42 CFR Part 2
42 CFR Part 2 is a federal regulation that gives special confidentiality protection to the records of patients treated for substance use disorders by federally assisted treatment programs, generally requiring patient consent before those records are disclosed.
Updated
42 CFR Part 2 (often shortened to "Part 2") is the section of the federal Code of Federal Regulations that governs the confidentiality of substance use disorder (SUD) records. It applies to "Part 2 programs" — individuals or entities that are federally assisted and hold themselves out as providing SUD diagnosis, treatment, or referral for treatment. The regulation is administered by the Substance Abuse and Mental Health Services Administration (SAMHSA), part of the U.S. Department of Health and Human Services.
The core idea is that information identifying a person as having sought or received SUD treatment is protected more tightly than ordinary health information. Historically, Part 2 generally required specific patient consent before such records could be shared, including for many treatment, payment, and health care operations purposes, with narrow exceptions defined in the rule (for example, certain medical emergencies, audits, or court orders that meet the regulation's requirements). Because the framework has been revised over time, the exact consent standards, permitted disclosures, and how closely they track HIPAA depend on the version of the rule in effect and its implementation date — the authoritative text and effective dates should be confirmed with SAMHSA and HHS.
Part 2 sits alongside the HIPAA Privacy Rule rather than replacing it. A program subject to both must satisfy each set of requirements, and where they differ, follow the more protective standard for the records Part 2 covers.
In practice
In the medical billing and revenue cycle context, Part 2 matters because claims, remittance data, and patient statements can reveal that a person received SUD treatment. Programs and their billing partners typically build consent, disclosure-tracking, and re-disclosure safeguards into their workflows so that records covered by Part 2 are not shared with payers, clearinghouses, or other parties beyond what the applicable consent and the rule permit. Whether a specific disclosure for billing or payment is allowed depends on the version of the rule in force, the scope of the patient's consent, and the program's own policies.
Because Part 2 obligations turn on facts — whether an entity qualifies as a Part 2 program, what the signed consent authorizes, and which regulatory version applies — organizations generally confirm requirements against the current SAMHSA regulation and HHS guidance rather than assuming a single universal rule. Prohibitions on re-disclosure and requirements for notices accompanying disclosed records are common areas of attention, but the precise obligations vary by situation and effective date.
Commonly confused with
- HIPAA Privacy Rule: HIPAA sets a baseline privacy standard for protected health information generally; 42 CFR Part 2 adds heightened, more specific protections for substance use disorder records held by federally assisted SUD programs. An entity can be subject to both, and the two frameworks have been the subject of alignment efforts over time.
- State behavioral health confidentiality laws: States have their own privacy laws covering mental health and SUD information. Part 2 is federal; state law may impose additional or different requirements, and providers generally follow the more protective applicable standard rather than assuming Part 2 alone controls.
- 42 CFR (the code) generally: 42 CFR is the broad Title 42 of the Code of Federal Regulations covering many public health programs; "42 CFR Part 2" refers specifically to the SUD confidentiality regulation, not to Title 42 as a whole.