As of October 2026, every Part 2 program and every organization holding its records must comply with the 2024 amendments to 42 CFR Part 2. The compliance date was 16 February 2026, and HHS’s Office for Civil Rights has enforced the rule with HIPAA-style civil penalties since that day. For apps that handle substance use disorder (SUD) records, the changes cut both ways. A patient can now sign one consent for all future treatment, payment and health care operations (TPO), and HIPAA-covered recipients can redisclose under HIPAA rules. But breaches must now be reported as HIPAA breaches are, and records still cannot be used against the patient in legal proceedings without specific consent or a court order. This guide sets out what changed, where each rule sits in the regulation, and what to build.
1. Does Part 2 Apply to Your App?
Part 2 protects records that identify a person as having, or having had, a substance use disorder, when those records come from a Part 2 program: a federally assisted program that holds itself out as providing, and provides, SUD diagnosis, treatment or referral for treatment (42 CFR 2.11, 2.12). “Federally assisted” is broad. Under 2.12(b) it includes, for example, Medicare participating providers, programs registered under the Controlled Substances Act to dispense controlled substances for SUD treatment, recipients of any federal financial assistance, and programs with federal tax-exempt status.
Your app is in scope if any of these is true:
- You build for a Part 2 program, such as an opioid treatment program, an outpatient addiction clinic or an SUD unit that promotes itself as one. You are then usually a qualified service organization (QSO) and, if the program is also a HIPAA covered entity, a business associate as well.
- You receive Part 2 records from someone else: a health system, a payer or an HIE that got them under a patient’s consent. Recipients are “lawful holders” and stay bound by parts of the rule.
- You are a behavioral-health app that also offers SUD treatment and presents itself that way.
Part 2 does not apply to general mental-health records, or to SUD information that a provider who is not a Part 2 program records in its own chart. A general practice that diagnoses alcohol use disorder during a routine visit is covered by HIPAA, not Part 2, unless it holds itself out as an SUD program (2.12(e)). State law can be stricter in both cases.
2. Timeline and What Changed, With Sources
| Date | Event | Source |
|---|---|---|
| 27 March 2020 | CARES Act section 3221 directs HHS to align Part 2 more closely with HIPAA | Cited in the final rule |
| 16 February 2024 | Final rule published: “Confidentiality of Substance Use Disorder (SUD) Patient Records” (89 FR 12472) | Federal Register |
| 16 April 2024 | Rule effective | Final rule “Dates” |
| 25 August 2025 | HHS Secretary delegates Part 2 administration and civil enforcement to the Director of OCR (published 27 August 2025, 90 FR 41833) | Federal Register |
| 13 February 2026 | OCR announces its civil enforcement program for Part 2 | HHS press release |
| 16 February 2026 | Compliance date. OCR starts accepting Part 2 complaints and breach reports | Final rule; HHS press release |
| Not yet set | Accounting of TPO disclosures made through an EHR (2.25(b)). Compliance is tolled until HHS finalizes the matching HIPAA accounting rule | Final rule preamble |
The main changes, each traced to the current regulation text on eCFR:
| Area | Before | Since 16 February 2026 | Section |
|---|---|---|---|
| TPO consent | Narrow consents, often per recipient | One consent can cover all future TPO uses and disclosures | 2.31(a), 2.33(a)(2) |
| Redisclosure by HIPAA entities | Generally needed new Part 2 consent | Covered entities and BAs that receive records for TPO may redisclose them as HIPAA permits, except in proceedings against the patient | 2.33(b)(1) |
| Segmentation | Recipients commonly segregated Part 2 data | A Part 2 program, covered entity or BA receiving records under a TPO consent is not required to segregate or segment them | 2.12(d)(2)(i)(C) |
| Breach notification | No federal breach notification duty under Part 2 | HIPAA Breach Notification Rule applies to breaches of unsecured Part 2 records | 2.16(b) |
| Penalties | Criminal fines only | HIPAA civil and criminal penalties (SSA 1176 and 1177), enforced through HIPAA’s procedures | 2.3 |
| Complaints | No HIPAA-style complaint process | Programs must run a complaint process; patients can complain to HHS; no retaliation | 2.4 |
| SUD counseling notes | No separate category | New category, needing its own consent, much like HIPAA psychotherapy notes | 2.11, 2.31(b) |
| De-identification | Part 2’s own standard | HIPAA’s de-identification standard at 45 CFR 164.514(b) | 2.16(a), 2.54 |
3. Consent: The Single TPO Consent and Its Limits
A Part 2 consent can be paper or electronic and must contain the elements in 42 CFR 2.31(a): the patient’s name, who may disclose, a specific description of the information, the recipients, the purpose, the right to revoke in writing, an expiration date or event, the signature and the date. Electronic signatures are allowed unless other law prohibits them.
For a single TPO consent, the rule accepts simpler wording:
- Recipients can be described as “my treating providers, health plans, third-party payers, and people helping to operate this program” or similar.
