What 42 CFR Part 2 means when you start treatment

People delay the first call to a treatment program for a practical reason. They want help, and they also do not want a record of that help following them to an employer, a court, a landlord, or a family argument.

That fear is not imaginary. HHS states that confidentiality protections exist because discrimination and fear of prosecution deter people from entering treatment for a substance use disorder (HHS). ASAM puts the same point in clinical terms: 42 CFR Part 2 is meant to encourage people to seek substance use treatment without fear (ASAM).

This article explains what that federal rule actually covers when you start outpatient care, what a consent form is asking you to allow, and what a program still cannot do with your record.

What Part 2 is

Part 2 is a federal law — 42 U.S.C. 290dd-2 and 42 CFR part 2 — that protects the confidentiality of patient records for people receiving services for substance use disorders. SAMHSA calls those files Part 2 records, and the rules describe when and how they may be used and disclosed (SAMHSA).

The statute is specific about what is protected: records of the identity, diagnosis, prognosis, or treatment of any patient, kept in connection with a federally conducted, regulated, or assisted substance use program (HHS). In plain language, that includes the fact that you are a patient, what you are being treated for, and how treatment is going.

The rules apply to any federally assisted program that provides substance use diagnosis, treatment, or referral for treatment. SAMHSA calls those Part 2 programs. Some of the same limits also follow the records after they leave the program, including when they go to other health care providers (SAMHSA).

HIPAA still applies to health information. Part 2 is the extra layer for substance use treatment records. When the two rules overlap, the stricter limit is the one that matters.

The default is written consent

The general rule is simple: a program needs your written consent before it uses or discloses Part 2 records, unless a listed exception applies (Federal Register).

That is why an admissions packet is full of signature lines. Each one is not decoration. A consent has to identify you, who may disclose the information, who may receive it, what will be shared, the purpose, an expiration date or event, and your signature and date (Federal Register).

Read the recipient line. "My spouse" is not the same as "any family member." "This health plan, for payment" is not the same as "anyone at my workplace."

What changed so insurance and coordinated care can work

In 2024, HHS revised Part 2 so that some of it lines up more closely with HIPAA, while keeping the extra protections that are specific to substance use records (HHS). Programs were required to comply with the updated rule by February 16, 2026.

The change people notice first is practical. You can now give one consent that covers future uses and disclosures for treatment, payment, and health care operations (HHS). That is how a program can verify benefits, submit a claim, and share information with another clinician on your team without collecting a new form for every phone call.

If you sign that broader consent, HIPAA-covered recipients may redisclose those records in line with the HIPAA rules. Two limits stay in place:

• Those records still cannot be used in a legal proceeding against you without a separate, specific consent or a court order. That is stricter than HIPAA (HHS).
• A consent for use in civil, criminal, administrative, or legislative proceedings cannot be combined with a consent for anything else (HHS). If a court, probation officer, or attorney is asking for records, that should be its own form.

You may revoke a consent in writing. A program may already have acted on a consent that was valid when it acted (Federal Register).

What a program can share without asking you first

Consent is the default. It is not the only path. The 2024 rule still allows disclosures without consent in narrow situations, including (Federal Register):

• A bona fide medical emergency, to medical personnel, only to the extent needed, and documented.
• Required reports of suspected child abuse or neglect.
• A crime, or a threat of a crime, on program premises or against program staff.
• A court order that meets Part 2's own requirements. A subpoena or discovery request by itself is not enough when a Part 2 court order is required.
• Qualified research, audit, or evaluation.
• Certain public health reports, using de-identified information.

HHS is explicit about what has not changed: treatment records still cannot be used to investigate or prosecute you without your written consent or a qualifying court order (HHS).

What this means on the first call

A few practical implications follow from the rule, not from clinic policy.

The person who answers the phone may be limited in what they can confirm. If you are calling about someone else, do not be surprised if the program will not say whether that person is a patient. That is the law working as designed.

Insurance verification is not secret from the health plan. A benefits check and a claim require some disclosure. The updated rule makes that possible with one payment consent. If you do not want a service billed, ask before it is delivered whether paying in full lets you request that it not go to the plan (Federal Register).

Family involvement is optional, not automatic. A program can treat you without briefing relatives. If you want a parent, partner, or adult child in the loop, that usually takes a named consent.

Counseling notes can be held to a higher bar. HHS created a separate category for a clinician's notes analyzing an SUD counseling session when those notes are kept apart from the rest of the record. They need their own consent. A broad treatment-payment-operations consent does not cover them (HHS).

Rights that come with the record

The updated rule also added patient rights that will look familiar if you have ever received a HIPAA notice (HHS; Federal Register):

• A notice that explains how records may be used, what your rights are, and how to complain.
• The right to ask for restrictions on some disclosures.
• The right to file a complaint with the program and directly with HHS.
• Breach-notification rules if unsecured records are compromised.

Ask for that notice in writing and keep it. If a line on a consent form is unclear, it is reasonable to ask the admissions staff to explain that line before you sign. The form is doing legal work. It should be understandable.

This is not legal advice, and it is not a description of any one program's paperwork. It is the federal rule that those papers are supposed to follow.