42 CFR Part 2 vs HIPAA: What Behavioral Health Clinics in Orange County Need From IT

42 CFR Part 2 protects the confidentiality of certain substance use disorder (SUD) patient records. For a behavioral health provider, the first step is determining whether its programs, records, and recipients are subject to Part 2, then designing workflows that respect both Part 2 and applicable HIPAA and California requirements.

In brief: Part 2 permits a single patient consent for future treatment, payment, and health care operations disclosures. Other disclosures and uses have different rules and exceptions. The 2024 final rule required compliance by February 16, 2026. HHS explains the current protections.

Which organizations and records are covered?

Part 2 applies to certain federally assisted SUD programs and protects records that identify a patient in connection with SUD diagnosis, treatment, or referral for treatment. Some requirements also apply to recipients of those records, including qualified service organizations, other health care providers, and certain HIPAA covered entities and business associates. Federal assistance is broadly defined, but receiving a particular payment or grant does not by itself answer every question about whether a program or record is covered. Review the program's structure and services with a qualified compliance professional. See 42 CFR 2.11 and 2.12.

A clinic providing only mental health care is not automatically a Part 2 program, but it may receive records protected by Part 2. Federally qualified health centers and providers working with CalOptima or county systems should examine each SUD program, the data it receives, and the relevant agreements rather than assume a uniform rule for every service.

How do consent and redisclosure work?

The 2024 HHS final rule allows one consent for all future uses and disclosures for treatment, payment, and health care operations. When HIPAA covered entities and business associates receive records under that consent, they may redisclose them as HIPAA permits, subject to Part 2 restrictions on proceedings against the patient. Other disclosure rules and exceptions depend on the recipient, purpose, and circumstances. A general HIPAA workflow should not be assumed to satisfy every Part 2 requirement.

Part 2 imposes special restrictions on use or disclosure in civil, criminal, administrative, or legislative proceedings against a patient. Patient consent or an appropriate Part 2 court order and accompanying legal process may permit certain disclosures. A routine subpoena alone is not the same as a qualifying court order.

What should an IT review cover?

• Record identification and access: Identify where protected records enter, reside, and move. Configure access, disclosure controls, and data handling to support the organization's policies. Separate databases or partitions are not automatically required in every situation.
• Consent and disclosure workflows: Review how the EHR records consent, communicates its scope, and handles patient requests and disclosures to outside recipients.
• Audit and incident response: Check access and disclosure logging against the organization's applicable obligations and risk assessment. Update breach response procedures for the revised Part 2 and HIPAA rules.
• Vendor agreements: Determine whether a vendor is a HIPAA business associate, a Part 2 qualified service organization, or both. Review the appropriate agreement and its data handling obligations with counsel; a single generic template is not a substitute for that review.
• Integrations and backups: Document information exchanged with health information exchanges, payers, county programs, and backup providers, and test permissions and recovery procedures.

HHS's qualified service organization guidance describes the required written agreement for a QSO. The applicable facts determine whether one is needed.

How does this relate to HIPAA and California law?

Part 2 and HIPAA overlap but are distinct. The 2024 rule brought several requirements closer to HIPAA, including breach notification and enforcement, while retaining special protections for SUD records. California law may add requirements depending on the provider, record, and disclosure. Have counsel assess the specific facts rather than assume every Part 2 issue automatically violates another law.

Frequently asked questions

Does the rule require separate consent for every routine disclosure?

Not necessarily. A single consent can cover future treatment, payment, and health care operations uses and disclosures. Other purposes have separate requirements and exceptions.

Does an EHR have to store SUD records in a separate partition?

Part 2 does not prescribe one universal database design. The organization should assess whether its chosen system and configuration can support its applicable privacy, consent, disclosure, and security obligations.

What are the penalties?

The 2024 final rule aligned Part 2 enforcement with the applicable HIPAA civil and criminal enforcement authorities. The outcome depends on the facts and the applicable law. See the HHS fact sheet.

How can AdVran help?

AdVran's healthcare IT and compliance and risk management services can help teams inventory systems, review access controls and integrations, and document technical safeguards. The provider and its legal and compliance advisers determine the requirements for its programs and contracts.

Related reading

• HIPAA Security Rule support
• Healthcare IT in Irvine
• Healthcare IT in Riverside