Part 2’s single consent freed the recipients and bound the source

The week

For half a century, records of addiction treatment in the United States have been guarded more tightly than almost any other health information. The reason is human. People seeking help for alcohol or drug use fear that their records could cost them a job, custody of a child or their freedom, and that fear can keep them from treatment at all. In February 2024, the rules that protect those records changed shape.

On February 8, 2024, the Department of Health and Human Services (HHS) announced a final rule modifying the substance use disorder confidentiality regulations at 42 CFR Part 2, usually just called “Part 2.” Two parts of HHS issued it jointly: the Office for Civil Rights (OCR), which enforces HIPAA, and the Substance Abuse and Mental Health Services Administration (SAMHSA), which had long administered Part 2. Part 2 applies to federally assisted programs that treat substance use disorder, or SUD, the clinical term for addiction to alcohol or drugs. The new rule implemented changes required by the CARES Act of 2020, the pandemic-era law in which Congress directed HHS to bring Part 2 closer to HIPAA, the main federal health privacy law.

The rule had a long lineage. Congress first protected these records in a 1970 law on alcohol abuse and extended the protection to drug abuse treatment records in 1972. HHS’s predecessor issued the first Part 2 regulations in 1975. A 1992 statute, codified at 42 U.S.C. 290dd-2, narrowed the grounds for court-ordered disclosure and carried the criminal penalties that remained the only sanction until the CARES Act. Section 3221 of the CARES Act, signed on March 27, 2020, amended that statute. HHS published a proposed rule in December 2022, and the February 2024 rule finalized it.

The headline change was about consent. The rule allowed patients to give a single consent for all future uses and disclosures of Part 2 records for treatment, payment and health care operations, often shortened to “TPO.” Before, patients typically had to sign separate consents naming each recipient. The new consent could describe recipients as a class, such as the patient’s treating providers and health plans, and could run until the end of treatment or carry no expiration at all.

The rule also changed what happens after the records leave the treatment program. HIPAA covered entities, meaning hospitals, doctors, health plans and similar organizations, and their business associates, meaning the vendors that handle health data on their behalf, may redisclose records received under that consent as HIPAA permits. There is one important exception: the records still cannot be used in proceedings against the patient. HHS added that recipients under a TPO consent did not have to segregate or segment those records from the rest of their data.

Two more changes raised the stakes. The rule applied HIPAA breach notification to Part 2 records, so a breach now triggers the same kind of notice to patients and regulators that a HIPAA breach does. And it replaced a criminal-only penalty scheme with HIPAA’s civil and criminal penalties, which made enforcement far more practical.

A longer list of smaller provisions filled out the rule. It created a protected category of “SUD counseling notes” that needs its own consent. It gave patients rights modeled on HIPAA’s: a right to request restrictions on disclosures, a right to an accounting of disclosures, and a right to file a complaint with HHS without retaliation. It rewrote the patient notice to resemble a HIPAA notice of privacy practices. It adopted HIPAA’s standard for de-identifying data.

The legal provisions moved in the other direction. The rule made explicit that the court order protections reach civil, criminal, administrative and legislative proceedings, and testimony as well as documents. It also added a limited safe harbor for investigative agencies that obtain Part 2 records without knowing it, provided they had first taken defined diligence steps.

One provision was put on hold. The new accounting of disclosures for TPO disclosures made through an electronic health record was tied to a revision of HIPAA’s own accounting rule, and would not apply until HHS finalized that revision.

The rule was published in the Federal Register on February 16, 2024. It took effect on April 16, 2024, with a compliance date of February 16, 2026, which gave organizations two years to prepare.

The rule was widely summarized as aligning Part 2 with HIPAA. That is true on average and misleading in detail, because the alignment was uneven. It fell differently on three parties. The first is the Part 2 program that creates the records. The second is the HIPAA covered entities and business associates that receive them. The third is the legal channel through which courts, investigators and regulators reach them.

Recipients gained most of the flexibility. Programs gained a simpler consent but kept tight limits and took on new enforcement exposure. The legal channel kept, and in places strengthened, the protections that make Part 2 different. Planning for the rule meant treating each party separately.

The distinction matters because most compliance plans are organized by system or by department, not by legal role. A health system’s privacy office, its EHR team and its legal department each saw a different slice of the rule. Each slice looked manageable. The risk lay in the seams between them, where data created under one set of obligations became subject to another. The sections below take the background first, then each party in turn, then a single legal request traced through one organization, then the stakes and the controls.

