Substance use disorder programs
42 CFR Part 2 is a different standard, and it is already being enforced.
Feb 16
2026
The compliance date has passed. The 2024 Final Rule aligning 42 CFR part 2 with HIPAA took effect April 16, 2024 with a compliance date of February 16, 2026. HHS Office for Civil Rights opened its civil enforcement program the same day and began accepting Part 2 complaints and breach notifications.
For a program that has not yet revisited its consents, redisclosure notices, patient notice, breach response, and safeguards policy, this is no longer preparation for a future deadline. The obligations are in force, and the enforcement scheme behind them is borrowed from HIPAA. Where that leaves any particular program is a question for that program and its counsel.
Who this applies to. A part 2 program is a federally assisted program that holds itself out as providing substance use disorder diagnosis, treatment, or referral (42 CFR 2.11). Federal assistance is defined broadly at 42 CFR 2.12: DEA registration, Medicare or Medicaid participation, block grant funds passed through the state, or 501(c)(3) status each satisfy it independently. In practice nearly every Washington residential substance use disorder provider is covered.
The common mistake
“Part 2 just follows HIPAA now.” It does not.
The 2024 rule made Part 2 consent reusable. It did not make it optional. Six places the two regimes still diverge, and each one is a live exposure:
Consent is still required for treatment, payment and operations
The single biggest operational gap, and the one most often gotten wrong.
- 42 CFR 2.31: Consent requirements. HIPAA permits treatment, payment and health care operations disclosures with no authorization at all. Part 2 requires written consent meeting the elements of this section first.
- 42 CFR 2.33: Uses and disclosures permitted with written consent. A single consent can now cover all future TPO uses until the patient revokes it in writing. That is the change. The consent itself is not optional.
Records cannot be used against the patient in proceedings
There is no HIPAA analogue for this, and it is the one that surprises counsel.
- 42 CFR 2.13: Confidentiality restrictions and safeguards. Records may not be used or disclosed in any civil, criminal, administrative or legislative proceeding conducted by any federal, state or local authority.
- 42 CFR 2.12: Applicability. That restriction applies to any person who obtains the record, not only to the program that created it.
- 42 CFR 2.33: The bar survives lawful redisclosure. A covered entity that receives the record may pass it on under HIPAA, except for proceedings against the patient.
A subpoena is not enough
Under HIPAA a qualifying court order generally suffices. Under Part 2 the order has to meet Part 2's own criteria.
- 42 CFR 2.64: Orders authorizing uses and disclosures for noncriminal purposes.
- 42 CFR 2.65: Orders authorizing use and disclosure of records to criminally investigate or prosecute patients.
- 42 CFR 2.66: Orders authorizing use and disclosure to investigate or prosecute a part 2 program.
Every disclosure carries a notice
HIPAA has no equivalent. It is a small requirement that generates findings because nobody built it into the workflow.
- 42 CFR 2.32: Notice and copy of consent to accompany disclosure. Each disclosure travels with either the long-form notice or the short form, plus a copy of the consent or a clear explanation of its scope.
Breach notification and penalties now run on HIPAA rails
This is what changed the stakes. The obligations are stricter than HIPAA, and the consequences are now the same size.
- 42 CFR 2.16: Security for records and notification of breaches. The HIPAA Breach Notification Rule at 45 CFR part 164 subpart D applies to part 2 programs in the same manner as it applies to a covered entity.
- 42 CFR 2.3: Civil and criminal penalties for violations. Part 2 violations now carry HIPAA's civil money penalties and criminal penalties, and 45 CFR part 160 subparts C, D and E govern noncompliance.
Even acknowledging the patient is there requires consent
Front desk, phone, visitor log. This is a training problem more than a policy problem.
- 42 CFR 2.13: Presence at a facility publicly identified as providing only substance use disorder services may be acknowledged only with the patient's written consent. HIPAA's facility directory rule is an opt-out regime; this is opt-in.
- 42 CFR 2.14: Minor patients. Where state law lets a minor obtain treatment on their own, the consent may be given only by the minor.
Where the state rule hands off to the federal one. WAC 246-341-0425 requires a behavioral health agency to keep individual service records for six years after the most recent discharge, and to release them only in compliance with applicable state and federal law. For a federally assisted substance use disorder program, the release standard that sentence points to is 42 CFR part 2, not the WAC. An agency whose release policy stops at the state rule has not answered the question.
Bright Rowan signs a Business Associate Agreement before handling protected health information, and works to Part 2 standards on substance use disorder records. See how we handle your information.