42-cfr-part-2
42 CFR Part 2 — Substance Use Disorder Records
Overview
42 CFR Part 2 establishes federal confidentiality protections for patient records created by federally assisted programs treating substance use disorders (SUDs). Originally enacted under the Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment, and Rehabilitation Act of 1970 and the Drug Abuse Prevention, Treatment, and Rehabilitation Act of 1972, Part 2 was designed to remove barriers to treatment by ensuring that SUD records could not be used to criminally prosecute or otherwise discriminate against patients. Part 2 is intentionally stricter than HIPAA — it requires specific written consent for most disclosures and prohibits re-disclosure by recipients. The CARES Act §3221 (enacted March 2020) and the subsequent 2024 Final Rule (89 FR 12472, effective February 16, 2024) significantly amended Part 2 to align certain provisions with HIPAA while preserving core patient protections.
Applicability — Who Must Comply
Part 2 Programs
Part 2 applies to any "program" that is federally assisted and holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment. A program is federally assisted if it:
- Is conducted by any department or agency of the United States (VA, IHS, military)
- Is carried out under a license, certification, registration, or authorization from the federal government (DEA registration for opioid treatment programs)
- Is supported by funds from any federal department or agency (Medicare/Medicaid participation qualifies)
- Is assisted by the IRS through tax-exempt status under 26 USC §501(c)(3)
- Is conducted by a state or local government receiving federal funds that could be used for SUD programs (even if not directly used for SUD)
Asclepius Health Network Applicability: Asclepius operates 3 dedicated SUD treatment facilities and provides SUD treatment services in all 12 hospitals. Because Asclepius participates in Medicare and Medicaid, all SUD treatment records are Part 2 records. Asclepius maintains a separate consent workflow for Part 2 records in its EHR.