A working checklist for substance use disorder record confidentiality under 42 CFR Part 2, as amended by the February 2024 final rule that aligned Part 2 with HIPAA. The compliance date passed on February 16, 2026, and OCR now enforces Part 2 with HIPAA-level civil penalties. Use the filter to see obligations for Part 2 programs, for entities that receive Part 2 records, or both together. Check items off as you confirm them; your progress saves in this browser.
Part 2 obligations split along a practical line: Part 2 programs (federally assisted programs that hold themselves out as providing SUD diagnosis, treatment, or referral) carry the full rule, while recipients of Part 2 records (hospitals, health plans, ACOs, attorneys, anyone downstream) carry redisclosure and legal-proceeding restrictions. Items badged "New · 2024 Rule" changed or first appeared in the February 2024 final rule and became enforceable on February 16, 2026.
The full rule: consent management, patient notice, counseling-note protections, security, breach notification, and the disclosure prohibitions.
Entities that receive Part 2 records under consent or an exception. Key duties: honoring redisclosure limits and keeping records out of proceedings against the patient.
Single TPO consent, HIPAA-style redisclosure for regulated recipients, SUD counseling notes, HITECH breach notification, patient complaint rights, and OCR civil enforcement.
This checklist compiles the confidentiality requirements for substance use disorder patient records under 42 CFR Part 2, as amended by the final rule at 89 FR 12472 (February 16, 2024, compliance date February 16, 2026), for general compliance-learning purposes. Part 2 applicability is fact-specific: whether a provider is a "Part 2 program" and whether particular records carry Part 2 protection depend on funding, holding-out, and how records were received. This is not legal advice. Brandon Goulter is not an attorney, and using this checklist creates no professional advisory relationship. Verify current requirements against primary sources (42 CFR Part 2 and the Federal Register) and confirm your own program's compliance with a licensed attorney before relying on this checklist. Checked items are stored only in your browser's local storage, nothing is transmitted or saved to any server.