42 CFR Part 2
42 CFR Part 2 is the federal regulation that protects the confidentiality of substance use disorder treatment records created by federally assisted programs, limiting how those records can be used and disclosed.
Also called Part 2, Confidentiality of Substance Use Disorder Patient Records
- Last reviewed
- 4 sources, linked
- 5 related terms
What it means
It applies to a Part 2 program: one that holds itself out as providing, and provides, substance use disorder diagnosis, treatment or referral for treatment, and is federally assisted. Federal assistance is read broadly. Medicare participation, a DEA registration to dispense a controlled substance used for treatment, federal funding and tax-exempt status can each qualify.
A 2024 final rule, published in the Federal Register on February 16, 2024, brought Part 2 closer to HIPAA. Patients can now give a single consent for future treatment, payment and health care operations disclosures, the HIPAA breach notification rule applies to Part 2 records, and HIPAA's civil and criminal enforcement replaces Part 2's old penalties. The general compliance date was February 16, 2026.
The core protection stayed, and the rule widened it: Part 2 records and testimony cannot be used in civil, criminal, administrative or legislative proceedings against the patient without the patient's consent or a court order. And a patient includes anyone who has applied for diagnosis, treatment or referral at a Part 2 program, not only people who were admitted.
Why it matters for your website
Most of Part 2 lives in your records and billing systems, but the website is where an application can begin. A contact or insurance verification form that collects a name next to a request for addiction treatment deserves Part 2 care: no advertising pixels on the page, submissions routed only to systems under agreement, and a privacy notice that matches what you actually do.
Do not assume a HIPAA-ready setup is enough. Part 2 can be stricter, and whether submitting a particular form makes someone a patient is a question for your attorney.
Sources
The facts on this page about a law, a regulator, a clinical standard or a platform come from these sources. Each link opens the original in a new tab.
- Cornell Law School, Legal Information Institute42 CFR § 2.11, Definitions (Part 2 program, patient, records) (opens in a new tab)
- Cornell Law School, Legal Information Institute42 CFR § 2.12, Applicability (federally assisted) (opens in a new tab)
- Federal RegisterConfidentiality of Substance Use Disorder (SUD) Patient Records, final rule, February 16, 2024 (opens in a new tab)
- U.S. Department of Health and Human ServicesFact Sheet: 42 CFR Part 2 Final Rule (opens in a new tab)
Last reviewed
This entry explains a rule so you can plan a website around it. It is not legal advice: for a decision about your own program, ask a healthcare attorney.
See how your own site handles it
Send your URL for the free funnel review. Within two business days you get a 3-minute video on the page your traffic lands on, the three places it is losing inquiries, and what ChatGPT and Perplexity say about your center. It is free, and no call is attached.