Where Part 2 Complexity Remains

This is the final article in our three-article series on the 2024 amendments to 42 C.F.R. Part 2, the federal confidentiality rule for substance use disorder (SUD) treatment records. The first article explained why Part 2 is back at the center of care coordination, and the second covered the single consent for treatment, payment, and healthcare operations (TPO), and the new patient rights. This article turns to where meaningful complexity remains, and what the convergence of Part 2 and HIPAA means going forward.

Key Takeaways:

• The rule does not require segmenting Part 2 records, but systems still need to reliably identify, track, and honor consent for them.
• Consent revocation, downstream redisclosure, state law, and vendor contracts all still need careful, cross-functional work,
• Policies and data architecture have to advance together, and the gap between them is where risk concentrates.

Even with greater alignment, Part 2 remains its own framework. The 2024 Final Rule reduces certain operational friction, but it does not eliminate the need for careful analysis. If anything, the work is becoming more practical and more cross-functional. Organizations are no longer asking only what Part 2 requires; they are asking how to operationalize Part 2 within systems and workflows largely built around HIPAA.

The threshold issue is deceptively simple: is the entity a Part 2 program in the first place? That analysis is fact-specific and can turn on the nature of the services provided, how the entity holds itself out, whether it provides SUD diagnosis, treatment, or referral for treatment, and whether federal assistance is involved. For organizations offering a mix of physical health, behavioral health, care coordination, technology, and data exchange services, the answer is rarely straightforward.

In modern healthcare environments, information does not stay neatly in one lane. A single record, platform, message, referral, or data feed may include Part 2-protected information alongside other protected health information, creating practical questions around segmentation, access controls, consent management, redisclosure notices, audit trails, and downstream use. It is worth being precise about what the rule does and does not require here. The Final Rule expressly states that segregating or segmenting Part 2 records is not required. Segmentation can be a sound design choice, and some organizations will adopt it, but it is an architectural option rather than a compliance mandate. The policy goal is better care coordination, with heightened protections for SUD treatment records, but that balance is difficult to strike if systems cannot reliably identify, tag, or track Part 2 data. As interoperability expands, the investment is not just in updated forms and policies but in technical infrastructure capable of more precise privacy controls.

A single consent for future TPO disclosures reduces administrative burden. However, organizations still need to plan for the moment a patient revokes it: when revocation takes effect, which prior disclosures remain permissible, which future disclosures must stop, and how revocation is communicated across internal teams, vendors, and downstream recipients. If revocation lives in a policy document but not in the systems that move the data, gaps are likely.

Downstream redisclosure raises related issues. The revised framework permits broader operational use once appropriate consent is obtained, but organizations cannot lose sight of what happens after disclosure. Part 2 has always placed significant weight on redisclosure limitations, and those obligations now must operate in increasingly complex data-sharing environments involving health information exchanges (HIEs), technology vendors, care coordination platforms, analytics tools, and other intermediaries. That is an engineering problem as much as a legal one.

State law adds another layer. Some states impose additional protections for SUD, behavioral health, mental health, HIV/AIDS, genetic, or other sensitive information, sometimes stricter than federal law. Even as federal Part 2 and HIPAA requirements converge, organizations still need to evaluate whether state-specific requirements affect consent, disclosure, patient rights, segmentation, or retention workflows. Federal alignment does not eliminate the state-by-state analysis.

Vendor and contractual considerations also warrant a fresh look. Business associate agreements, qualified service organization agreements, data-sharing agreements, participation agreements, and other vendor contracts should accurately document roles and obligations:

• Consent
• Redisclosure
• Breach notification
• Use limitations
• Patient rights
• Audit cooperation
• Incident response

Standard HIPAA language alone is unlikely to be sufficient.

 Convergence Without Elimination

The story of the 2024 Final Rule is a quiet one. What has changed is subtler than a repeal or merger and, in the long run, more consequential: the framework that once lived in a compliance world of its own is being absorbed into the workflows, governance structures, and technologies that organizations already use to administer HIPAA. The convergence is real, but it is not equivalence.

A single consent for TPO, HIPAA-style breach notification, expanded patient rights, and a tiered enforcement structure now overseen by the same regulator that enforces HIPAA all point toward a Part 2 designed to function within modern healthcare operations rather than beside them. At the same time, the protections that gave Part 2 its purpose remain intact: consent remains the gateway to disclosure; redisclosure restrictions still follow records downstream; SUD counseling notes require their own separate consent; and the bar on using these records against a patient in legal proceedings remains untouched.

For the organizations that move clinical information in real time, the shift is less about any single legal change than about where the work now lives. With the February 2026 compliance date behind us, the operative question has shifted from whether Part 2 applies to whether existing systems can support both what the law now permits and what it still requires. A privacy program may be mature from a HIPAA perspective and still fall short on Part 2’s consent, redisclosure, and revocation obligations.

Policies, notices, and contracts do substantial work here. They record the commitments an organization has made, define the standard against which a regulator will measure it, and allocate responsibility among the parties handling Part 2 records. But documentation and data architecture have to advance together. The technical capability to deliver on those commitments generally takes longer to build, and that lag is where residual risk tends to concentrate.

Looking ahead, the biggest development is unlikely to be another sweeping rule. It will be the steady operational absorption of Part 2 into enterprise privacy risk assessments, vendor diligence, consent-management tooling, breach-response protocols, interoperability strategy, and data governance, reinforced by state-law overlays that federal alignment does nothing to eliminate. The quiet convergence of HIPAA and Part 2 does not reduce the need for careful compliance; it changes its character, from a discrete legal question into an implementation discipline exercised across people, process, and technology. The organizations that recognize both halves of that balance (the alignment and the enduring difference) will be best positioned to support the care coordination the rule was meant to enable while preserving the confidentiality Part 2 was designed to protect.

This article is provided for general informational purposes only and does not constitute legal advice or create an attorney-client relationship. It reflects the authors’ views as of the date of publication, does not necessarily represent the views of their employer, and may not account for subsequent regulatory or sub-regulatory developments. Organizations should consult qualified counsel regarding the application of 42 C.F.R. Part 2 and HIPAA to their specific facts and circumstances.