42 CFR Part 2 Therapy Guide: Consent and Mixed Records

The intake form lists alcohol use disorder. The group roster shows three members in IOP. Billing wants the claim out today, and a hospital just called for records. The question is not “do we care about privacy.” The question is whether these are ordinary mental-health notes under HIPAA or 42 CFR Part 2 therapy records with stricter federal confidentiality rules.

This guide translates the 2024 Part 2 final rule and the February 16, 2026 compliance date into 42 CFR Part 2 therapy workflows: program status, consent, redisclosure notices, SUD counseling notes, breach handling, and mixed records. It is educational guidance for US mental-health clinicians and practice leaders, not legal advice.

What Part 2 confidentiality actually covers

42 CFR Part 2 is the federal Confidentiality of Substance Use Disorder Patient Records regulation. HHS, through SAMHSA and the Office for Civil Rights, issued the 2024 final rule to implement CARES Act section 3221 and align certain Part 2 elements with HIPAA while preserving core SUD protections. The complete regulation lives at 42 CFR Part 2 on eCFR.

Part 2 does not attach to every chart that mentions cannabis, alcohol, or a past detox. It protects qualifying records connected to a federally assisted Part 2 program. In broad terms, that usually means a program that is federally assisted and either:

1. Holds itself out as providing, and provides, SUD diagnosis, treatment, or referral for treatment, or
2. Has staff whose primary function is SUD diagnosis, treatment, or referral for treatment

Opioid treatment programs, dedicated SUD units inside larger clinics, and IOP tracks advertised as substance-use treatment often sit inside this frame. A general outpatient therapist who occasionally addresses drinking inside broader anxiety work may not. Mixed-use facilities need a fact-specific determination, not a hallway guess.

When Part 2 applies, HIPAA still matters if you are a covered entity. Part 2 is the additional confidentiality layer for covered SUD records, not a replacement for every HIPAA duty.

For recovery facilitation technique, stay on the group therapy resource hub. For claim ops once confidentiality pathways are clear, use insurance billing for therapists. For the wider compliance cluster, start at the compliance resource hub.

Educational resource for licensed US mental-health clinicians and practice leaders. Part 2 and HIPAA materials change. Verify current HHS OCR and SAMHSA materials, your program structure, and qualified counsel before you rely on any checklist.

Recovery and group workflow framing reviewed by Priya Mehta, Group & Recovery Therapy Editor.

2024 final rule timeline therapists should date in the policy binder

Milestone	Date	Practice meaning
Federal Register publication	February 16, 2024	Official final-rule text and preamble (89 Fed. Reg. 12472) implementing CARES Act section 3221
Effective date	April 16, 2024	Amendments were in effect; implementation could begin
Compliance date	February 16, 2026	Persons subject to the rule must meet applicable requirements

If your consent forms, redisclosure stamps, patient notices, breach playbook, and staff training still reflect pre-2024 Part 2 habits, treat that as an open compliance task, not a footnote.

Part 2 versus HIPAA decision tree

Use this tree before anyone shares SUD-related content outside the original treatment team.

1. Is the record from a federally assisted Part 2 program?
   If no, manage ordinary PHI under HIPAA, state law, and your license board. Stop the Part 2 path unless you are a lawful holder of Part 2 records received from someone else.

2. If yes, is the content a Part 2 record (or information that would identify a patient as having or having had an SUD from that program)?
   If no, apply ordinary HIPAA/state pathways. If yes, continue.

3. Is there a valid patient consent that covers this recipient and this purpose?
   Check whether the consent is a single TPO consent, a narrower consent, a separate legal-proceeding consent, or a separate SUD counseling-notes consent. Wrong consent type means stop.

4. Is disclosure allowed without consent under a narrow Part 2 exception?
   Examples can include certain medical emergencies, required crime reporting on program premises, research under rule conditions, audit and evaluation, or a qualifying court order pathway. Do not invent an exception from memory. Confirm the current regulatory basis and document the facts.