HIPAA, Part 2 and the locked room

HIPAA, the Health Insurance Portability and Accountability Act, is the law most people associate with health privacy. Its Privacy Rule sets out when hospitals, doctors and health plans may use and share patient information. Broadly, HIPAA lets health information flow fairly freely for treatment, payment and the running of the organization, while restricting most other uses. HIPAA works like a building where staff move between departments on an ordinary badge.

Part 2 has been a stricter regime. It was written for a specific fear: that records of addiction treatment would be used to prosecute, fire or stigmatize patients. Under Part 2, records generally could not move without the patient’s written consent, often naming each recipient, and recipients were limited in what they could pass on. Part 2 records, by contrast, sat in a locked room that needed a separate key for each visitor.

That strictness had a cost. Doctors treating a patient for heart disease or depression might not see that the patient was also in addiction treatment, including medications that could interact dangerously with others. Health systems often kept Part 2 data in separate systems or simply left it out of shared records, because tracking consents for each recipient was too hard. Care coordination suffered. The CARES Act and the 2024 rule tried to keep the protection that matters most, against use of the records against the patient, while letting the records support care.

Who counts as a Part 2 program

Part 2 does not cover all addiction treatment, and many planning errors start with getting this wrong. It covers a “program” that is “federally assisted.” Federal assistance is defined broadly. A program qualifies if a federal agency runs it, if it operates under a federal license, certification or registration, if it receives federal funds, or if it benefits from federal tax status.

That breadth pulls in most of the field. The regulation’s own examples of the registration test include Medicare certification and a DEA registration to dispense controlled substances used in addiction treatment. Opioid treatment programs that dispense methadone are therefore almost always Part 2 programs. So are many community behavioral health clinics funded through federal grants or Medicaid.

The “program” test is narrower than it sounds. An individual or entity is a program if it holds itself out as providing SUD diagnosis, treatment or referral for treatment. Inside a general medical facility, only an identified unit, or staff whose primary function is SUD care, counts. An emergency department that treats an overdose is not a Part 2 program because of that visit. A primary care physician who prescribes buprenorphine is not automatically one either, unless the practice holds itself out as an addiction treatment provider.

The consequence is that the same diagnosis can be protected by Part 2 in one building and by HIPAA alone in another. A health system has to map its programs one by one, not by service line. The map tends to surprise people. An addiction medicine clinic that advertises its services may be a program while the inpatient detox unit next to it, staffed by general hospitalists, may not be.

What Congress asked for, and what it did not

The CARES Act did not repeal Part 2 or fold it into HIPAA. It amended the Part 2 statute in specific ways. It allowed the single TPO consent and HIPAA-based redisclosure by covered entities and business associates. It imported HIPAA’s breach notification and penalty provisions. It also kept, and wrote more firmly into the statute, the ban on using records in proceedings against the patient without consent or a court order.

Congress therefore chose a hybrid on purpose. Health care operations would get HIPAA’s freedom. The courtroom would keep Part 2’s walls. The 2024 rule was HHS’s attempt to turn that hybrid into workable text. Most of the difficulty organizations later faced came from the fact that a hybrid needs a way to tell which regime governs a given record at a given moment.

A few more terms will help. A covered entity is an organization HIPAA applies to directly: most health care providers, health plans and clearinghouses. A clearinghouse is a company that translates and routes billing data between providers and insurers. A business associate is a vendor that handles protected health information for a covered entity, such as an analytics firm or a billing company. A health information exchange is a network that lets different hospitals and clinics share patient records electronically. A “lawful holder” is Part 2’s term for anyone who has received Part 2 records under the rule and is bound by its restrictions.

The source: Part 2 programs

A federally assisted substance use disorder program could now ask a patient for one consent covering treatment, payment and health care operations. The patient can revoke it in writing, and it cannot be combined with consent for SUD counseling notes. For an integrated system that runs an addiction treatment program alongside primary care, this simplified intake considerably. One form at admission could replace a series of recipient-specific consents.

The program itself, however, remained bound by the consent. The relaxed redisclosure rules applied to recipients, not to the program that obtained the consent. A program’s own uses and disclosures still had to fit what the patient had agreed to. Programs also had to give patients a notice of their rights and privacy practices and honor revocations. They had to handle a new category, SUD counseling notes, kept separate from the rest of the record and requiring their own consent for most disclosures. Counseling notes are, broadly, a clinician’s own notes analyzing what was said in a counseling session, as distinct from the core treatment record of diagnoses, medications and visits.

