It is 2 a.m., and a patient comes into the emergency department confused, carrying a handful of medications, with a history that includes depression and a substance use disorder they have been in recovery from for two years. The nurse pulls the med list, the allergies, and the last three admissions in a few clicks. The one fact that might change which drug goes into the IV, the substance use history, is the hardest thing in the building to surface. Not because it is missing from the record. Because a rule drafted in the mid-1970s keeps it behind a wall the rest of the chart does not have.
That wall is 42 CFR Part 2, the federal regulation that governs how substance use disorder records move between systems. A 2024 final rule rebuilt large parts of it to sit closer to HIPAA, and the compliance deadline came and went on February 16, 2026. Since that date, the Office for Civil Rights has been taking complaints and has named Part 2 an enforcement priority. So the question in front of most health IT teams has quietly changed. It is no longer whether you are allowed to share this data. It is whether your systems can share it the way the rule permits while still protecting the part it guards.
Why Part 2 Guards SUD Records More Tightly Than HIPAA
Part 2 exists because of stigma, and that origin story still shapes the engineering. Congress understood decades ago that people avoid addiction treatment when they fear the record could later be turned against them, so it wrote a confidentiality standard stronger than the one covering everything else in medicine. HIPAA lets a provider move records for treatment, payment, and operations without stopping to ask. Part 2 generally makes you get the patient’s written consent before substance use records go anywhere.
Two protections survived the 2024 alignment intact, and both matter more to your architecture than to your legal team. Sharing SUD records still turns on patient consent in most situations. And those records still cannot be used against the patient in a civil, criminal, administrative, or legislative proceeding without consent or a court order, a bar the American Psychiatric Association describes as more stringent than anything in HIPAA. Treat this data like ordinary protected health information, and you have broken the law. That single fact is why it cannot ride the same rails as the rest of the chart.
What The 2024 Rule Loosened, And What It Left Untouched
The final rule carries out a provision of the CARES Act, and it pulled Part 2 toward HIPAA in a handful of concrete ways. A patient can now sign one consent that covers future treatment, payment, and operations uses, instead of a fresh signature for every exchange. A HIPAA-covered entity that receives records under that consent can redisclose them under HIPAA rules. The breach notification requirements that apply to HIPAA now apply to Part 2 records. Penalties line up with HIPAA’s civil and criminal structure, and patients picked up rights like an accounting of disclosures.
Here is the part the compliance summaries tend to bury. What the rule kept is what matters to the people who build the pipes. Consent is still the gate for sharing SUD data. The legal-proceeding protection stands. And every disclosure still has to travel with a notice stating that Part 2 forbids unauthorized use or redisclosure. The rule made the paperwork lighter. It did not touch the restriction underneath.
Rule Now Has Teeth
For years, Part 2 ran on good intentions, because there was almost nothing behind it. Enforcement sat with U.S. attorneys, compliance actions were rare, and a lot of teams treated the rule as a formality. That era is over. HHS handed Part 2 enforcement to the Office for Civil Rights, the same office that has run HIPAA enforcement for decades, and OCR stood up a civil enforcement program right before the February 2026 deadline. Anyone can now file a Part 2 complaint, and OCR has said noncompliance is a place it intends to look.
That changes what belongs on your roadmap and when. A behavioral health provider, an EHR vendor, or a health information exchange that moves SUD data now carries real exposure if consent and segmentation are handled by hope rather than by design. The teams that filed the rule as a policy update to read later are the ones improvising now.
Why This Is A Data Problem, Not A Legal One
The uncomfortable truth is that the 2024 rule made Part 2 legally friendlier and, in the same motion, laid bare a harder problem underneath. Most health data systems were built to do one of two things with a record: share it or block it. They have no clean way to hand over the general chart while holding back the substance use portion. That gap between all and nothing is exactly where Part 2 lives.
Three failures show up over and over. Consent does not travel with the record, so the receiving system gets the data with no machine-readable signal about what it is allowed to do with it. Sensitive notes are not tagged, so a system cannot tell a substance use note from a routine progress note when it assembles a response. And redisclosure happens by default, so the instant the data lands somewhere that shares freely, the protection evaporates. None of those are questions for a lawyer. They are questions about how data is labeled, moved, and logged, and they decide whether you can honor Part 2 without refusing to share anything at all.
