What is 42 CFR Part 2?

Posted By Steve Alder on Dec 9, 2025

42 CFR Part 2 is a set of federal regulations that protects the confidentiality of substance use disorder patient records created, received, maintained, or transmitted by a federally assisted Part 2 program or by a lawful holder of the information. The purpose of the regulations is to reduce stigma and discrimination associated with substance use disorders by ensuring sensitive information is not disclosed without consent. 

At the start of the 1970s, Congress recognized that drug abuse was rapidly increasing and affecting urban, suburban, and rural communities. As part of a long-term national strategy, Congress passed a series of Acts to combat drug and alcohol abuse through prevention, treatment, rehabilitation, education, and law enforcement.    

Recognizing that, if it were known that patients were seeking help for substance use disorders, they may experience personal, professional, and legal consequences, Congress also instructed the Secretary of Health and Human Services to develop regulations to protect the confidentiality of patients in federally assisted programs.  

The regulations were published in 1975 in Part 2 of Title 21 of the Code of Federal Regulations under the jurisdiction of the Food and Drug Administration. They were subsequently relocated to Part 2 of Title 42 in 1983 to reinforce the message that patient confidentiality is a public health issue and not a drug enforcement issue.  

Who Does 42 CFR Part 2 Apply To? 

42 CFR Part 2 applies to any federally assisted healthcare provider or facility that “holds itself out” as providing substance use disorder diagnoses, treatments, or referrals. This means that any provider or facility that directly or indirectly receives funds from the federal government qualifies as a Part 2 program if the provider or facility: 

• Advertises substance use disorder (SUD) services, 

• Lists the provision of SUD services in directories, 

• Identifies workforce members as SUD providers, 

• Operates an identified SUD unit or service, and/or 

• Makes public statements about providing SUD care. 

In addition, 42 CFR Part 2 applies to “lawful holders” that receive protected information from a Part 2 program with the patient’s consent or under an exception. Examples of lawful holders include primary care providers, health plans, and social service agencies. Once a lawful holder has received the information, they must comply with 42 CFR Part 2 and not redisclose the information unless permitted by the patient’s consent or under an exception. 

One of the most common exceptions is when a lawful holder is also a HIPAA-covered entity. Since the 2024 CARES update to 42 CFR Part 2, HIPAA-covered entities that receive Part 2 records under a patient’s single consent for treatment, payment, and healthcare operations can use and disclose the information as permitted by HIPAA – except for specially protected uses, such as civil and criminal proceedings, where knowledge of a substance use disorder could influence the outcome of the proceedings.  

What Information Is Protected by Part 2? 

42 CFR Part 2 protects any information that would identify an individual as having – or as having had – a substance use disorder, or as having sought or received SUD treatment. This includes not only medical records, but also appointment information, billing records, and even the mere fact that someone is a patient in a Part 2 program. The protection applies to information in written, electronic, and verbal formats. 

The information is protected by the strict consent requirements of 42 CFR Part 2, which stipulates that a Part 2 program may not disclose protected information unless the patient provides written consent that meets specific regulatory requirements. The consent must clearly identify who may receive the information, what information may be disclosed, and for what purpose. Redisclosure by the recipient is also limited, helping ensure that information does not spread beyond what the patient intended. 

There are limited exceptions to the consent requirement. These include medical emergencies, certain research and audit activities, and disclosures required by a court order under very specific conditions. Even in these situations, disclosures must be narrowly tailored to minimize unnecessary exposure of patient information. 

Violations of 42 CFR Part 2 can result in civil and criminal penalties – not only for the Part 2 program or lawful holder, but also for members of the workforce that violate the Part 2 requirements. For this reason, providers and facilities must implement appropriate policies and procedures, provide 42 CFR Part 2 training to all members of the workforce, and monitor workforce compliance with the policies and procedures.