Part 2’s single consent freed the recipients and bound the source
HHS’s 2024 Part 2 rule let hospitals and payers that receive substance use disorder records treat them almost like other health data. The treatment programs that create them, and the legal teams that answer subpoenas, carried more obligation than before.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On February 8, 2024, the Department of Health and Human Services announced a final rule modifying the substance use disorder confidentiality regulations at 42 CFR Part 2. It implemented changes required by the CARES Act of 2020. The rule allowed patients to give a single consent for all future uses and disclosures of Part 2 records for treatment, payment and health care operations. HIPAA covered entities and business associates that receive records under that consent may redisclose them as HIPAA permits, except for use in proceedings against the patient. The rule applied HIPAA breach notification to Part 2 records and replaced a criminal-only penalty scheme with HIPAA’s civil and criminal penalties. It was published in the Federal Register on February 16, 2024, with a compliance date of February 16, 2026.
The rule was widely summarized as aligning Part 2 with HIPAA. That is true on average and misleading in detail, because the alignment was uneven. It fell differently on three parties. The first is the Part 2 program that creates the records. The second is the HIPAA covered entities and business associates that receive them. The third is the legal channel through which courts, investigators and regulators reach them. Recipients gained most of the flexibility. Programs gained a simpler consent but kept tight limits and took on new enforcement exposure. The legal channel kept, and in places strengthened, the protections that make Part 2 different. Planning for the rule meant treating each party separately.
The source: Part 2 programs
A federally assisted substance use disorder program could now ask a patient for one consent covering treatment, payment and health care operations. The patient can revoke it in writing, and it cannot be combined with consent for SUD counseling notes. For an integrated system that runs an addiction treatment program alongside primary care, this simplified intake considerably. One form at admission could replace a series of recipient-specific consents.
The program itself, however, remained bound by the consent. The relaxed redisclosure rules applied to recipients, not to the program that obtained the consent. A program’s own uses and disclosures still had to fit what the patient had agreed to. Programs also had to give patients a notice of their rights and privacy practices and honor revocations. They had to handle a new category, SUD counseling notes, kept separate from the rest of the record and requiring their own consent for most disclosures.
Enforcement changed most for programs. Before the rule, Part 2 violations carried criminal penalties enforced by the Justice Department, which were rarely pursued. Afterward, HHS could impose HIPAA’s civil money penalties, and state attorneys general could bring civil actions. Breaches of unsecured Part 2 records now triggered HIPAA-style notification to patients and HHS. For many standalone treatment programs, which had never run a HIPAA-grade privacy and security program, this was the larger change. They needed a risk analysis, breach response procedures, workforce training and a privacy officer with real authority, often on budgets much smaller than a hospital’s.
The recipients: covered entities and business associates
For a hospital, health plan or business associate receiving records under a TPO consent, the change was substantial. It could use and redisclose those records as HIPAA permits. HHS also stated that such a recipient is not required to segregate or segment the records. That removed a barrier which had kept substance use treatment data out of shared records, care management platforms and health information exchanges.
The freedom had a boundary that recipients could not ignore. The records were still Part 2 records. They could not be used or disclosed in civil, criminal, administrative or legislative proceedings against the patient without specific consent or a qualifying court order. A recipient that merged the data into its general record, as the rule allowed, still had to recognize those records later. The moment came when a subpoena, an attorney’s records request or a law enforcement inquiry arrived.
That shaped practical choices. A health system did not need a separate repository, but it did need a flag or provenance field that survived ingestion, and a release-of-information workflow that checked it. A payer could leave claims data where it was. Its litigation and special investigations units still needed a rule for handling records that might contain Part 2 information. Business associates, from analytics vendors to clearinghouses, needed contract terms that carried the proceedings restriction forward.
The legal channel: courts, investigators and regulators
The third party is the one most compliance plans omitted. The rule tightened the conditions under which Part 2 records could be used against a patient. Court orders authorizing disclosure for such purposes had to meet specific requirements. The protection covered testimony relaying the content of records as well as the documents themselves. At the same time, the rule gave investigative agencies a limited safe harbor if they unknowingly obtained Part 2 records while acting with reasonable diligence.
For health systems, this put the general counsel’s office and the release-of-information desk on the front line. A subpoena that would be routine for ordinary medical records can be improper for Part 2 records. The intake process for legal requests therefore needs a step that asks whether any responsive record originated in a Part 2 program and, if so, whether a qualifying court order or specific consent exists. Outside counsel who handle malpractice or employment disputes need the same awareness, because Part 2 records may sit in files they request.
Regulators formed the other half of the channel. With HHS’s Office for Civil Rights now able to investigate Part 2 complaints and impose civil penalties, complaint handling and breach reporting for these records joined the HIPAA compliance cycle. Organizations should expect Part 2 questions in HIPAA audits and investigations and should check specific scenarios with counsel.
Treating the three parties separately changes the plan. A system that is both a Part 2 program and a recipient needs three things. It needs a consent and notice program at the source, a provenance flag and proceedings check downstream, and a legal intake step that connects the two.
With hindsight
The compliance date of February 16, 2026 has now passed, and the rule’s structure was not changed before it arrived. HHS’s Office for Civil Rights began accepting Part 2 complaints and breach reports on that date. Related HIPAA work landed on the same date. A separate HIPAA rule issued in April 2024 required covered entities to update their notices of privacy practices to reflect Part 2 by February 16, 2026. When a federal court in Texas vacated most of that April 2024 rule in June 2025, the reproductive health provisions fell, but the Part 2 notice changes were left in place. The uneven alignment described here therefore reached compliance intact. Recipients gained flexibility. Treatment programs had to run a HIPAA-grade privacy and breach program for the first time. Legal teams had to screen requests for Part 2 records inside merged data. Later articles in this series look at the data handling work that arrived with the compliance date.