Subject: Final rule changes to 42 CFR Part 2

Final Rule Changes to 42 CFR Part 2

On February 8, 2024, the U.S. Department of Health & Human Services (HHS) through the Substance Abuse and Mental Health Services Administration (SAMHSA) and the Office for Civil Rights (OCR) announced final rule changes to 42 CFR Part 2 ("Part 2"), the federal law that protects the confidentiality of substance use disorder (SUD) treatment records.

The changes in the final rule implement provisions of the CARES Act (enacted March 27, 2020), which required HHS to align certain aspects of Part 2 with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Rules and Health Information Technology for Economic and Clinical Health Act (HITECH).

The new Part 2 rule modifications:

  • Include changes to patient consent requirements.

  • Permit disclosures without patient consent to public health authorities according to the standards under HIPAA.

  • Restrict the use of records and testimony against patients without consent or a court order.

  • Add a right to file a complaint directly with the Secretary for an alleged violation of Part 2.

  • Change the requirements for segregating Part 2 data.

  • Align enforcement and imposition of penalties with HIPAA.

  • Apply the same breach notification requirements found in HIPAA.

  • Align patient notice of privacy practices with HIPAA.

  • Create safe harbor requirements.

  • Create a right for patients to opt out of fundraising communications.

Stay up-to-date with the CoE-PHI!

At this time, the CoE-PHI Team is reviewing the final rule in detail. Following that process, we'll provide training and technical assistance, and disseminate resources to assist providers and administrators of SUD and behavioral health treatment in various settings, and state and local agency leaders, in understanding and applying this new rule in practice.

For any questions of concerns, please contact

Michael Graziano at

 Funded by SAMHSA, the CoE-PHI develops and disseminates resources, training, and TA for states, healthcare providers, school administrators and individuals and families to improve understanding and application of federal privacy laws and regulations, including FERPA, HIPAA, and 42 CFR Part 2, when providing and receiving treatment for SUD and mental illness.

Our website is supported by SAMHSA of the U.S. Department of Health and Human Services (HHS) as part of a financial assistance award with 100% funded by SAMHSA/HHS. The contents are those of the author(s) and do not necessarily represent the official views of, nor an endorsement, by SAMHSA/HHS, or the U.S. Government.

Resources, training, technical assistance, and any other information provided through the CoE-PHI do not constitute legal advice.