The consent form becomes a controlled document

A single consent sounds like less paperwork, and at the point of care it is. Behind the desk it becomes a more consequential document. The rule lists required elements. They include the patient’s name, who may disclose, a meaningful description of the information, and the recipients or class of recipients. The form must also state the purpose, the right to revoke and how, an expiration, and carry a signature and date.

A TPO consent adds statements of its own. It must tell the patient that recipients may redisclose the records and that the records will then no longer be protected by Part 2 in the same way. It must also explain what happens if the patient declines to sign. Those statements are where patient trust is won or lost. A form drafted by counsel to be legally complete can still leave a frightened patient unsure what he has agreed to.

Programs therefore had two jobs. They had to version-control the consent form, so that any disclosure could later be matched to the exact wording the patient signed. They also had to train intake staff to explain the form in a sentence or two, without overstating or understating what it permits. Both are cheap compared with what follows if the record of consent is missing when a regulator asks for it.

Revocation and the reliance problem

The patient can revoke a consent in writing, but revocation does not undo disclosures already made in reliance on it. That rule is sensible and creates an operational puzzle. Once records have flowed to a hospital and a health plan under a TPO consent, the program cannot recall them. What the program can and must do is stop further disclosures on the revoked consent.

For a program with an EHR that feeds an exchange or a shared system automatically, stopping disclosures is a technical task. The interface has to read a consent status and suppress outbound messages when it changes. A paper log at the front desk will not stop an overnight data feed. Programs that automated sharing without automating revocation built a gap that only shows up when a patient changes their mind.

New patient rights

The rule gave Part 2 patients rights that HIPAA patients already had. Patients may ask a program to restrict disclosures for TPO. Where a patient has paid in full out of pocket for a service, the patient may require the program not to disclose it to the health plan. Programs had to set up a process to receive complaints, and they may not retaliate against a patient who complains or require a patient to waive the right to complain to HHS.

The rule also gave patients a right to an accounting of disclosures. For disclosures made with consent, patients may ask for an accounting covering up to three years. The parallel right for TPO disclosures made through an EHR was put on hold until HHS finalizes a revision to HIPAA’s accounting standard. HHS had proposed that revision in 2011 and had not finalized it when the Part 2 rule appeared. This part of the rule therefore depended on a rulemaking that had stalled for over a decade.

Patients who consent to disclosures to an intermediary, such as a health information exchange or a care management organization, may also ask for a list of the participants that received their records. That right predates the 2024 rule, and the new notice tells patients about it. A program that sends records to an exchange needs to know that the exchange can produce such a list on request.

Enforcement arrives

Enforcement changed most for programs. Before the rule, Part 2 violations carried criminal penalties enforced by the Justice Department, which were rarely pursued. Afterward, HHS could impose HIPAA’s civil money penalties, and state attorneys general could bring civil actions. Breaches of unsecured Part 2 records now triggered HIPAA-style notification to patients and HHS. The rule moved Part 2 from a regime that was strict on paper but seldom enforced to one with an active regulator and a well-worn penalty process.

HIPAA’s penalty structure is tiered by culpability. At the low end are violations the organization did not know about and could not reasonably have known about. At the high end is willful neglect that is not corrected. The tiers matter because they reward documentation. An organization that can show a current risk analysis, trained staff and prompt correction is arguing from the lower tiers. One that cannot show those things invites a finding of neglect.

HIPAA breach notification has its own mechanics. Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery. HHS must be notified at the same time as individuals for breaches affecting 500 or more people, and in an annual log for smaller ones. Breaches affecting more than 500 residents of a state or jurisdiction also require notice to prominent media outlets there. A breach also triggers a presumption: an impermissible disclosure is treated as a breach unless a documented risk assessment shows a low probability that the information was compromised.

For many standalone treatment programs, which had never run a HIPAA-grade privacy and security program, this was the larger change. They needed a risk analysis, breach response procedures, workforce training and a privacy officer with real authority, often on budgets much smaller than a hospital’s. A risk analysis is a structured review of where sensitive data lives, what could go wrong, and what controls are in place. For a small community clinic, this may mean building, for the first time, a compliance function that a large hospital takes for granted.

