Substance Abuse Prevention and Control
42 CFR Part 2 Final Rule
Overview of 42 CFR Part 2 Final Rule (2024)
On February 8, 2024, the U.S. Department of Health & Human Services (HHS) through the Substance Abuse and Mental Health Services Administration (SAMHSA) and the Office for Civil Rights
announced a final rule modifying the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR Part 2 (“Part 2”).
The Final Rule puts into place key changes to better align Part 2 provisions with the Health Insurance Portability and Accountability Act of 1996 (HIPAA),
specifically those concerning consent, notice of privacy practices, civil money penalties, and how breaches are to be handled.
A key new provision grants special treatment for “SUD counseling notes”,
which is akin to HIPAA’s treatment of psychotherapy notes. Compliance with the Part 2 Final Rule updates is required by February 16, 2026.
Resources for SAPC Provider Agencies:
Resources for SAPC Stakeholders:
- 42 C.F.R. Part 2: Final Rule - Implementation Guide for SAPC Provider Agencies – Outlines key actions SAPC provider agencies need to take to ensure compliance with the Part 2 updates, summarizes the requirements imposed by the Part 2 updates; and provides a decision tree to support your assessment of whether Part 2 permits disclosure of SUD information.
- U.S. Department of Health and Human Services (HSS) Model Notices of Privacy Practices (NPP) – Updated by HHS to reflect changes of the 2024 Part 2 Final Rule and the Part 2-related provisions of the 2024 HIPAA Privacy Rule Final Rule.
- Updated Release of Information (ROI) Forms:
- SAPC Payment and Operations ROI (New – May 2026): This form is required for all clients and is necessary for submitting claims to SAPC and third-party payors, including DHCS and managed care plans. It authorizes the release of SUD information for billing and healthcare operations purposes including auditing, compliance, and administrative activities. A signed Payment and Operations ROI is required for claims submission to SAPC. Without this form, providers cannot bill for services rendered.
- SAPC Treatment and Care Coordination ROI (New – May 2026): This form authorizes the sharing of SUD information for care coordination purposes. It supports communication within the SAPC provider network and with external entities such as primary care providers, managed care plans, and other partners, as well as client-directed requests for records. Updates to federal regulations allow for redisclosure of SUD information to HIPAA-covered entities for care coordination, which is reflected in this form.
- SAPC Legal Proceedings ROI (New – May 2026): This form is required for disclosures related to civil, criminal, legislative, or administrative proceedings. It authorizes the release of SUD information specific to the legal matter identified on the form. This authorization is case-specific and may not be used for any other legal matter or disclosure purposes beyond what is explicitly documented.
Resources for SAPC Stakeholders:
- 42 C.F.R. Part 2: Quick Tips for Lawful Holders (or Non-Part 2 Programs) – This Quick Tips Sheet is intended to provide readily available information on the key provisions of Part 2 that impact stakeholders, partners, and other Non-Part 2 Programs.
- Primer on Part 2 & Final Rule Updates: SAPC Stakeholders Training PowerPoint – Slide deck from a virtual training that was offered by SAPC in partnership with the firm Sheppard to SAPC partners and stakeholders who either will or already request or receive confidential SUD patient records. Familiarity with Part 2 requirements are particularly important in environments where Part 2 SUD data is being shared to deliver effective and coordinated care. Managed Care Plans and County Partners are encouraged to review this training.
