the past three years, to a list of an intermediary's disclosures, to a paper or electronic copy, to discuss the notice, and to opt out of fundraising.
• The program's duties, including to notify affected patients after a breach of unsecured records.
• How to complain to the program and to HHS, and a statement that the patient will not be retaliated against.
• A contact name or title, phone and email, and the notice's effective date.

When and where must the notice be provided?

No later than the first service delivery, including electronic service, or as soon as practicable after an emergency (2.22(c)(1)). A program with a physical site must keep copies available to take and must post the notice "in a clear and prominent location" where patients can read it "in a manner that does not identify the patient as receiving treatment or services for substance use disorder" (2.22(c)(2)). A program with a website must post it prominently there (2.22(c)(3)(i)). Email delivery is allowed if the patient agrees, with a paper copy if the email fails. When a first service is delivered electronically, the notice must go out automatically in response to the first request for service. A material change requires a prompt revision and redistribution (2.22(b)(3)).

The website posting has a second effect: the rule's safe harbor for investigators includes viewing a provider's Patient Notice before demanding records (2.3(b)(1)(iv)), so a visible notice helps outsiders recognize protected records.

Which mistakes do we see in forms?

• A HIPAA authorization used as a Part 2 consent, without the Part 2 elements.
• A TPO consent missing the redisclosure and refusal statements.
• A litigation or court consent folded into the general consent.
• No expiration date or event.
• A notice posted where reading it identifies the reader as a patient, or not posted online.
• A release log with no record of the 2.32 statement sent with each disclosure.

How do we help?

Our Part 2 Policy Alignment is $395: consent templates (TPO, specific purpose, counseling notes, proceedings), the 2.32 disclosure statement, a Patient Notice built to 2.22, and the posting and delivery procedure. These are policy templates, not legal advice; have counsel review them, especially the minor consent rules for your state. We work from blank forms and never receive patient records. The rest of the rule is in the 2024 Part 2 rule, and breach and complaint handling in Part 2 breach notification and the complaint process.