How the burden differs by type of program

The burden fell unevenly across the field. A Part 2 unit inside a large health system could borrow the system’s privacy office, security team and breach procedures. Its main work was mapping and labeling. A standalone opioid treatment program might be a HIPAA covered entity already, because it bills insurers electronically, yet run its privacy program as a set of forms rather than a managed function.

A small nonprofit residential program funded largely by state and federal grants faced the hardest climb. It might have no full-time IT staff, an EHR configured by a vendor years ago, and no one who had ever run a breach investigation. Programs run by counties or states, such as those attached to public health departments or correctional health services, had another layer. Their records may also be subject to state public records laws, state confidentiality statutes and procurement rules that slow any change to systems or contracts.

The trade-off for small programs was stark. Every hour spent on compliance infrastructure was an hour not spent on treatment, in a field with chronic staffing shortages. Shared services helped: a state association or a managed services provider could supply a template risk analysis, a breach playbook and training content. What could not be outsourced was accountability. The rule expects someone inside the program to own the decisions.

The recipients: covered entities and business associates

For a hospital, health plan or business associate receiving records under a TPO consent, the change was substantial. It could use and redisclose those records as HIPAA permits. HHS also stated that such a recipient is not required to segregate or segment the records. Segmenting means technically separating certain data so it can be hidden or handled differently. That removed a barrier which had kept substance use treatment data out of shared records, care management platforms and health information exchanges.

The freedom had a boundary that recipients could not ignore. The records were still Part 2 records. They could not be used or disclosed in civil, criminal, administrative or legislative proceedings against the patient without specific consent or a qualifying court order. A recipient that merged the data into its general record, as the rule allowed, still had to recognize those records later. The moment came when a subpoena, an attorney’s records request or a law enforcement inquiry arrived.

That shaped practical choices. A health system did not need a separate repository, but it did need a flag or provenance field that survived ingestion, and a release-of-information workflow that checked it. Provenance simply means a record of where a piece of data came from. Ingestion is the process of loading incoming data into a system. If the label falls off when the data is loaded, nobody can tell later which entries came from a Part 2 program. A payer could leave claims data where it was. Its litigation and special investigations units still needed a rule for handling records that might contain Part 2 information. Business associates, from analytics vendors to clearinghouses, needed contract terms that carried the proceedings restriction forward.

Why “no segmentation required” still needs labels

The phrase “not required to segregate or segment” was read by some as permission to forget the records’ origin. That reading confuses two things. Segmentation means handling the data differently in everyday use, such as hiding it from some users. Provenance means remembering where it came from. The rule removed the first obligation. It could not remove the need for the second, because the proceedings restriction still attaches to the records.

Provenance is harder to keep than it sounds. Clinical data passes through interface engines, data warehouses, analytics platforms and reporting tools. Each hop may drop fields that the receiving system does not recognize. A medication imported from a Part 2 program can become indistinguishable from one prescribed in primary care after a single transformation. Keeping provenance means deciding, in each pipeline, which field carries it and testing that the field survives.

Standards exist for this. HL7, the health data standards body, publishes an implementation guide called Data Segmentation for Privacy that defines security labels for sensitive data, including substance use information. Adoption by EHR vendors has been uneven, so most organizations rely on a mix of source-system identifiers, document types and local flags. The important design choice is to label at the point of ingestion, where the source is known, not later, where it has to be inferred.

Hospitals and health systems

For a health system, the clinical benefit and the legal risk land in the same record. Clinicians gain visibility of addiction treatment medications and diagnoses, which can change prescribing and discharge planning. The same entries become discoverable when the record is pulled for litigation. Health systems therefore needed the EHR team and the release-of-information team to agree on a single definition of a Part 2-originated entry and a single way to find it.

Access policy is a separate decision. The rule did not require hiding Part 2 data from clinicians, but some systems chose to restrict access for certain roles anyway, for reasons of patient trust. That choice has a cost. Restricted data reduces the care benefit the rule was meant to deliver, and break-the-glass access patterns create their own audit burden. A system that chooses to restrict should be able to explain why, in terms of patient interest rather than habit.

Health plans

Payers receive Part 2 information mainly as claims, prior authorization requests and care management data. Under a TPO consent, a plan may use it for payment and operations much as it uses other claims. The exposure is concentrated in a few functions: special investigations units that build fraud cases, litigation teams responding to discovery, and subrogation units pursuing third-party recovery. Each of those functions can generate a use “against the patient” if it is not careful.

A plan does not need to tag every claim line. It does need a reliable way to identify claims from Part 2 programs, often by provider identifier or service code, and a rule that routes any legal use of those claims through counsel. Plans that serve Medicaid populations, where addiction treatment is common, face the largest volume of such records.

