Substance Abuse Prevention and Control
42 CFR Part 2 Final Rule
Overview of 42 CFR Part 2 Final Rule (2024)
On February 8, 2024, the U.S. Department of Health & Human Services (HHS) through the Substance Abuse and Mental Health Services Administration (SAMHSA) and the Office for Civil Rights
announced a final rule modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR Part 2 (“Part 2”).
The Final Rule puts into place key changes to better align Part 2 provisions with the Health Insurance Portability and Accountability Act of 1996 (HIPAA),
specifically those concerning consent, notice of privacy practices, civil money penalties, and how breaches are to be handled.
A key new provision grants special treatment for “SUD counseling notes”,
which is akin to HIPAA’s treatment of psychotherapy notes. Compliance with the Part 2 Final Rule updates is required by February 16, 2026.
Resources for SAPC Provider Agencies:
Resources for SAPC Stakeholders:
- 42 C.F.R. Part 2: Final Rule - Implementation Guide for SAPC Provider Agencies – Outlines key actions SAPC provider agencies need to take to ensure compliance with the Part 2 updates, summarizes the requirements imposed by the Part 2 updates; and provides a decision tree to support your assessment of whether Part 2 permits disclosure of SUD information.
- U.S. Department of Health and Human Services (HSS) Model Notices of Privacy Practices (NPP) – Updated by HHS to reflect changes of the 2024 Part 2 Final Rule and the Part 2-related provisions of the 2024 HIPAA Privacy Rule Final Rule.
- SAPC Required Release of Information Forms (link forthcoming).
Resources for SAPC Stakeholders:
- 42 C.F.R. Part 2: Quick Tips for Lawful Holders (or Non-Part 2 Programs) – This Quick Tips Sheet is intended to provide readily available information on the key provisions of Part 2 that impact stakeholders, partners, and other Non-Part 2 Programs.
- Primer on Part 2 & Final Rule Updates: SAPC Stakeholders Training PowerPoint – Slide deck from a virtual training that was offered by SAPC in partnership with the firm Sheppard to SAPC partners and stakeholders who either will or already request or receive confidential SUD patient records. Familiarity with Part 2 requirements are particularly important in environments where Part 2 SUD data is being shared to deliver effective and coordinated care. Managed Care Plans and County Partners are encouraged to review this training.
