Single Consent, New Rights, and the Protections That Remain

This is the second article in a three-article series on the 2024 amendments to 42 C.F.R. Part 2, the federal confidentiality rule for substance use disorder (SUD) treatment records. The first article covered why Part 2 is back at the center of care coordination and the congressional directive behind the changes. Here, we look at the rule’s centerpiece, a single patient consent for treatment, payment, and healthcare operations (TPO), along with the patient rights the rule borrows from HIPAA and the protections it leaves untouched.

Key Takeaways:

•  One written patient consent can now cover all future TPO uses and disclosures of Part 2 records.
• That consent is streamlined, not a waiver. Revocation rights, redisclosure notices, separate consent for SUD counseling notes, and protection in legal proceedings all still apply.
• Breach notifications, restriction requests, and complaints to HHS apply now. The accounting-of-disclosures right is delayed.

The Single Consent for TPO

The centerpiece of the 2024 Final Rule is the single consent for TPO. Under revised 42 C.F.R. § 2.31, a patient may now give one written consent covering all future uses and disclosures of their Part 2 records for TPO. Once a Part 2 program, HIPAA covered entity, or business associate receives records pursuant to that consent, it may redisclose them in accordance with the HIPAA Privacy Rule, subject to limitations the rule preserves, most notably the continued bar on using records in proceedings against the patient.

This moves Part 2 decisively toward HIPAA’s operational model. Under the prior framework, each disclosure typically required its own consent naming the recipient, and downstream recipients could not pass records along through ordinary TPO channels. Under the new framework, a properly obtained TPO consent functions much more like the front door to the HIPAA ecosystem. Once it is in place, records may generally move through familiar HIPAA TPO pathways, subject to the limitations that Part 2 continues to preserve.

The practical benefits are significant:

• Reduces administrative friction. Programs and their partners no longer need to chase a fresh consent for each routine disclosure.
• Facilitates care coordination, because SUD treatment information can reach the emergency physician, the primary care practice, the care manager, and the health plan through the same real-time channels that carry other clinical data, where legally and technically supported.
• Simplifies interoperability workflows for HIEs and technology intermediaries, whose value depends on records flowing across organizational boundaries without one-off legal review at every hop.

Three caveats deserve equal emphasis, because this change is a common mistake we see.

1. Consent is still required. The single TPO consent is a streamlined form of consent, not an exemption from consent; without it, Part 2’s baseline restrictions continue to apply, and a patient may revoke consent prospectively at any time.
2. The rule does not create unrestricted sharing. Redisclosure under the TPO consent must comply with the HIPAA Privacy Rule; the prohibition on the use of records against patients in legal proceedings survives; and certain records (such as SUD counseling notes, a new category the rule treats analogously to HIPAA’s psychotherapy notes) require their own separate consent.
3. Redisclosure obligations still matter. Disclosures made with consent must still carry the required notice of Part 2’s prohibition on unauthorized use and disclosure, and recipients outside the HIPAA ecosystem do not acquire HIPAA-style TPO flexibility merely by receiving the records.

The enforcement backdrop underscores why precision matters. The Coronavirus Aid, Relief, and Economic Security (CARES) Act replaced Part 2’s prior criminal-only enforcement scheme with HIPAA’s tiered civil and criminal penalty structure. The U.S. Department of Health and Human Services (HHS) has aligned Part 2 enforcement with the mechanisms its Office for Civil Rights (OCR) already uses for HIPAA. An organization that treats the TPO consent as a blanket waiver now faces the same category of enforcement exposure that attends a HIPAA violation.

HIPAA-Like Patient Rights Come to Part 2

Beyond the TPO consent, the 2024 Final Rule imports a broader set of HIPAA-familiar concepts into Part 2. That does not mean Part 2 has been folded into HIPAA or that the two frameworks are interchangeable. Still, certain privacy rights, compliance expectations, and enforcement concepts are clearly converging. The practical significance is that organizations now have a real opportunity to bring Part 2 into their broader privacy governance structures rather than running it as a separate compliance lane.

Breach notification is a good example. Part 2 programs now face HIPAA-style breach notification obligations for breaches involving unsecured Part 2 records. For organizations with mature HIPAA breach-response processes, the requirement will feel familiar on paper. Operationally, it demands more attention: a breach response is only as useful as the organization’s ability to identify what information was involved, whether Part 2 records were implicated, who received it, whether redisclosure restrictions apply, and what notices are required. Having a breach policy and having a breach policy that accounts for SUD treatment records are two different things.

The same is true for patient rights. The Final Rule adds HIPAA-like rights for patients to request restrictions on certain disclosures and to obtain an accounting of disclosures. The concepts are familiar; the execution is where it gets complicated, and the timing of the two rights is different. The right to request restrictions applies now.

The accounting right is on a delayed track: HHS has stated that the compliance date for the Part 2 accounting of disclosures will be set when the corresponding right is revised in the HIPAA Privacy Rule, and that rulemaking remains unfinished. The provision is also narrower than it first appears: it covers disclosures made with consent, applies only to disclosures for treatment, payment, and healthcare operations made through an electronic health record, and looks back three years rather than HIPAA’s six. Accounting is therefore better understood as a design requirement on the horizon than a present compliance obligation.

That is not a reason to defer the thinking. When the right does take effect, honoring an accounting request will require systems that can identify when a Part 2 record was disclosed, to whom, for what purpose, and under what consent. Organizations replacing data infrastructure are effectively deciding today whether they will be able to answer those questions later. As organizations build integrated care models, participate in HIEs, deploy analytics tools, and rely on vendors for care coordination, the ability to honor Part 2-specific rights depends heavily on data architecture. The question shifts from whether the organization has the right policy to whether its systems can support what the policy promises.

Finally, patients may now file a complaint directly with the HHS Secretary alleging a Part 2 violation, in substantially the same manner as a HIPAA complaint. Part 2 can fit within the same intake, triage, and documentation workflow that an organization already runs for HIPAA.

The enforcement landscape may also change how organizations prioritize Part 2. As enforcement concepts align with HIPAA, Part 2 is likely to draw more attention from privacy, legal, compliance, and executive teams already accustomed to managing HIPAA risk. Over time, that could move Part 2 out of the category of a specialized privacy issue and into the broader enterprise privacy program.

One thing that has not changed, and it matters: Part 2 continues to restrict the use of Part 2 records and testimony in certain civil, criminal, administrative, and legislative proceedings against a patient, absent patient consent or a court order. That protection sits at the heart of Part 2 and remains intact. Convergence is not dilution.

Next in this series: where meaningful complexity remains, from mixed records and consent revocation to state law and vendor contracts.

This article is provided for general informational purposes only and does not constitute legal advice or create an attorney-client relationship. It reflects the authors’ views as of the date of publication, does not necessarily represent the views of their employer, and may not account for subsequent regulatory or sub-regulatory developments. Organizations should consult qualified counsel regarding the application of 42 C.F.R. Part 2 and HIPAA to their specific facts and circumstances.