Business associates and intermediaries

Business associates are where the chain is most likely to break. A clearinghouse, a revenue cycle vendor or an analytics firm may receive Part 2 data from dozens of clients. It may combine data for benchmarking or product development within what its contracts permit. It is unlikely to know, without being told, which of its inputs are Part 2 records. Business associate agreements written before 2024 rarely mention Part 2 at all.

The fix is contractual and technical together. Agreements should identify Part 2 data as a category and carry the proceedings restriction forward. They should require the vendor to preserve any provenance labels the client supplies, and to give notice if it receives a subpoena for client data. The vendor’s own subpoena process should route requests that touch client data back to the client rather than answering them directly.

The rule also distinguishes recipients that are not HIPAA covered entities or business associates. A social services agency, a school or an employer assistance program that receives Part 2 records with consent is a lawful holder, not a HIPAA entity. It does not gain HIPAA-based redisclosure rights. For those recipients, the old, tighter Part 2 limits largely remain. Programs sharing with community partners have to keep both regimes in mind.

De-identified data and research

The rule adopted HIPAA’s de-identification standard for Part 2 data. Data de-identified to that standard, through either expert determination or removal of specified identifiers, falls outside the rule. That gave analytics and public health teams a familiar method. It also raised a familiar risk. De-identified datasets about addiction treatment are attractive to researchers and vendors, and re-identification attacks become easier as datasets are combined. Organizations that release such data should treat the expert determination route with care and keep the documentation.

The legal channel: courts, investigators and regulators

The third party is the one most compliance plans omitted. The rule tightened the conditions under which Part 2 records could be used against a patient. Court orders authorizing disclosure for such purposes had to meet specific requirements. The protection covered testimony relaying the content of records as well as the documents themselves. At the same time, the rule gave investigative agencies a limited safe harbor if they unknowingly obtained Part 2 records while acting with reasonable diligence. A safe harbor is a legal protection for someone who followed defined steps in good faith.

What a qualifying court order requires

A subpoena alone does not authorize disclosure of Part 2 records. A subpoena compels a response, but under Part 2 the response may be an objection. Disclosure for use against the patient requires a court order that meets the rule’s criteria, and in many cases a subpoena as well to compel production.

The criteria are demanding. In civil, administrative and legislative proceedings, the application must use a fictitious name for the patient. The patient and the record holder must get notice and a chance to respond. Hearings are held in chambers or otherwise kept from the public. The court must find good cause: other ways of getting the information are unavailable or ineffective, and the public interest outweighs the potential harm to the patient. The order must limit disclosure to the essential parts of the record and to the people who need them.

Criminal investigations face stricter conditions still, generally reserved for serious crimes and subject to additional findings. A records clerk does not need to master these provisions. The clerk does need to recognize that an ordinary subpoena, even one signed by a judge’s clerk or an attorney, is not the same thing as a Part 2 court order.

The investigative agency safe harbor

The safe harbor protects agencies, not providers. An investigative agency that obtains Part 2 records without knowing it can avoid liability if it took specified steps within no more than 60 days before demanding records. The steps include searching SAMHSA’s online treatment locator, checking a similar state database where one exists, checking the provider’s website or physical location, and viewing the provider’s patient notice or HIPAA notice where available.

That list has a side effect for providers. A program’s public footprint now tells investigators whether they are dealing with a Part 2 program. Programs listed in the locator, with clear notices on their websites, make it more likely that an agency will follow Part 2’s procedures from the start. Programs that are hard to identify make it more likely that records will be demanded and produced in error. Keeping public listings and notices accurate became a privacy control.

The safe harbor also requires the agency, once it learns it has Part 2 records, to follow the rule for any further use or disclosure. Police, prosecutors and state agencies with investigative powers, such as Medicaid fraud control units, are the agencies the provision has in mind. Public agencies that investigate providers or patients need written procedures of their own, separate from those of the providers they investigate.

For health systems, this put the general counsel’s office and the release-of-information desk on the front line. The release-of-information desk is the team that responds to requests for copies of medical records. A subpoena that would be routine for ordinary medical records can be improper for Part 2 records. The intake process for legal requests therefore needs a step that asks whether any responsive record originated in a Part 2 program and, if so, whether a qualifying court order or specific consent exists. Outside counsel who handle malpractice or employment disputes need the same awareness, because Part 2 records may sit in files they request.