5. If disclosing with consent, will the package include the required redisclosure notice and consent scope?
   The short notice language under the final rule is: “42 CFR Part 2 prohibits unauthorized use or disclosure of these records.” Policies should also cover sending a copy of the consent or a clear explanation of scope.

6. Is the recipient a HIPAA covered entity or business associate redisclosing under a TPO consent?
   They may redisclose as HIPAA allows for TPO, except proceedings against the patient still need separate patient consent or a qualifying court-order path. Your outbound packet should still make Part 2 status obvious.

7. Are state laws stricter?
   Apply the more protective rule when state confidentiality law is tighter. Part 2 is a federal floor for covered SUD records, not a license to ignore state overlays.

Print this tree on the mixed-record checklist. The goal is a stop/go decision a covering clinician can reconstruct later.

Consent workflows after the 2024 Part 2 rewrite

Single TPO consent

Patients may still need to consent before TPO disclosures of Part 2 records, but the final rule allows a single consent for all future uses and disclosures for treatment, payment, and health care operations. That is the operational change many therapy practices care about most.

What to verify on the form:

• Required Part 2 consent elements, including how the patient may revoke
• Whether recipients may be named as a person or class of persons when the rule allows that flexibility
• Purpose language that matches TPO if you intend a broad TPO consent
• Effective date, expiration if any, and patient signature process your EHR can store

What not to do:

• Combine TPO consent with consent for use in legal proceedings against the patient
• Combine ordinary record consent with consent for SUD counseling notes
• Treat a portal “I agree” checkbox as a Part 2 consent without confirming the form elements

Redisclosure notice and consent package

Disclosures with consent need the updated notice to accompany disclosure. Build the notice into the release packet so staff cannot send the chart alone. For group and IOP settings under 42 CFR Part 2 therapy programs, train facilitators and admins that “the hospital already treats this client” is not a substitute for the packet rules.

Patient notice of federal confidentiality requirements

Part 2 programs must give patients a notice of federal confidentiality requirements. The 2024 rule further aligned that notice with HIPAA Notice of Privacy Practices concepts for dual-regulated programs. If you are both a Part 2 program and a HIPAA covered entity, revise the NPP and Part 2 patient notice together so clients do not get contradictory stories at intake.

SUD counseling notes

The final rule recognizes SUD counseling notes: clinician notes from an SUD counseling session kept separate from the rest of the patient record, analogous to HIPAA psychotherapy notes. If your program uses them:

• Store them apart from the designated record set the team uses for routine care and billing
• Require separate written consent for their use and disclosure
• Train staff not to paste process material into ordinary progress notes “for convenience”

If you do not maintain SUD counseling notes, say so in policy so nobody invents a hybrid note type mid-crisis.

Mixed-record workflow when Part 2 and ordinary PHI share a chart

Most real practices are mixed. One client may have anxiety notes, a medication list, an IOP attendance roster, and a Part 2-covered SUD treatment episode in the same enterprise chart.

The 2024 rule reduces pressure to keep a fully separate database for Part 2 content. It does not reduce the need for disclosure discipline.

Mixed-record checklist (use before any external share)

1. Program status. Is the source service a Part 2 program service or ordinary outpatient therapy?
2. Record class. Progress note, group note, labs, claims data, SUD counseling notes, or all of the above?
3. Identifiers. Would the disclosure identify the person as having or having had an SUD from a Part 2 program?
4. Consent on file. TPO single consent, limited consent, legal-proceeding consent, SUD counseling-notes consent, or none?
5. Recipient and purpose. Treatment team, payer, family, school, court, HIE, quality auditor, or law enforcement?
6. Pathway. Consent package, exception, court order path, or stop and escalate?
7. Notice package. Redisclosure notice plus consent copy or scope explanation attached?
8. Minimum necessary. Only the fields required for the stated purpose?
9. State overlay. Any tighter state SUD confidentiality rule?
10. Documentation. Who decided, what pathway, what was sent, date/time, and where the packet is filed?

