Why Part 2 Is Back at the Center of Care Coordination

Key Takeaways:

• The 2024 Final Rule’s Feb. 16, 2026, compliance date has passed, and the HHS Office for Civil Rights now enforces Part 2.
• The changes are evolutionary: Part 2 still requires patient consent and still protects SUD records from use in legal proceedings against the patient.
• The rule implements a congressional directive to align Part 2 more closely with HIPAA without merging the two.

Why Part 2 Matters

For most of its half-century existence, the federal confidentiality rule for substance use disorder (“SUD”) treatment records at 42 C.F.R. Part 2 (referred to here as “Part 2”) lived in a compliance world of its own. Health systems, health plans, health information exchanges (“HIEs”), and technology intermediaries built their privacy programs around the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). They handled Part 2 records, when they encountered them at all, as a separate operational category: segregated data stores, bespoke consent forms, and workflows deliberately walled off from the treatment, payment, and healthcare operations (“TPO”) pipelines that move most health information through the modern healthcare system.

That separation is narrowing. In February 2024, the U.S. Department of Health and Human Services (“HHS”), acting through the Substance Abuse and Mental Health Services Administration (“SAMHSA”) and the Office for Civil Rights (“OCR”), published a final rule comprehensively amending Part 2. That rule represents the most significant revision to the regulation in years and the culmination of a directive Congress issued in section 3221 of the Coronavirus Aid, Relief, and Economic Security Act (“CARES Act”) to bring Part 2 into closer alignment with HIPAA. The rule took effect on April 16, 2024, and the February 16, 2026, compliance date has now passed. With HHS having delegated Part 2 enforcement to OCR (the same regulator that enforces HIPAA), the alignment is no longer a forthcoming development to monitor. It is the operating environment.

That is why Part 2 has moved from the periphery of privacy compliance back to the center of care coordination strategy. Organizations are revisiting foundational questions:

• How consent is captured and managed
• How redisclosure restrictions follow records downstream
• How expanded patient rights will be operationalized
• What the enforcement posture now looks like
• Whether data segmentation architectures built for the old regime still make sense

For organizations whose business is moving clinical information in real time (alerting a care team when a patient presents in an emergency department, closing gaps in care, or reconciling records across settings), the treatment of SUD information is no longer an edge case. It is a design requirement.

Two framing points are worth stating at the outset. First, the changes are evolutionary, not revolutionary. Part 2 has not been repealed, folded into HIPAA, or stripped of its consent requirement. The regulation’s heightened protections reflect a deliberate congressional judgment that people will not seek SUD treatment if doing so creates a discoverable record that can be used against them. That judgment survives the 2024 amendments intact. Second, the purpose of the new framework is better care coordination with confidentiality, not instead of it: the rule is designed to protect sensitive SUD information while making it materially easier to share that information among the providers, plans, and partners involved in a patient’s care.

The practical consequence for many organizations is a period of reassessment. Where Part 2 records are in scope, that work tends to involve revisiting privacy policies and notices, reviewing vendor and data-sharing agreements, and re-examining the technical workflows that determine whether Part 2 data can flow where the law now permits. This series maps that landscape. This first article covers what makes Part 2 different and the congressional mandate behind the 2024 Final Rule. The second covers what the rule changed and where the two frameworks now converge. The third covers where meaningful complexity remains.

A Brief Refresher: What Makes Part 2 Different from HIPAA

HIPAA and Part 2 regulate overlapping information through different architectures, and the differences are easiest to see side by side. HIPAA’s Privacy Rule applies broadly to covered entities and to the business associates that handle protected health information on their behalf. Its central operational feature is permissive: covered entities may use and disclose protected health information for TPO without obtaining the individual’s authorization.

Part 2 starts from the opposite premise. It applies to federally assisted programs that hold themselves out as providing, and do provide, SUD diagnosis, treatment, or referral for treatment, and to the records those programs create, including many downstream recipients of those records. Historically, Part 2 required specific written patient consent for most disclosures, including those made for treatment purposes that HIPAA would permit as a matter of course. It imposed strict limits on redisclosure: a recipient of Part 2 records received them subject to a prohibition on further disclosure and a required notice to that effect. And it sharply restricted the use of these records in civil, criminal, administrative, and legislative proceedings against the patient.

None of this severity is incidental. Congress’s underlying concern was stigma: absent a credible promise of confidentiality, individuals would avoid or abandon SUD treatment rather than risk exposure to prosecution, job loss, custody consequences, or discrimination. The practical result, for years, was operational bifurcation. Organizations treated Part 2 data as a separate category requiring specialized handling: distinct consent forms, distinct storage, and distinct release-of-information workflows. This bifurcation existed because Part 2 has long imposed safeguards more restrictive in certain respects than HIPAA’s general framework. Understanding that baseline is essential to understanding what the 2024 Final Rule does, and does not, change.

At a Glance: HIPAA vs. Part 2 (before the 2024 Final Rule)

What Congress Directed

The 2024 Final Rule did not emerge from agency initiative alone; it implements a specific congressional command. Section 3221 of the CARES Act, enacted in March 2020, substantially amended Part 2’s authorizing statute, 42 U.S.C. § 290dd-2, and directed HHS to align aspects of Part 2 more closely with HIPAA. Among other things, Congress authorized a single patient consent covering all future uses and disclosures for TPO, extended HIPAA-style breach notification to Part 2 records, applied HIPAA’s civil and criminal enforcement structure to Part 2 violations, and added antidiscrimination protections for individuals whose records are disclosed.

The important interpretive point is that Congress preserved Part 2’s core identity while authorizing greater harmonization. The CARES Act did not merge Part 2 into HIPAA or eliminate consent as the gateway to disclosure. It kept the statute’s foundational architecture (including its heightened protections against use of records in legal proceedings) and layered HIPAA-compatible mechanics on top. The 2024 Final Rule is HHS’s implementation of that mandate, and its structure mirrors the statute’s balance: operational alignment where Congress authorized it, continued distinctiveness where Congress preserved it.

Next in this series: what the 2024 Final Rule changed, starting with single patient consent for treatment, payment, and healthcare operations, and the HIPAA-like patient rights now coming to Part 2. Check the Bamboo Health blog for more.

This article is provided for general informational purposes only and does not constitute legal advice or create an attorney-client relationship. It reflects the authors’ views as of the date of publication, does not necessarily represent the views of their employer, and may not account for subsequent regulatory or sub-regulatory developments. Organizations should consult qualified counsel regarding the application of 42 C.F.R. Part 2 and HIPAA to their specific facts and circumstances.