Fix One: Let Consent Ride With The Record
Start by treating consent as data, not as a document in a drawer. When a patient agrees to share, that decision should attach to the record in a form other systems can read and act on. The FHIR Consent resource was built for exactly this. It records who may see what, for which purpose, and for how long, and it can carry the single treatment-payment-operations consent the 2024 rule now allows. Revocation has to move the same way, so a system that had access yesterday loses it today. A consent that lives only as a signed PDF in one application solves nothing downstream, because the next system in the chain cannot open that file and change its own behavior because of it.
Fix Two: Label Sensitive Notes So Systems Can Withhold Them
The second fix is segmentation, and there is a real standard behind it rather than a bespoke hack. The Data Segmentation for Privacy work that ONC started, and that SAMHSA carried forward through its open-source Consent2Share tool, tags sensitive records with security labels so a system can release the rest of the chart while withholding the protected part. The FHIR security-label approach lets a record announce that its basis for protection is 42 CFR Part 2, which tells the receiving system to switch from default HIPAA handling to Part 2 handling.
The obstacle here is old and specific. Most systems still run an all-or-nothing consent model: share the whole record or share none of it, which is precisely the behavior Part 2 defeats. Segmentation swaps that binary for something finer. This note is Part 2, so hold it back unless consent covers this recipient and this purpose. Getting there means tagging at the point of capture, because a substance use note that was never labeled cannot be filtered later without a human reading every line to find it.
Fix Three: Govern Redisclosure And Keep The Receipts
The third fix covers what happens once data leaves your walls. Every Part 2 disclosure has to carry the notice that the records cannot be used or redisclosed without consent, and your systems should stamp that notice automatically rather than trusting someone to remember it on a busy afternoon. You also need an accounting of disclosures, which the 2024 rule strengthened as a patient right, so you can show who received which record under which consent. When an auditor or a patient asks, the answer has to come out of a log, not out of anyone’s memory.
Three Ways Teams Get Part 2 Wrong
Two of the failure modes sit at opposite ends of the same spectrum. The first is over-blocking. A team gets nervous, walls off all behavioral health data, and clinicians lose the context they need to treat someone safely, which is the exact harm a confidentiality rule was never meant to cause. The second is under-protecting. A team reads the HIPAA alignment as permission to pass SUD records around like any other note, skips the consent and segmentation requirements, and manufactures both the breach and the enforcement case.
The third mistake is quieter and, in my experience, the most common of all. A team files the rule under “legal,” refreshes the notice of privacy practices, runs a staff training, and never touches the systems that actually move the data. On paper, the organization is compliant. In practice, the pipes leak. Part 2 is only handled when the engineering is handled.
A Readiness Check For Your Stack
A short set of questions will tell you where the gap really is:
- Is patient consent captured in a machine-readable form that downstream systems can read and enforce, revocation included?
- Are substance use records tagged at the point of capture so that a system can withhold them without a human reading each note?
- Can your systems share the general chart while holding back the Part 2 portion, instead of sharing everything or nothing?
- Does every disclosure carry the required Part 2 notice automatically?
- Can you produce an accounting of disclosures showing who received what, under which consent?
- Have you tested a revocation end to end, so access actually stops where it should?
A “no” on any one of these is a gap between what your policy claims and what your systems do. After February 2026, that gap is not a documentation problem. It is enforcement exposure.
Real Work Lives In The Data Layer
The 2024 rule handed the industry something genuinely useful. Sharing behavioral health data is legally easier than it has been in fifty years, which means the barrier that remains is technical, not statutory. Whoever solves the data problem gets to deliver whole-person care without breaking a federal confidentiality law. Whoever ignores it inherits the enforcement risk instead.
That work sits squarely in the data layer, which is why moving Part 2 data safely belongs to mature healthcare interoperability solutions rather than to a policy memo. Consent that travels, sensitive data that is tagged, and disclosure that is logged are engineering problems, and they are what separate a system that shares this data safely from one that refuses to share it at all.
Disclaimer: This article is for general informational purposes only and does not constitute legal or compliance advice. Regulations under 42 CFR Part 2 and HIPAA are subject to change and to agency interpretation, and their application depends on your specific circumstances. Consult qualified legal counsel or a compliance professional before making decisions about handling substance use disorder or behavioral health records.