Group, IOP, and recovery-program notes

In recovery groups and IOP, facilitators often hold the richest SUD narrative: slips disclosed in circle, family conflict, housing risk, medication-assisted treatment status. That richness is clinically useful and legally sensitive.

Practical group controls:

• Separate the shared group frame from each member’s individual response in the chart
• Do not paste another member’s identity into a peer’s note
• Confirm whether group notes are Part 2 records for your program before any external release
• Align continuity between individual substance-use counseling and group without informal texting of protected details
• Keep court, probation, and employer requests on a legal pathway, not a facilitator favor

For technique selection inside the room, use recovery and group resources. For the federal confidentiality path around those rooms, use this guide.

Breach handling when Part 2 records are in scope

The final rule applies HIPAA breach-notification requirements to breaches of Part 2-protected records. That means your therapy practice should not invent a separate “Part 2-only” incident playbook. Extend the existing incident file:

• Discovery log and containment
• Four-factor risk assessment for unsecured PHI when HIPAA applies
• Counsel and carrier notice when the facts warrant
• Individual, HHS, and media notice tracks when required
• Explicit notation that Part 2 records or lawful-holder duties were involved

Use HIPAA breach notification for therapists for the timeline worksheet. Use this page to force the Part 2 status question into hour one of the incident.

Vendors, HIEs, and AI documentation tools

Before SUD content enters a vendor system:

• Confirm Business Associate Agreement status when HIPAA applies
• Ask how the product captures Part 2 consent status and redisclosure notices
• Ask whether SUD counseling notes can be isolated if you use them
• Ask what happens in HIE or network exchange defaults (automatic share vs hold-back)
• Confirm training, retention, and export behavior for identifiable session content

Software labels such as “behavioral health ready” are marketing. Your checklist is the control.

Emosapien is built for mental-health clinicians, keeps clinician review before sign-off, and offers a Business Associate Agreement on Professional and Enterprise plans. Product tooling still does not decide Part 2 program status or replace counsel on high-risk disclosures. If you want documentation support inside a review-first workflow, start a free trial.

Download the Part 2 versus HIPAA checklist

The printable worksheet combines the decision tree and the mixed-record disclosure checklist: program status, consent type, redisclosure notice, exception path, state overlay, and a dated decision log. It is an educational handout, not a certification and not a substitute for counsel when program status or court process is unclear.

Closing checklist for Part 2 programs

1. Write a one-page determination of whether each service line is a Part 2 program, ordinary outpatient care, or mixed.
2. Update consent forms for revocation language, TPO single-consent options, and prohibited combinations.
3. Update redisclosure notices and patient confidentiality notices, including NPP alignment for dual-regulated programs.
4. Decide whether the program maintains SUD counseling notes and configure storage accordingly.
5. Train intake, clinicians, group facilitators, billers, and release-of-information staff on the stop/go tree.
6. Add Part 2 status to the breach playbook and vendor inventory.
7. Re-check state SUD confidentiality overlays on the same cadence as your annual HIPAA review.
8. File the dated policy pack where a covering clinician can find it at 6pm on a Friday.

42 CFR Part 2 therapy compliance is not a poster in the break room. It is the boring packet that lets a hospital request, a payer audit, or a group disclosure stay inside a documented pathway. That is the standard this checklist is built to support.

References

• U.S. Department of Health and Human Services. Fact Sheet: 42 CFR Part 2 Final Rule (2024 rule overview; compliance by February 16, 2026).
• U.S. Department of Health and Human Services. Understanding Confidentiality of Substance Use Disorder Patient Records.
• Electronic Code of Federal Regulations. 42 CFR Part 2 (current Part 2 text).
• Federal Register. Confidentiality of Substance Use Disorder (SUD) Patient Records (89 Fed. Reg. 12472, Feb. 16, 2024).
• Center of Excellence for Protected Health Information (SAMHSA-funded). Implementation Fact Sheet: 3 Key Steps for Implementing the Latest Changes to 42 CFR Part 2 (consent, notices, policies, training; effective April 16, 2024; compliance February 16, 2026).