- “For treatment, payment, and health care operations” is a sufficient purpose.
- “End of the treatment” or “none” is a sufficient expiration.
But a TPO consent must also include two statements: that records disclosed under it may be redisclosed by the recipient and no longer protected by Part 2, and what happens if the patient refuses to sign (2.31(a)(10)). If the recipient is a covered entity or business associate, the consent must also say that the records may be redisclosed under HIPAA, except for proceedings against the patient (2.31(a)(4)(iii)).
Three things still need their own consent:
- SUD counseling notes. A consent for these can only be combined with another consent for counseling notes, and treatment cannot be made conditional on it (2.31(b)).
- Legal proceedings. A consent to use records in civil, criminal, administrative or legislative proceedings cannot be combined with any other consent (2.31(d)).
- Intermediaries such as HIEs. The consent must name the intermediary and either its member participants or a general designation limited to participants with a treating relationship (2.31(a)(4)(ii)).
4. Redisclosure, Notices and Segmentation
Every consented disclosure carries a notice
Each disclosure made with written consent must come with one of two statements from 2.32(a), either the full paragraph or the short form, “42 CFR part 2 prohibits unauthorized use or disclosure of these records”, and a copy of the consent or a clear explanation of its scope (2.32(b)). For an app, that means the notice and the consent scope travel with the data: in the API response, the exported document, the fax cover or the message.
What recipients may do
- Covered entities and business associates that receive records for TPO may use and redisclose them as the HIPAA Privacy Rule allows (2.33(b)(1)).
- Part 2 programs that are not HIPAA entities may redisclose consistently with the consent (2.33(b)(2)).
- Other lawful holders receiving records for payment or operations may pass them to contractors only under a written contract that binds the contractor to Part 2 (2.33(b)(3), (c)).
The restriction that never goes away
Whoever holds the records, they cannot be used to bring criminal charges against the patient, or in civil, criminal, administrative or legislative proceedings against them, without the patient’s specific consent or a court order under subpart E (2.12(d)(1)). Investigative agencies get a limited safe harbor if they acted with reasonable diligence before requesting records (2.3(b)). That restriction is why Part 2 data still needs to be identifiable as Part 2 data, even where segmentation is no longer required.
Segmentation: not required, but labeling still matters
Under 2.12(d)(2)(i)(C), a Part 2 program, covered entity or business associate that receives records under a single TPO consent is not required to segregate or segment them. That removes the old pressure to keep separate databases. It does not remove the need to know which records came from a Part 2 program, because you still have to attach the 2.32 notice on disclosure, apply the proceedings restriction, honor revocations and restrictions, keep counseling notes apart, and report breaches correctly. In FHIR, the usual way to do this is with security labels, for example the HL7 privacy-law code for 42 CFR Part 2 in resource meta, following the HL7 Data Segmentation for Privacy guidance.
5. Breach Notification and Penalties
Section 2.16(b) applies the HIPAA Breach Notification Rule (45 CFR part 164, subpart D) to Part 2 programs for breaches of unsecured records, “in the same manner” as for covered entities. In practice, that means a risk assessment for each incident, notice to affected patients without unreasonable delay and within 60 days of discovery, notice to HHS, and media notice for breaches affecting more than 500 residents of a state or jurisdiction. Records encrypted to HHS’s guidance standard are not “unsecured” (2.11), which is one more reason to encrypt everything.
Section 2.3 applies the penalties in sections 1176 and 1177 of the Social Security Act, the same civil money penalty tiers and criminal penalties as HIPAA, and makes HIPAA’s enforcement procedures (45 CFR part 160, subparts C to E) apply. HHS says penalties “are aligned with those available under HIPAA’s Privacy, Security, and Breach Notification Rules” and that OCR may resolve cases through resolution agreements, corrective action plans, monetary settlements or civil money penalties (HHS, 13 February 2026). Our HIPAA penalties guide sets out the tiers.
6. Patient Rights: Notice, Accounting, Restrictions
- Patient notice. Part 2 programs must give patients a notice of their rights that mirrors the HIPAA Notice of Privacy Practices (2.22). HIPAA covered entities that create or maintain Part 2 records must also reflect Part 2 in their own NPP (45 CFR 164.520).
- Accounting of disclosures. Patients can request an accounting of disclosures made with consent in the past 3 years (2.25(a)). The duty to account for TPO disclosures made through an EHR (2.25(b)) is tolled until HHS finalizes the HIPAA accounting rule, according to the final rule’s preamble.
- Intermediary lists. An intermediary must, on written request, list who received records under a general designation in the past 3 years, within 30 days (2.24).
- Requested restrictions. Patients can ask a program to restrict TPO disclosures. The program must agree to restrict disclosures to a health plan for services the patient paid for in full (2.26).
