The 2024 Part 2 Rule: What Treatment Programs Had to Change by February 2026

42 CFR Part 2 protects the confidentiality of substance use disorder treatment records held by federally assisted programs. For decades it ran on rules quite different from HIPAA, which forced programs to keep two sets of consent forms and two ways of thinking about disclosure. In March 2020, section 3221 of the CARES Act amended the underlying statute, 42 U.S.C. 290dd-2, to align parts of Part 2 with HIPAA, and HHS issued the final rule implementing it on February 16, 2024 (89 FR 12472).

The rule took effect April 16, 2024. The compliance date, by which "persons subject to this regulation must comply with the applicable requirements," was February 16, 2026. Programs still running on pre-2024 forms and notices are out of date. What follows is a summary for policy readiness, not legal advice; confirm your program's obligations with counsel.

Does Part 2 apply to your program?

Part 2 covers a "Part 2 program," meaning a federally assisted program that holds itself out as providing, and provides, substance use disorder diagnosis, treatment or referral for treatment (42 CFR 2.11, 2.12). "Federally assisted" is broad. A program qualifies if, among other things, it participates in Medicare, holds a federal authorization to conduct maintenance treatment or withdrawal management, holds a DEA registration to dispense a controlled substance used in SUD treatment, receives federal financial assistance in any form, or has federal tax-exempt status or tax-deductible contributions (2.12(b)). Opioid treatment programs are expressly required to comply (42 CFR 8.11(e)(3)).

The records covered are broad too: any information created, received or acquired by a Part 2 program relating to a patient, "including billing information, emails, voice mails, and texts" (2.11).

How did consent change?

The headline change is the single consent for treatment, payment and health care operations. A patient may now sign one consent for all future uses and disclosures for those purposes, and the recipient may be described generally, as "my treating providers, health plans, third-party payers, and people helping to operate this program" (2.31(a)(4)(i)). The consent stays in force until the patient revokes it in writing, and "end of the treatment" or "none" is a sufficient expiration for this purpose (2.31(a)(7); 2.33(a)(2)).

Once records reach a HIPAA covered entity or business associate under that consent, the recipient may redisclose them as HIPAA permits, except for use in civil, criminal, administrative or legislative proceedings against the patient (2.33(b)(1)). Because of that, a TPO consent must now tell patients two things: that records disclosed under it may be redisclosed and no longer protected by Part 2, and the consequences of refusing to sign (2.31(a)(10)). The detail is in Part 2 consent and the Patient Notice.

What are SUD counseling notes, and why do they matter?

The rule created a new category modeled on HIPAA's psychotherapy notes. SUD counseling notes are notes recorded by a SUD or mental health professional "documenting or analyzing the contents of conversation" during a private or group SUD counseling session, kept separate from the rest of the record. They exclude medication prescription and monitoring, session times, modalities, test results and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress (2.11).

Counseling notes need their own consent for almost any use or disclosure, and that consent may be combined only with another counseling-notes consent. A program may not condition treatment, payment, enrollment or eligibility on a patient signing one (2.31(b)). If clinicians keep separate process notes, the policy has to say so and the record system has to keep them separate.

What does the new Patient Notice require?

Section 2.22 now mirrors a HIPAA notice of privacy practices. It must open with a prescribed header, describe uses and disclosures with and without consent, state that the patient may give a single consent for TPO and may revoke consent, set out patient rights (including an accounting of disclosures for the past three years and the right to opt out of fundraising), describe the program's duties including breach notification, explain how to complain to the program and to HHS without retaliation, name a contact person with phone and email, and carry an effective date. It must be given no later than the first service, posted at the site where patients can read it without being identified, and posted on the program's website if it has one (2.22(c)).

Which new duties came with HIPAA alignment?

• Breach notification. HIPAA's breach notification rules now apply to breaches of unsecured Part 2 records "in the same manner" as they apply to covered entities (2.16(b)). See Part 2 breach notification and the complaint process.
• Security policies. Formal policies must cover paper and electronic records: transfer, destruction, secure storage, access and de-identification (2.16(a)).
• Complaints. A program must provide a process to receive complaints, may not retaliate against a patient for complaining, and may not require patients to waive the right to complain as a condition of treatment (2.4).
• Penalties and enforcement. Violations are now subject to the civil and criminal penalties in sections 1176 and 1177 of the Social Security Act, the HIPAA enforcement tiers, and HHS enforces under the HIPAA enforcement rule's procedures (2.3(a) and (c)).
• Accounting of disclosures. On request, a program must account for disclosures made with consent in the prior three years (2.25).

Did anything change for service providers and investigators?

Yes, in two ways that affect how a program deals with outsiders. First, the definition of a qualified service organization now includes a HIPAA business associate, for a Part 2 program that is also a covered entity (2.11). Second, an investigative agency gets a limited safe harbor if it acted with "reasonable diligence" before demanding records, which means searching SAMHSA's online treatment locator and any state database, checking the program's website or location, and viewing its Patient Notice or HIPAA notice, all within 60 days before the request (2.3(b)). In practice, an accurate listing and a posted Patient Notice help outsiders recognize that your records are protected.

Is HIPAA compliance enough now?

No. Alignment is partial. Part 2 still bars use of records in proceedings against the patient without specific consent or a court order (2.12(d); 2.22(b)(1)(ii)(H)), still requires its own consent elements and notice to accompany each disclosure (2.31, 2.32), and still has rules HIPAA lacks, such as the counseling notes consent and the limits on criminal investigation. A program that is also a HIPAA covered entity has to meet both sets of rules.

Which documents should a program have updated?

1. Consent forms: a TPO single consent, a specific-purpose consent, a counseling notes consent, and a proceedings consent that is never combined with others (2.31(d)).
2. The Patient Notice under 2.22, posted on site and online.
3. Security policies for paper and electronic records under 2.16(a).
4. A breach response procedure and log.
5. A complaint procedure with a non-retaliation statement.
6. Disclosure procedures using the 2.32 notice, and an accounting process.
7. Qualified service organization and business associate agreements.
8. Staff training records on all of the above.

How do we help, and where do we stop?

Our Part 2 Policy Alignment is $395, flat: policy and form templates for consent, the Patient Notice, complaints and breach response, written to the current rule and your program's services. It is policy readiness, not legal advice, and we recommend counsel review the final versions. We never receive patient records to do it. For programs rebuilding a whole manual, the Policy and Procedure Manual ($1,495) covers Part 2 alongside your state rule and accreditor; see writing a policy manual to the state rule and the accreditor.