42 CFR Part 2: What Therapists Need to Know About Substance Abuse Records

If you treat patients with substance use disorders, HIPAA isn't your only concern. 42 CFR Part 2 adds stricter requirements that most therapists don't know exist.

TL;DR: 42 CFR Part 2 Basics

1. Applies to federally-assisted substance abuse treatment programs
2. Stricter than HIPAA - more consent required, less sharing allowed
3. Violations can result in criminal penalties (not just fines)
4. If you treat addiction, you probably need to comply

Who Does 42 CFR Part 2 Apply To?

You're covered if you:

1. Receive federal funding (including Medicare/Medicaid)

1. Most therapists accepting insurance qualify
2. Grants, contracts, or tax-exempt status count

2. Provide substance use disorder treatment

1. Alcohol or drug abuse counseling
2. Addiction treatment as part of mental health services
3. Even if it's not your primary specialty

3. Hold yourself out as providing SUD treatment

1. Listed as an addiction specialist
2. Accept referrals for substance abuse
3. Advertise SUD services

How 42 CFR Part 2 Differs from HIPAA

The Consent Requirements

HIPAA approach:

"We may share your information for treatment, payment, and operations."

42 CFR Part 2 approach:

"We need your written consent specifying exactly who we can share with, what we can share, and why."

Every disclosure requires:

☐ Patient's written consent

☐ Specific name of recipient

☐ Purpose of disclosure

☐ What information will be shared

☐ Expiration date or event

☐ Patient's right to revoke

Redisclosure Prohibition

This is the big one. When you share 42 CFR Part 2 records, you must include:

"This information has been disclosed to you from records protected by federal confidentiality rules (42 CFR Part 2). The federal rules prohibit you from making any further disclosure of information in this record that identifies a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person unless further disclosure is expressly permitted by the written consent of the individual whose information is being disclosed or as otherwise permitted by 42 CFR Part 2."

Every. Single. Time.

Common Violations

1. Sharing with insurance without proper consent

1. "But they're paying for treatment!"
2. Doesn't matter. Consent required.

2. Coordinating care without documentation

1. Calling the patient's psychiatrist
2. Requires written consent specifying that provider

3. Responding to subpoenas like HIPAA

1. 42 CFR Part 2 has stricter court order requirements
2. Regular subpoenas don't apply

4. Using the same EHR consent as medical records

1. 42 CFR Part 2 consent must be separate and specific
2. General HIPAA consent doesn't cover it

5. Forgetting the redisclosure notice

1. Every communication must include it
2. Emails, faxes, reports - everything

Technical Safeguards for 42 CFR Part 2

Your IT setup needs to support:

1. Segmented access controls

1. SUD records separate from general mental health
2. Not everyone in the practice should see them
3. Role-based access is essential

2. Enhanced audit logging

1. Who accessed what, when, why
2. More detailed than HIPAA requires
3. Retain indefinitely (no 6-year limit specified)

3. Consent tracking system

1. Which patients consented to what disclosures
2. Expiration dates tracked
3. Easy revocation process

4. Secure communication with redisclosure notice

1. Templates with required language
2. Can't use regular email workflows
3. Portal or encrypted email recommended

The 2024 Rule Changes

Recent updates aligned some 42 CFR Part 2 with HIPAA:

What changed:

1. Patients can now request records
2. Some treatment coordination is easier
3. Integration with state HIEs allowed (with consent)

What didn't change:

1. Consent still stricter than HIPAA
2. Redisclosure prohibition still applies
3. Criminal penalties still possible

Practical Steps for Therapists

1. Determine if you're covered

1. Do you treat any substance abuse?
2. Do you receive any federal assistance?
3. If yes to both, you're covered

2. Separate your consent forms

1. Create 42 CFR Part 2-specific consent
2. Don't rely on general HIPAA authorization
3. Get legal review

3. Update your Notice of Privacy Practices

1. Must address 42 CFR Part 2 specifically
2. Explain the stricter protections
3. Document patient acknowledgment

4. Train your staff

1. Front desk needs to understand the difference
2. Everyone handling records must know
3. Document the training

5. Configure your systems

1. EHR should support segmented access
2. Consent tracking should be automated
3. Audit logs must be comprehensive

The Bottom Line

If you treat substance use disorders:

1. HIPAA is the floor, not the ceiling
2. 42 CFR Part 2 consent is always required for disclosure
3. Violations can be criminal, not just civil
4. Your IT systems need to support segmentation

Most therapists treating addiction are technically violating 42 CFR Part 2 because they treat it like HIPAA. Don't be most therapists.

Not sure if your practice is 42 CFR Part 2 compliant? We help therapy practices implement the technical safeguards these regulations require. Get Free Assessment

Need Help With Your Practice’s Security?

Free assessment, no obligation, real answers.

Get Free Assessment

(469) 306-9520 • Serving Dallas-Fort Worth