What Part 2 covers
Part 2 rests on a federal statute (42 U.S.C. 290dd-2) and its regulation. It applies to any federally assisted program that provides SUD diagnosis, treatment, or referral for treatment. HHS calls these Part 2 programs. Some requirements also reach those who receive Part 2 records. Examples are other health care providers, qualified service organizations, HIPAA covered entities and business associates, and intermediaries (HHS Part 2 overview).
In general, a Part 2 program cannot share information that identifies someone as having, or having had, a substance use disorder unless Part 2 permits it. With limited exceptions, such as emergency medical treatment, a program may share a record in two cases. One is the patient’s written consent. The other is a court order and subpoena (or similar legal mandate).
What changed: the CARES Act and the 2024 final rule
The 2020 CARES Act amended the underlying statute to align Part 2 more closely with HIPAA and the HITECH Act. HHS published the 2024 final rule to carry out those changes. Together, per HHS, they give Part 2 these features:
- A single consent for treatment, payment, and health care operations. HHS calls this a TPO consent, and it can cover all future uses and disclosures of Part 2 records for those purposes.
- Redisclosure under HIPAA. A HIPAA-regulated entity that receives a Part 2 record with a TPO consent can share it again without further consent. It can do so in all the ways HIPAA allows, except in legal proceedings against the patient.
- A ban on using SUD records against a patient in legal proceedings without the patient’s consent or a court order and subpoena. The rule sets requirements for the court orders that can permit it.
- Breach notification. Part 2 programs must notify affected individuals, the HHS Secretary, and in some cases the media when unsecured Part 2 records are breached.
- Civil and criminal penalties for violations, enforced through the HIPAA Enforcement Rule.
Dates to know
HHS gives these dates on its Part 2 page:
- April 16, 2024: the final rule took effect.
- August 25, 2025: the HHS Secretary delegated authority to administer and enforce Part 2 to the Director of the Office for Civil Rights.
- February 16, 2026: compliance with the final rule was required, and anyone can file a Part 2 complaint from that date.
Where Part 2 touches automated workflows
The points below are our reading of how those requirements land on software. Treat them as design prompts and check them with counsel.
Consent scope. A TPO consent covers treatment, payment, and health care operations. Store each consent with its scope, then check any use outside those purposes against the consent on file. A yes-or-no field loses that detail.
Record tagging. Part 2 attaches to the record, so the flag has to travel with it. If intake tags a record as Part 2 and billing, reminders, or reporting drop the tag, the protection stops at the first handoff.
Legal requests. Because Part 2 restricts use of SUD records in legal proceedings, route subpoena and records-request exports to a person. Do not automate them.
Breach scoping. Part 2 programs must report breaches of unsecured Part 2 records. Access logs that show who saw which record, and when, make the scope of a breach easier to establish.
Patient notices. HHS says Part 2 programs must give patients a notice covering Part 2 confidentiality requirements and patient rights. A program that is also a HIPAA covered entity may issue a combined notice. Onboarding flows should present the current version.
Questions to ask an automation vendor
Ask how the system marks Part 2 records and where that mark can be lost. Ask how it stores consent and what scope it records. Ask which subcontractors see Part 2 records, since HHS says some requirements reach business associates that receive them. Ask what the audit log records.
Our behavioral health automation page describes how we approach these builds, and our BAA guide covers the contract side. For the audit side, see HIPAA audit preparation for automated systems.
Sources
- Understanding Confidentiality of Substance Use Disorder (SUD) Patient Records or “Part 2”. HHS. Content last reviewed February 13, 2026.
We checked the HHS statements above against the linked pages on September 24, 2026. Where a paragraph gives our own advice, it says so. This post is general information, not legal advice. Confirm how these rules apply to you with your privacy officer and counsel.