New changes to federal law make it easier — and safer — to share substance use disorder records for care. PelEX helps communities, clinicians, and health systems navigate every step.
Understanding the Regulation
What is 42 CFR Part 2?
Part 2 is a set of federal regulations that provide extra-strong privacy protections for records related to substance use disorder (SUD) diagnosis, treatment, and referral. Unlike standard HIPAA rules, Part 2 historically required explicit patient consent before any records could be shared.
Created in the 1970s during the early days of addiction treatment, 42 CFR Part 2 was designed to encourage people struggling with substance use to seek treatment without fear of discrimination or legal consequences. It applies to any federally assisted program that holds itself out as providing SUD diagnosis, treatment, or referral services.
Part 2 records cannot be used in criminal proceedings against a patient without their express consent, and cannot be shared without a valid written authorization — providing protections that go beyond those of standard HIPAA rules.
Over time, these strict rules created barriers to coordinated care: a primary care physician may not know a patient is receiving SUD treatment, limiting their ability to provide safe, integrated care. The 2024 Final Rule is designed to address this imbalance — protecting privacy while enabling life-saving care coordination.
Who is covered? Any program that receives federal assistance (including Medicaid reimbursement) and provides SUD services must comply with Part 2.
Compliance Deadline: February 16, 2026
All programs subject to 42 CFR Part 2 must be in full compliance with the Final Rule by this date. PelEX is ready to support your journey.
🔒 Why the Extra Protection?
SUD records carry unique stigma and legal risks. Part 2 ensures patients can seek treatment confidentially, without fear their records will be used against them in court, employment, or housing decisions.
📋 Consent-First Philosophy
Before sharing any Part 2 record, a covered program must obtain written patient consent identifying who will receive the information, for what purpose, and how long the consent is valid.
⚖️ Limits on Redisclosure
Recipients of Part 2 records are historically prohibited from re-sharing the information without new patient consent — stricter than HIPAA’s redisclosure rules. The 2024 rule updates these requirements to align more closely with HIPAA, allowing for a single consent to facilitate disclosures to providers authorized by the patient.
🏥 Who Is a "Part 2 Program"?
Any federally assisted program that holds itself out as providing SUD diagnosis, treatment, or referral — including hospitals, clinics, and health systems that receive Medicaid.
2024 Final Rule
How is 42 CFR Part 2 Changing?
The CARES Act of 2020 directed HHS to align Part 2 more closely with HIPAA. The 2024 Final Rule (effective April 2024; compliance required by February 16, 2026) makes sweeping changes that improve care coordination while preserving core privacy protections.
1. Single TPO Consent Form
Patients may now sign one consent authorizing all future uses and disclosures of their Part 2 records for treatment, payment, and healthcare operations (TPO) — eliminating the need for a new consent each time care is coordinated.
2. HIPAA-Aligned Redisclosure Rules
Once a patient provides TPO consent, downstream recipients (covered entities and business associates) may redisclose Part 2 records under HIPAA’s standard rules — dramatically simplifying data flows across health systems.
3. Right to Revoke
Patients retain the right to revoke their TPO consent in writing at any time. After revocation, no new disclosures can occur, though records already shared lawfully are not required to be “pulled back.”
4. Notice of Privacy Practices
Part 2 programs must now provide patients with a Notice of Privacy Practices (aligned with HIPAA), making it easier for patients to understand how their information is used and their rights under the law.
5. Updated Breach Notification
Breach notification requirements for Part 2 programs now align with the HIPAA Breach Notification Rule, creating consistent standards for covered entities operating under both frameworks.
6. Intermediary Protections
New rules define how intermediaries (such as HIEs and data exchange networks) can receive and redisclose Part 2 records — enabling data interoperability goals while maintaining patient-centered consent requirements.
7. Prohibition on Use in Criminal Proceedings
The 2024 rule maintains — and in some respects strengthens — the prohibition on using Part 2 records against a patient in any criminal, civil, or administrative proceeding without their consent.
8. Updated Consent Form Requirements
Consent forms must now include the potential consequences of refusing to sign a TPO consent and a notice of the potential for redisclosure by recipients — ensuring patients are fully informed before authorizing sharing.
Your Role in Better Care
How can PelEX help you?
Whether you’re a patient seeking care, a provider coordinating treatment, or a technology partner building solutions — there’s a clear path forward. PelEX is here to guide you.
The 2024 Part 2 changes were designed with you in mind. You now have more control — and more clarity — about how your substance use disorder records are used and shared.
- PelEX works with participating organizations to update consent forms to single TPO consent — no more signing a new form every time your providers need to communicate.
- You can revoke your consent in writing at any time to PelEX and we will stop future sharing of your records.
- PelEX keeps your data secure with industry-leading encryption and access controls.
- PelEX ensures Part 2 daat is delivered to authorized care teams — reducing harmful drug interactions and improving your health outcomes.
The Part 2 changes unlock the ability to coordinate care for patients with SUD in ways that were previously burdensome or impossible. PelEX makes compliance manageable and data exchange seamless.
- PelEX works with you to simplify consent workflows: collect a single TPO consent that covers ongoing care coordination — reducing administrative burden for your clinical staff.
- PelEX offers technical guidance and implementation support for your EHR vendor
- PelEX supports your compliance obligations with audit trails and consent management.
EHR vendors and health technology partners play a critical role in enabling the Part 2 changes across the ecosystem. PelEX offers the capabilities you need to support your customers and accelerate interoperability.
- PelEX works with you to scope standardized consent data exchange via HL7 (FHIR coming soon), based on TPO consent workflows on your platform
- PelEX provides a scalable infrastructure for consented data exchange to support national interoperability goals and compliance requirements.
