42 CFR Part 2 Compliance Consulting for Substance Use Disorder Programs
We help substance use disorder programs put Part 2 consent forms, record policies and staff training in writing.
Book a Free Discovery Call
Confidential. No obligation. Direct access to James.
Operational compliance with one federal rule
42 CFR Part 2 is the federal rule that restricts the use and disclosure of records that would identify a patient as having or having had a substance use disorder. Pacific Viking helps owners, compliance officers and clinical directors put consent forms, record policies and staff training in writing. This is operational compliance work, not legal advice. Book a free discovery call to review your Part 2 practices.
Pacific Viking works alongside your healthcare counsel, who gives the legal opinion. No consulting engagement guarantees against audits, complaints, breaches or penalties.
Who 42 CFR Part 2 applies to
The rule defines what counts as a program and when a program is federally assisted. The quoted text and its source are further down this page.
What counts as a program
A program includes a person, other than a general medical facility, that holds itself out as providing, and provides, substance use disorder diagnosis, treatment or referral for treatment.
What federally assisted means
A program is federally assisted if, among other things, it is carried out under a license, certification, registration or other authorization from a federal department or agency.
An example from the rule
The rule lists being a participating provider in the Medicare program as one of the ways a program counts as federally assisted.
What changed in the 2024 final rule
Closer alignment with HIPAA
The final rule made changes to increase alignment with the HIPAA Privacy Rule, to improve workability and decrease burden on programs, covered entities and business associates.
Effective April 16, 2024
The 2024 final rule took effect on April 16, 2024, according to the dates section of the Federal Register notice.
Compliance by February 16, 2026
Persons subject to the rule had to comply with its applicable requirements by February 16, 2026. That date has passed.
HIPAA enforcement rules apply
The HIPAA enforcement provisions in 45 CFR part 160, subparts C, D and E, apply to Part 2 noncompliance in the same manner as they apply to covered entities and business associates.
What Part 2 compliance consulting covers
A written consent must include the elements the rule lists, and a Part 2 program must have formal policies and procedures to protect patient identifying information. We help you put both in place.
- Assessment and risk prioritization
- We assess your consent practice, record handling and training against the rule, then rank what to fix by risk.
- Written consent forms
- A written consent may be paper or electronic and must include the elements the rule lists, beginning with the patient's name. We check your forms against that list.
- Record security policies
- A Part 2 program must have formal policies and procedures to reasonably protect against unauthorized uses and disclosures of patient identifying information. We draft or revise them with you.
- Training design and documentation
- We design staff training on consent and disclosure and document who completed it, so the record exists when someone asks.
- Corrective action support
- When an assessment, audit or complaint finds a gap, we help you write and carry out the corrective action plan.
What the rule says, quoted
42 CFR 2.11, definition of “Program”: “A person (other than a general medical facility) that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment.”
Source: ecfr.gov/current/title-42/section-2.11 · Checked Nov 12, 2026
42 CFR 2.12(b)(2): a program is federally assisted if it is “being carried out under a license, certification, registration, or other authorization granted by any department or agency of the United States”, including as a “Participating provider in the Medicare program.”
Source: ecfr.gov/current/title-42/section-2.12 · Checked Nov 12, 2026
42 CFR 2.12(a)(1)(i): the restrictions apply to records that “Would identify a patient as having or having had a substance use disorder either directly, by reference to publicly available information, or through verification of such identification by another person.”
Source: ecfr.gov/current/title-42/section-2.12 · Checked Nov 12, 2026
42 CFR 2.16(a): “The part 2 program or other lawful holder of patient identifying information must have in place formal policies and procedures to reasonably protect against unauthorized uses and disclosures of patient identifying information.”
Source: ecfr.gov/current/title-42/section-2.16 · Checked Nov 12, 2026
42 CFR 2.3(c): “The provisions of 45 CFR part 160, subparts C, D, and E, shall apply to noncompliance with this part in the same manner as they apply to covered entities and business associates for noncompliance with 45 CFR parts 160 and 164.”
Source: ecfr.gov/current/title-42/section-2.3 · Checked Nov 12, 2026
The 2024 final rule (89 FR 12472) “makes certain other modifications to increase alignment with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to improve workability and decrease burden on programs, covered entities, and business associates.”
Source: federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-sud-patient-records · Checked Nov 12, 2026
“Effective date: This final rule is effective on April 16, 2024. Compliance date: Persons subject to this regulation must comply with the applicable requirements of this final rule by February 16, 2026.”
Source: federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-sud-patient-records · Checked Nov 12, 2026
42 CFR 2.31(a): “A written consent to a use or disclosure under the regulations in this part may be paper or electronic”, and it must include the listed elements, beginning with “The name of the patient.”
Source: ecfr.gov/current/title-42/section-2.31 · Checked Nov 12, 2026
How an engagement runs
- 01
Discovery call
A free call of about 30 minutes about your program, the records you keep and how consent is handled today.
- 02
Operational assessment
We assess your consent forms, record policies and staff training against the rule, and we rank the risks by priority.
- 03
Strategic roadmap
You get a prioritized remediation plan with defined milestones for your forms, your policies and your training.
- 04
Implementation and support
We revise policies and forms, design and document training, and support corrective action, working alongside your healthcare counsel.
Frequently asked questions
Who has to follow 42 CFR Part 2?
The rule covers federally assisted programs that hold themselves out as providing substance use disorder diagnosis, treatment or referral for treatment. A program counts as federally assisted if, for example, it participates in Medicare or holds a federal license or registration.
What records does Part 2 protect?
Part 2 restricts the use and disclosure of records that would identify a patient as having or having had a substance use disorder.
When did programs have to comply with the 2024 final rule?
The final rule took effect on April 16, 2024, and the compliance date was February 16, 2026.
Does Part 2 require written policies?
Yes. A Part 2 program must have formal policies and procedures that protect patient identifying information against unauthorized uses and disclosures.
Does Pacific Viking give legal advice on Part 2?
No. Pacific Viking provides operational compliance consulting and works alongside your healthcare counsel, who gives the legal opinion.
Review your Part 2 consent forms and policies
Book a free discovery call of about 30 minutes. Tell us how your program handles consent and records today, and we'll outline what an assessment would cover.