- Complaints. Programs must have a complaint process and cannot make patients waive the right to complain as a condition of treatment (2.4).
7. What SUD and Behavioral-Health Apps Should Build
| Feature | What it does | Rule it supports |
|---|---|---|
| Part 2 provenance flag on every record, document and message | Marks data that originated in a Part 2 program, so downstream rules can apply | 2.12(d), 2.32 |
| Structured consent object with all 2.31 elements, versioned and e-signed | Lets you check, before each disclosure, that a valid consent exists and covers the recipient and purpose | 2.31, 2.33 |
| Revocation workflow | Captures written revocation and stops future disclosures under that consent | 2.31(a)(6), (c)(3) |
| Separate store and consent type for SUD counseling notes | Keeps notes out of general record views and exports | 2.11, 2.31(b) |
| Disclosure wrapper | Attaches the 2.32 notice and the consent scope to every outbound disclosure | 2.32 |
| Disclosure log | Records each consented disclosure: recipient, date, data described. Supports accountings and intermediary lists | 2.24, 2.25 |
| Restriction registry | Stores agreed restrictions, including self-pay restrictions to health plans | 2.26 |
| Legal-request hold | Routes subpoenas and law-enforcement requests to review, never to auto-release | 2.12(d)(1), subpart E |
| Breach workflow | Incident log, four-factor risk assessment, 60-day notification clock | 2.16(b) |
| Encryption, audit logging, RBAC, session timeouts | Baseline safeguards for the records themselves | 2.16(a); HIPAA Security Rule where it applies |
A few practical notes from building these:
- Don’t rely on the single TPO consent alone. Patients can decline it, revoke it or restrict it, so your app still needs per-recipient consent as a fallback.
- Treat telehealth and messaging as disclosures. The 2.11 definition of “records” explicitly includes emails, voicemails and texts. Our telemedicine app guide covers the video and messaging side.
- Log reads, not just writes. When OCR investigates a complaint, it will ask who saw what. Our audit logging guide lists the fields to capture.
- Check your vendors. Every service that touches Part 2 data needs a QSO agreement or BAA that binds it to Part 2, including SMS, email, analytics and AI providers.
- Payer and FHIR APIs carry Part 2 data too. CMS requires payer APIs to respect Part 2 (see our CMS-0057-F guide), and our FHIR integration guide covers security labels in practice.
VertiComply generates full-stack healthcare apps (web plus native iOS and Android) with encryption, audit logging, role-based access and session timeouts on every plan, and offers a 42 CFR Part 2 framework option for SUD apps as a starting point for consent and disclosure handling. You still need to review the generated consent forms and workflows against your program’s own legal advice. We sign a BAA on request on all paid plans, not on the free plan (pricing). Our HIPAA checklist and free HIPAA checker cover the HIPAA safeguards Part 2 builds on.
This article summarizes federal regulations for general information and is not legal advice. State SUD and mental-health confidentiality laws may be stricter.
Frequently Asked Questions
What happened on February 16, 2026 for 42 CFR Part 2?
It was the compliance date for the 2024 Part 2 final rule. From that day, Part 2 programs and other holders of Part 2 records had to follow the amended rules on consent, redisclosure, breach notification and patient rights, and HHS’s Office for Civil Rights began accepting complaints and breach reports and enforcing the rule with civil penalties.
Can one consent cover all treatment, payment and health care operations under Part 2?
Yes. Since the 2024 rule, a patient can sign a single consent for all future uses and disclosures for treatment, payment and health care operations. The consent must still include every required element, including statements about redisclosure and the consequences of refusing. SUD counseling notes and use in legal proceedings need separate consents.
Do Part 2 breaches have to be reported like HIPAA breaches?
Yes. Section 2.16(b) applies the HIPAA Breach Notification Rule to breaches of unsecured Part 2 records in the same way it applies to covered entities. That means notifying affected patients within 60 days of discovery, notifying HHS, and notifying the media for large breaches.
What are the penalties for violating 42 CFR Part 2 now?
The same as HIPAA. The amended rule applies the civil and criminal penalties in sections 1176 and 1177 of the Social Security Act, and OCR enforces it with the same procedures it uses for HIPAA, including resolution agreements, corrective action plans and civil money penalties.
Do we still need to segment Part 2 data in our app?
A Part 2 program, covered entity or business associate that receives records under a single TPO consent is not required to segregate or segment them. You still need to know which records are Part 2 records, because the disclosure notice, the ban on use in proceedings against the patient, counseling-note rules and revocations still apply to them. Labeling is the practical answer.
Does Part 2 apply to mental-health apps?
Only if the app, or the organization it serves, is a federally assisted program that holds itself out as providing SUD diagnosis, treatment or referral, or if it receives records from one. General mental-health records fall under HIPAA and state law, not Part 2.
Last reviewed 12 October 2026. Regulation text checked against eCFR current to 8 October 2026. Nothing here is legal advice.