Regulators formed the other half of the channel. With HHS’s Office for Civil Rights now able to investigate Part 2 complaints and impose civil penalties, complaint handling and breach reporting for these records joined the HIPAA compliance cycle. Organizations should expect Part 2 questions in HIPAA audits and investigations and should check specific scenarios with counsel.

State law adds a further layer. Many states have their own confidentiality statutes for behavioral health or addiction treatment records, some stricter than Part 2. The 2024 rule does not preempt stricter state protections. A multistate health system can find that a disclosure permitted under the federal TPO consent is still barred by a state statute, so the legal intake step has to consider both.

One subpoena inside an integrated system

Take an integrated system that runs hospitals, primary care clinics, a health plan and a federally assisted addiction treatment program. Under the new rule, the system is both a Part 2 program and a recipient, so all three parties live under one roof.

At the treatment program’s front desk, a new patient signs a single TPO consent at admission. The form explains that the patient may revoke it in writing. A separate form, used rarely, covers counseling notes. The program gives the patient a notice of rights and privacy practices. Its privacy officer, newly appointed with real authority, keeps a log of revocations and makes sure staff honor them.

Downstream, the patient’s medication list and diagnoses flow into the shared record that the hospital and primary care doctors use. A cardiologist treating the same patient can now see the addiction treatment medication and avoid a dangerous combination. That is the benefit the rule was designed to deliver. Behind the scenes, each of those entries carries a provenance flag marking it as originating in a Part 2 program.

Months later, a lawyer in a car accident case sends a subpoena for the patient’s complete medical records. The release-of-information clerk runs the request through intake. The system flags that some responsive entries came from the Part 2 program. Instead of sending the full file, the clerk escalates to the general counsel’s office, which checks for a qualifying court order or specific patient consent. Without either, those entries are withheld. The patient is protected, and the system avoids a disclosure that could now attract civil penalties.

Run the same scenario without the flag. The data was merged, legitimately, into the shared record, but nothing marks its origin. The clerk sends the whole file. Nobody did anything wrong at the moment of disclosure, yet the organization has breached the one protection the rule kept firmly in place.

Three variations on the same request

The same system meets the same issue from other directions. In the first variation, the system’s health plan receives a claims dispute that escalates to litigation. The plan’s legal team pulls claims history for the member. Some of those claims came from the treatment program. The plan’s discovery process needs the same Part 2 check as the hospital’s, and it runs on different software owned by a different team.

In the second, a county child welfare agency asks the hospital for records about a parent during a custody investigation. The request arrives by letter, cites the agency’s statutory authority, and looks official. The records request is exactly the kind of use against the patient that Part 2 was written to prevent. Without a qualifying court order or the patient’s specific consent, Part 2-originated entries should not go out, whatever the letterhead says. Counsel should confirm how any state reporting duties interact with that answer.

In the third, the patient revokes the TPO consent. The program records the revocation and stops sending new data to the shared record. Entries already shared remain where they are, lawfully, because the system relied on the consent when it received them. The provenance flag still matters. Those entries remain Part 2 records for purposes of any proceeding, and the release-of-information desk must still screen them.

Each variation tests a different seam: two legal teams on two systems, a public agency with apparent authority, and a consent that changed over time. A control that only works at the hospital’s release-of-information desk covers one of four doors.

Patients, penalties and the clinical prize

This rule is more than legal housekeeping. For leaders of health systems, health plans and treatment programs, it touches every part of the business that a board cares about.

Start with patients. The whole purpose of Part 2 is to make people willing to seek treatment for addiction. If a patient’s records were ever disclosed in a custody fight or a criminal case because a hospital lost track of where data came from, the harm to that person would be severe. The harm to the institution’s standing in its community, and to the willingness of others to come forward, could last far longer.

Then the money. Before the rule, the practical risk of a Part 2 violation was low, because criminal prosecution was rare. After it, HIPAA’s civil money penalties and state attorney general actions became available, and breaches triggered notification to patients and HHS. Notification itself is costly: letters, call centers, legal review and, often, credit or identity monitoring offers. A breach that once might have gone unremarked now has a visible, public price.

Regulators come next. With the Office for Civil Rights able to investigate Part 2 complaints, a single patient complaint can open an inquiry into how an organization handles these records end to end. Investigators tend to ask for documents: the risk analysis, the training records, the policies, the consent forms. An organization that cannot produce them has a problem regardless of whether a disclosure actually went wrong.

