42 CFR Part 2 for Behavioral Health Providers: A Plain-Language Guide

Your intake coordinator is staring at a consent form, unsure whether the new rules let her share a patient's SUD treatment history with the primary care office down the hall. Your compliance officer is wondering if last year's forms are still valid. If that sounds familiar, you're not behind. You're just catching up to a rule that's been rolling out for two years. And if your program bills per diem or ASAM levels of care, the compliance stakes are even higher -- the payer rules governing inpatient SUD billing intersect directly with how Part 2 records can be used and shared.

What Actually Changed

The 42 CFR Part 2 Final Rule took effect April 16, 2024, and full compliance became mandatory on February 16, 2026. As of that date, the HHS Office for Civil Rights began accepting complaints and actively enforcing the updated regulation, so this isn't a future deadline anymore. It's the operating rule your program is being held to today.

The rule aligns Part 2 more closely with HIPAA, and the practical changes are significant. Patients can now sign a single consent covering all future uses and disclosures of their SUD records for treatment, payment, and healthcare operations, instead of a separate form for every provider. HIPAA-regulated entities that receive Part 2 records with consent can redisclose them consistent with HIPAA. And breach notification requirements now apply to Part 2 records the same way they apply under HIPAA, with civil penalties that can reach into the millions for violations.

Where Part 2 Still Isn't HIPAA

Don't mistake alignment for equivalence. The updated rule keeps SUD counseling notes, the clinician's private analysis of a counseling session, walled off from the broad treatment-payment-operations consent. Those notes need separate, specific authorization, similar to how HIPAA treats psychotherapy notes. And Part 2 records still can't be used against a patient in most legal proceedings without written consent or a court order. Your EHR needs to know the difference, not just your compliance manual.

What to Update Before Your Next Audit

Most of the operational risk right now isn't in the regulation itself. It's in forms, workflows, and EHR configurations that never got updated after the 2024 rule passed. This pattern shows up across behavioral health billing more broadly -- if you want a ground-level view of where the system is breaking down, this post covers what's actually happening inside practices right now. Here's where to start on Part 2 specifically.

• Consent forms. Confirm your program is using the single-consent format for TPO disclosures, not the old per-provider consent structure.
• SUD counseling notes. Make sure your EHR keeps these segregated and requires their own consent, separate from the general treatment record.
• Breach response plan. Update your policy to apply HIPAA's breach notification timelines and risk-assessment process to Part 2 records.
• Patient notices. Align your Notice of Privacy Practices language with the new Part 2 notice requirements.
• Redisclosure tracking. Confirm your system logs when and to whom records are redisclosed, since that documentation is now part of audit exposure.

Compliance Without Slowing Down Care

Community health centers that integrate SUD treatment have felt this shift directly. In 2024, community health centers provided nearly 227,000 patients with medication-assisted treatment, a 24% increase, and that growth only works if consent and disclosure workflows keep pace without becoming a bottleneck at intake.

ADS is one of a small number of EHR vendors that is ASAM-certified, and that same compliance discipline shaped how Part 2 consent, segregation, and breach documentation are configured in the Medics Suite. Catholic Charities USA and Hispanic Counseling Center run their per diem and bundled billing on the same platform, without treating compliance and revenue as separate problems. That same EHR backbone also powers ASAM AI for treatment plan generation. If you're evaluating whether your current system can actually handle Part 2 requirements, this breakdown of what to look for in behavioral health EHR software in 2026 covers the compliance and billing features that matter most. For facilities billing inpatient psychiatric levels of care, what makes inpatient behavioral health billing different is worth reviewing alongside your Part 2 update.

Ready to see what AI built into 49 years of specialty-specific EHR looks like in practice? Request a Live Demonstration and see the Medics Suite working in your specialty's actual workflow. A real person answers in under 2 minutes at 1-800-899-4237 ext. 2264.

Sources: HHS.gov, Understanding Confidentiality of SUD Patient Records; SAMHSA, 42 CFR Part 2; National Association of Community Health Centers, 42 CFR Part 2 Factsheet.