Description
42 CFR PART 2 | SUBSTANCE USE DISORDER CONFIDENTIALITY
42 CFR Part 2 Behavioral Health Confidentiality Kit
Document ID: BHK-PT2-001 • Version 1.0
42 CFR Part 2 imposes confidentiality requirements on substance use disorder patient records that are stricter than the HIPAA Privacy Rule in several respects, including a redisclosure prohibition and a consent standard that a standard HIPAA authorization does not satisfy. A program that treats Part 2 records under a general HIPAA framework alone is not compliant, regardless of how strong its HIPAA policies are. This exposure grew after the 2024 SAMHSA final rule (89 FR 12472, 89 FR 12618), with full enforcement effective February 16, 2026, which aligned parts of Part 2 with HIPAA’s breach notification and enforcement structure while preserving Part 2’s stricter consent and redisclosure rules.
This kit builds a complete confidentiality framework around that overlap. The core Part 2 policy governs consent, use, and disclosure of federally assisted SUD treatment records. Three additional documents address the records and populations that sit adjacent to Part 2: general behavioral health PHI and psychotherapy notes, HIV/AIDS-related information for dual-diagnosis programs, and minor patients receiving SUD or behavioral health treatment.
A Qualified Service Organization Agreement extends the redisclosure prohibition to outside vendors, and a Workforce Confidentiality Agreement puts a signed acknowledgment behind all of it. The included START HERE guide sets out which of the six documents are required for every Part 2 program and which are situational, with a numbered implementation order so you are not guessing where to begin.
What Is Included (6 Documents)
Required for Every Part 2 Program
- 42 CFR Part 2 Policy: core consent, use, and disclosure procedures for federally assisted SUD treatment records, including the redisclosure prohibition and TPO consent workflows (42 CFR Part 2)
- Mental/Behavioral Health Confidentiality Policy: HIPAA-based procedures for behavioral health PHI outside strict Part 2 scope, including psychotherapy notes segregation and disclosure limits (45 CFR 164.501, 164.508(a)(2), 164.524(a)(1)(i))
- Workforce Confidentiality Agreement: signed staff acknowledgment operationalizing the redisclosure prohibition and confidentiality obligations above (45 CFR 164.530(b)(e)(f)(g))
Situational, Based on Program Structure
- Qualified Service Organization Agreement (QSOA): required when an outside vendor, such as billing, IT, or an answering service, needs access to Part 2-protected records without providing direct treatment (42 CFR 2.11, 2.12(c)(4), 2.21, 2.32)
- HIV/AIDS Confidentiality Policy Supplement: for integrated or dual-diagnosis programs where HIV/AIDS status appears alongside SUD or behavioral health records
- Pediatric/Minor Patient Privacy Policy: for programs treating minors, addressing minor consent and parental access nuances specific to SUD and behavioral health treatment (45 CFR 164.502(g))
Who This Is For
Privacy officers and program directors at substance use disorder treatment programs, behavioral health clinics, and dual-diagnosis or integrated-care providers who need a Part 2 compliance program in place, whether building one from scratch, onboarding a new billing or IT vendor under a QSOA, or preparing records for a SAMHSA or OCR review. Also suited to compliance consultants assembling a Part 2 program on behalf of a client organization. The 42 CFR Part 2 Behavioral Health Confidentiality Kit is scoped for exactly that population, not a generic HIPAA policy set retrofitted to cover Part 2.
Not every document in the 42 CFR Part 2 Behavioral Health Confidentiality Kit applies to every program. The included START HERE guide walks through which documents are required versus situational for your specific program structure and the order to implement them in. Each document requires customization to your organization’s name, program details, and applicable state law citations before use, and this kit is a compliance document template set, not legal advice; have counsel review before adoption, particularly the state law sections in the HIV/AIDS, mental health, and minor patient documents. Organizations that also need a baseline HIPAA compliance program alongside Part 2 can pair this kit with the HIPAA Compliance Essentials bundle.
Format: Microsoft Word (.docx), fully editable • Delivered as an instant digital download • Document ID: BHK-PT2-001
Reviews
There are no reviews yet.