Finally, there is opportunity. Tightening enforcement was half the rule’s purpose; the other half was to let addiction treatment information support better care. Health systems and plans that build the labeling and legal screening properly can use that information in care management and coordination with confidence. Those that do not may feel safer keeping the data out altogether, and lose the clinical benefit the rule was meant to deliver.

The case against the rule, and why the analysis holds

The rule had critics on both sides, and their arguments sharpen the analysis. Some patient and privacy advocates argued that the single TPO consent weakened the protection patients relied on. Once records enter a HIPAA environment, they travel to many more recipients, and each additional copy is another chance for a breach or misuse. On this view, the clinical gains did not justify a larger attack surface for the most stigmatizing data in medicine.

Some provider and payer groups argued the opposite. They wanted Part 2 folded fully into HIPAA, proceedings restriction included, so that records could be handled uniformly. On this view, any special status keeps the data partly segregated in fact, whatever the rule says, and so preserves the care gaps the CARES Act was meant to close.

Both critiques support the argument made here. The advocates’ concern is a reason to invest in provenance and legal screening, because the protection that remains depends on them. The providers’ concern explains why recipients will be tempted to drop the labels, and why that temptation needs to be resisted by design rather than by memo. Congress chose the hybrid, and the hybrid only works if organizations can still identify the records it protects.

A third objection is practical. Small programs may respond to the new enforcement exposure by sharing less, not more, which would defeat the rule’s purpose. That risk is real. The answer lies partly with the large recipients. Health systems and plans that want the data can lower the barrier by offering partners shared consent templates, interface support and clear contract terms.

Labels, intake checks and contracts

A well-prepared organization knows which of its entities are Part 2 programs, which are recipients, and which are both. Its programs run a real privacy and security program, sized to their budget but complete. Its systems keep a provenance flag on Part 2 data from the moment it arrives. Its legal intake process asks the Part 2 question every time. Its vendor contracts carry the proceedings restriction forward.

Owners and sequencing

The work divides cleanly among owners. The privacy officer owns the entity map, the consent and notice templates, and the complaint process. The CIO or CMIO owns the provenance design, the interface changes and the revocation handling. The general counsel owns the legal intake procedure and the instructions to outside counsel. Procurement or vendor management owns the contract amendments. The CISO owns the risk analysis and the breach playbook updates.

Sequencing matters more than speed. The entity map comes first, because every other decision depends on it. Provenance design comes next, before any new data feed goes live, since labeling at ingestion is far cheaper than retrofitting. Legal intake changes and contract amendments can run in parallel. Training comes last, once the procedures it teaches are settled.

Evidence an investigator would ask for

An OCR investigation of a Part 2 complaint would likely follow the HIPAA playbook. Organizations should be ready to produce the following:

• The current consent and notice templates, with the dates each version was in use.
• A log of consents, revocations and restriction requests, showing how each was honored.
• The risk analysis covering systems that hold Part 2 data, and the plan to address its findings.
• Training records for staff who handle intake, release of information and legal requests.
• Business associate agreements that address Part 2 data and the proceedings restriction.
• A record of legal requests that touched Part 2 data, with how each was resolved.

Metrics that show whether it works

Leaders need a small set of measures that reveal whether the controls hold. One useful measure is the share of inbound Part 2 data that arrives with a provenance label intact. Others are the time from revocation to suppression of outbound feeds, and the number of legal requests escalated under the Part 2 check. Periodic sampling helps too: pull a set of merged records and confirm that the Part 2 entries can still be identified. These measures need no new technology. They need someone to decide they will be measured.

The predictable failures:

• Reading the headline only. Treating “aligned with HIPAA” as meaning Part 2 records now behave exactly like any other health data.
• Merging without labeling. Bringing Part 2 data into shared records, as the rule allows, but losing track of where it came from.
• Forgetting the small programs. Assuming a standalone clinic can absorb HIPAA-grade obligations without a risk analysis, training or a privacy officer.
• Leaving lawyers out. Building consent forms and data flows while the subpoena desk and outside counsel carry on as before.
• Mixing consents. Folding counseling notes into the general TPO consent, which the rule does not allow.
• Silent contracts. Business associate agreements that never mention the restriction on use in proceedings against the patient.
• Automating sharing but not revocation. Interfaces that keep sending data after a patient withdraws consent.
• Ignoring non-HIPAA partners. Treating a school, employer program or social services agency as if it had HIPAA-based redisclosure rights.

