42 CFR Part 2 Compliance Checker
42 CFR Part 2 provides federal protections for patients receiving treatment for substance use disorders (SUD). These regulations restrict the disclosure and re-disclosure of SUD treatment records and require specific patient consent procedures that go beyond HIPAA's general provisions. This tool assesses your organization's adherence to consent management, qualified service organization agreements (QSOAs), re-disclosure prohibitions, audit controls, and court-order handling.
Progress: 0/22
Patient Consent & Authorization
0/5Qualified Service Organization Agreements
0/4Re-Disclosure Restrictions
0/4Audit & Record Keeping
0/4Court Orders & Legal Exceptions
0/5Patient Consent & Authorization
Assessment of consent processes specific to substance use disorder records under 42 CFR Part 2.
Q1
Do you obtain written patient consent that meets all 42 CFR Part 2 requirements (name of patient, purpose, recipient, specific information to be disclosed, expiration date, right to revoke) before disclosing any SUD treatment records?
Q2
Are patients informed of their right to revoke consent at any time, and do you have a documented process to immediately cease disclosures upon revocation?
Q3
Does your consent form specify each individual or entity that will receive SUD records, rather than using blanket or open-ended recipient designations?
Q4
Do all consent forms include a defined expiration date or condition, and do you track and enforce expiration so that disclosures stop automatically?
Q5
Do you maintain a separate, secured consent repository that tracks all active, expired, and revoked 42 CFR Part 2 consents with a full audit trail?
VertiComply
Build HIPAA-compliant healthcare applications with AI-powered code generation.
Product
Features
Pricing
Tools
Company
About
Blog
Contact
Legal
Privacy
Terms
Compliance
© 2026 VertiComply. All rights reserved.
Built for HIPAA + SOC 2 Type II
About the 42 CFR Part 2 Compliance Checker
This checker scores your handling of substance use disorder records against 42 CFR Part 2, the federal confidentiality rule that has always been stricter than HIPAA and was substantially amended by the February 2024 final rule implementing the CARES Act, with a compliance date of 16 February 2026. The rule protects records of the identity, diagnosis, prognosis or treatment of any patient held by a federally assisted Part 2 program. Scoring weights consent mechanics and redisclosure most heavily, because those are where the rule diverges from HIPAA and where the great majority of violations occur. The 2024 alignment brought Part 2 closer to HIPAA — a single prior consent can now permit all future uses and disclosures for treatment, payment and health care operations, and breach notification now follows the HIPAA rule — but it did not merge the two. Part 2 records still carry restrictions that follow the data after it leaves you.
What this 42 CFR Part 2 assessment covers
The 22-question assessment scores 100 points across 5 weighted categories. Each category reflects a distinct 42 CFR Part 2 control domain.
Patient Consent & Authorization · 25 pts · 5 questions
Assessment of consent processes specific to substance use disorder records under 42 CFR Part 2.
Qualified Service Organization Agreements · 20 pts · 4 questions
Evaluation of agreements with third-party organizations that handle SUD records.
Re-Disclosure Restrictions · 22 pts · 4 questions
Assessment of controls preventing unauthorized re-disclosure of SUD treatment information.
Audit & Record Keeping · 18 pts · 4 questions
Evaluation of audit trails and documentation practices for SUD record disclosures.
Court Orders & Legal Exceptions · 15 pts · 5 questions
Assessment of processes for handling court-ordered disclosures and permitted exceptions under Part 2.
Common 42 CFR Part 2 compliance gaps
The patterns we see most frequently in 42 CFR Part 2 self-assessments and remediation work. Each is the kind of finding an auditor flags first.
Part 2 data is treated as ordinary PHI once it reaches the EHR. Records received from a Part 2 program retain their protection. Systems that merge them into a general clinical record without segmentation lose the ability to honour the restrictions that travel with them.
No segmentation capability exists at all. Without the ability to tag and separate Part 2 records, an organisation cannot honour a patient's consent scope, and cannot respond to a revocation. This is an architectural gap and it is expensive to retrofit.
Consent forms do not meet the specific content requirements. Part 2 consent has prescribed elements. A HIPAA authorisation form is not a Part 2 consent, and reusing one is a common and consequential error.
The redisclosure notice is omitted. Disclosures must carry a notice prohibiting redisclosure. Teams commonly send the record and omit the accompanying notice, which is itself a violation.
Revocation is unimplemented. Patients can revoke consent, and the 2024 rule requires processes to honour it. Many organisations have a consent capture flow and no revocation flow at all.
Staff cannot distinguish Part 2 records from other clinical records. If the workforce cannot tell which rules apply to what is on screen, no policy will hold. This is a training and interface problem as much as a compliance one.
What to do with your 42 CFR Part 2 results
Your score is a starting point — these are the steps that convert the assessment into actionable remediation.
Determine first whether you are a Part 2 program, or a lawful holder of records received from one. The obligations differ, and many organisations are the latter without realising it.
Assess segmentation capability in your systems honestly. If Part 2 records cannot be tagged and separated, that is the gap to fix before writing any policy.
Rebuild consent forms against the specific content requirements, and implement a revocation path alongside the capture path.
Add the redisclosure notice to every disclosure route, including automated and API-based ones where it is most often missing.
Train clinical and support staff to recognise Part 2 records specifically, and make the distinction visible in the interface rather than relying on memory.
42 CFR Part 2 compliance FAQ
How is 42 CFR Part 2 different from HIPAA?
Part 2 is narrower in scope and stricter in effect. It covers only substance use disorder records from federally assisted Part 2 programs, but it restricts redisclosure by recipients in a way HIPAA does not — the protection follows the record after it leaves you. HIPAA permits many treatment, payment and operations disclosures without authorisation; Part 2 has historically required patient consent for them.
What changed in the February 2024 Part 2 final rule?
It aligned Part 2 more closely with HIPAA: a single prior consent can permit all future uses and disclosures for treatment, payment and health care operations; breach notification now follows the HIPAA Breach Notification Rule; patients gain a right to an accounting of disclosures and to request restrictions; and penalties align with HIPAA's civil and criminal structure. The compliance date is 16 February 2026.
Does Part 2 apply to a general hospital?
It can. A general medical facility is a Part 2 program if it has an identified unit providing SUD diagnosis, treatment or referral, or medical personnel whose primary function is such care and who are identified as such. It also applies as a lawful holder to records the facility receives from a Part 2 program.
Do we need to segregate Part 2 data in our database?
You need the ability to identify and segment it, which in practice means tagging at the record level and enforcing access and disclosure rules on that tag. Physical separation into a different database is one implementation, not a requirement — but an architecture with no segmentation capability at all cannot comply.
Build it instead of buying it
Generate a 42 CFR Part 2-compliant healthcare app with the controls built in
VertiComply generates production-ready healthcare applications with 42 CFR Part 2 controls scaffolded from the first commit — no add-on tier, no platform lock-in, code exported to your GitHub.
Start free