What Is 42 CFR Part 2?

42 CFR Part 2 is a federal regulation that provides extra confidentiality protections specifically for substance use disorder treatment records, protections that go beyond standard HIPAA medical privacy rules in some important ways. This page is a general orientation, not legal advice, the specifics of how it applies to your situation are worth confirming with a treatment provider or an attorney.

Why a Separate Law Exists for This

Part 2 was created because of the specific stigma and potential consequences, employment, legal, custody, insurance, that have historically been associated with substance use treatment, on top of the general privacy concerns that HIPAA already addresses for medical records generally.

What It Generally Restricts

In general terms, Part 2 restricts a treatment provider from disclosing that someone is or was a patient, or sharing any information that would identify someone as having a substance use disorder, without the patient's written consent, with some narrow exceptions such as medical emergencies. A 2024 federal rule update also changed some of these consent rules, including how consent works for future treatment, payment, and health-care-operations disclosures, so this summary should not be treated as exhaustive or current without checking the source regulation. The specifics of consent forms, exceptions, and how this interacts with other laws are detailed and change periodically, which is part of why this page stays general rather than attempting to summarize every provision.

How This Is Different From HIPAA

HIPAA sets a baseline of medical privacy protection across healthcare generally. Part 2 adds additional, more restrictive protections specifically for substance use disorder treatment records. See HIPAA and Addiction Treatment Privacy Explained for how the two frameworks relate. The two laws interact in ways that are genuinely complex, this is an area where a general overview is a starting point, not a complete answer.

What This Means Practically

In practical terms, this is part of why addiction treatment providers ask for specific written consent before sharing any information with an employer, family member, or another provider, and why they generally can't confirm or deny that someone is a patient without that consent.

Where Part 2 Comes Up Outside of Treatment Itself

Questions about Part 2 tend to surface in specific real-world situations, an employer asking for records, a family member requesting an update, a court proceeding, or a insurance claim review. In each of these, the underlying question is the same: has the patient given the specific written consent required, or does a narrow legal exception apply. Neither a treatment provider nor a family member gets to decide this informally, it follows the regulation's specific consent and exception framework.

What to Ask a Treatment Provider About Their Part 2 Practices

It's reasonable to ask any program directly how they handle Part 2 compliance, what their consent forms actually authorize, how long records are retained, and what happens if a third party (an employer, a court, an insurer) requests information. A program that can answer these questions clearly and specifically is generally a better sign than one that responds with vague reassurance.

How Part 2 Interacts With Legal and Court Proceedings

Part 2 records generally can't be released in response to an ordinary subpoena the way many other medical records can. In most cases, releasing them requires either your specific written consent or a special court order that meets a higher legal standard than a typical subpoena, one where a judge has to weigh the public interest in disclosure against the harm it could cause you and the broader treatment system.

This matters most in situations like child custody disputes, criminal cases, or civil litigation, where someone might try to use treatment history against a person. The extra legal hurdle exists specifically because Congress recognized that fear of records surfacing in court would otherwise keep people from seeking help at all. This is general information, not legal advice, if you're facing an actual legal situation involving your treatment records, talk to an attorney familiar with 42 CFR Part 2 specifically, not just general privacy law.

What Happens If a Provider Violates Part 2

Treatment programs that improperly disclose protected information can face federal penalties, and in some cases the improperly disclosed information may not be usable as evidence in a legal proceeding, regardless of how it was obtained. If you believe your records were shared without proper authorization, that's worth raising directly with the program and, if needed, with legal counsel, this isn't something to just let go without asking questions.