What counsel and the CIO should be able to show

1. Which of our entities are Part 2 programs, which receive Part 2 records, and which are both?
2. Does each treatment program have a current risk analysis, a breach response plan, staff training and a privacy officer with real authority?
3. When Part 2 data enters our shared records, does anything mark where it came from? Does that mark survive every system it passes through?
4. When a subpoena or records request arrives, at what step do we check whether any responsive record came from a Part 2 program? Who decides what happens next?
5. Do our contracts with analytics vendors and clearinghouses carry forward the restriction on use in proceedings against the patient?

Two narrower checks belong on the same list: how a patient’s written revocation of consent is recorded and honored, and whether outside counsel know that files they request may contain Part 2 records. Treating the three parties separately changes the plan. A system that is both a Part 2 program and a recipient needs three things. It needs a consent and notice program at the source, a provenance flag and proceedings check downstream, and a legal intake step that connects the two.

Each answer should come with evidence, not assurance. The entity map should be a document with a date and an owner. The provenance answer should name the field and the test that shows it survives. The legal intake answer should point to a written procedure and a log of cases that went through it. A board or audit committee that asks for these artifacts will learn more in an hour than from a slide that says the organization is compliant.

With hindsight

The compliance date of February 16, 2026 has now passed, and the rule’s structure was not changed before it arrived. From that date, Part 2 violations fell under the HIPAA-style civil penalties and breach notification duties the rule created. The two-year runway was over, and the obligations described here became live.

The runway itself was shorter than it looked. The rule took effect in April 2024, so organizations could adopt the single consent early. Most of the remaining time went to work that has no shortcut: mapping programs, changing interfaces, amending contracts and updating notices. An organization that left the mapping late would have found every later step waiting on it.

Related HIPAA work landed on the same date. A separate HIPAA rule issued in April 2024 required covered entities to update their notices of privacy practices to reflect Part 2 by February 16, 2026. A notice of privacy practices is the document patients receive explaining how their information may be used and what rights they have. Aligning the two deadlines meant many organizations could update their patient-facing materials once rather than twice.

Then came a legal twist. When a federal court in Texas vacated most of that April 2024 rule in June 2025, the reproductive health provisions fell, but the Part 2 notice changes were left in place. To vacate a rule is to strike it down. Organizations that had paused their notice updates while the case was pending had to pick the work back up for the Part 2 portions.

Events in the same month as the rule tested its assumptions about recipients. On February 21, 2024, a ransomware attack hit Change Healthcare, one of the largest claims clearinghouses in the country and a business associate to a large share of American providers and payers. UnitedHealth Group, its parent, later reported that the breach affected about 190 million people. Clearinghouses route claims for addiction treatment along with everything else. The attack showed how much sensitive data concentrates in a few intermediaries, which is where this analysis located the weakest link in the chain.

Other parts of the regulatory picture moved without settling. In January 2025, HHS proposed a major overhaul of the HIPAA Security Rule, which would reach Part 2 programs that are also HIPAA covered entities. In March 2025, HHS announced a reorganization plan that would fold SAMHSA, one of the rule’s two co-authors, into a new Administration for a Healthy America. Neither change altered the Part 2 rule’s text. Both pointed toward OCR, with its HIPAA enforcement machinery, as the center of gravity for these records.

The accounting of disclosures for TPO disclosures through an EHR remained the rule’s loose thread. It depends on a HIPAA accounting rule that HHS proposed in 2011 and had left unfinished for more than a decade when the Part 2 rule appeared. Organizations that built their plans around the provisions already in force lost nothing by leaving that one aside.

The uneven alignment described here therefore reached compliance intact. Recipients gained flexibility. Treatment programs had to run a HIPAA-grade privacy and breach program for the first time. Legal teams had to screen requests for Part 2 records inside merged data.

What held up best was the distinction between segmentation and provenance. The rule removed the duty to segregate, and the proceedings restriction made remembering origin unavoidable. What looks weaker in hindsight is any expectation that small programs would absorb the new obligations unaided. Their capacity, more than the rule’s text, was always going to set the pace at which addiction treatment data reached shared records.

“Simplification” in a regulation rarely means less work for everyone. It usually moves the work. Here, it moved away from consent paperwork at the point of care and toward data labeling, small-program compliance and legal screening. Organizations that saw that shift early could share addiction treatment data to improve care while keeping the protection patients were promised.