42 CFR Part 2 records, and where substance use details leak in medical files

42 CFR Part 2 protects records of substance use disorder (SUD) diagnosis, treatment and referral kept by federally assisted treatment programs. Disclosure generally needs the patient's written consent and a notice against redisclosure. The records also can't be used against the patient in civil, criminal, administrative or legislative proceedings without consent or a court order. Since February 16, 2026, everyone the rule covers has had to follow its 2024 revision, which brings parts of it in line with HIPAA and keeps those limits.

The rule protects any record that would identify someone as an SUD patient, not only the ones that state a diagnosis. That is why Part 2 information is hard to find in a general medical file: the page that gives a patient away often never mentions a disorder.

What Part 2 covers

The rule is 42 CFR Part 2, as revised by the 2024 final rule.

Who Part 2 binds, and where it follows the record

Federal assistance is defined broadly. A program counts if it takes part in Medicare, holds a DEA registration to dispense a controlled substance used in SUD treatment, receives federal funds in any form or has tax-exempt status (§ 2.12(b)). In a general hospital, only an identified unit, or staff whose primary job is SUD care, is a Part 2 program.

The protection travels with the record. Records a program sends to a provider outside Part 2 keep their status there. Since the 2024 revision, a provider, health plan or business associate that receives them under a single consent for treatment, payment and health care operations doesn't have to segregate them, but HHS says the information "is still considered a part 2 record" for the bar on use in proceedings against the patient (89 FR 12500).

Subpoenas, court orders and John Doe

A subpoena alone doesn't permit disclosing Part 2 records. A court has to enter an authorizing order under subpart E, and a subpoena is still needed to compel production (§ 2.61). For civil, administrative and legislative proceedings, § 2.64 sets the terms:

• The application uses a fictitious name, such as John Doe, unless the patient is the applicant, has consented or the court has sealed the record.
• The order limits disclosure to the parts of the record essential to its purpose, and to the people who need them.

For a records custodian, an order is a redaction job: produce the parts it names, and nothing else.

Where SUD details leak in medical files

HHS's estimate for the 2024 rule was 16,066 Part 2 programs handling 1,864,367 patient admissions a year (89 FR 12608). Now that most recipients needn't segregate Part 2 records, they can sit anywhere in a general chart or claims file. When a subpoena or records request arrives, check these places.

Letterheads, fax headers and cover sheets

A Part 2 program by definition holds itself out as providing SUD care, so its name is usually public; SAMHSA's FindTreatment.gov locator lists treatment facilities by name. Because Part 2 protects a record that identifies a patient "by reference to publicly available information", a fax header reading "FROM: FERNMOOR RECOVERY PROGRAM" beside a patient's name says as much as a diagnosis would.

Medication and dosing records

"Methadone 85 mg, dispensed daily at clinic" on a medication list tells a reader what is being treated, and so does a buprenorphine-naloxone film. Dosing records from a program look like any other medication list, so they are easy to pass over.

Lab results

A urine drug screen ordered by the program names it as the ordering location, and its comments may give the purpose: "monitoring for treatment adherence". When the report arrives as a fax or a scanned printout, those details sit in an image a text search never reads.

Claims and billing codes

Part 2's definition of records names billing information. A claim line with HCPCS code H0020, methadone administration by a licensed program, or diagnosis code F11.20, opioid dependence, says as much as a page of notes, in a column a reviewer may skim.

Intake notes and messages

Coverage includes referral and intake, and the definition of records names emails, voicemails and texts. An intake line ("self-referred after a DUI arrest; reports daily drinking since 2019") or a printed text ("Fernmoor Recovery: group tonight at 6 pm, Room 4") is a Part 2 record when it comes from the program.

Refusal letters and the notice itself

A reply to a request the rule doesn't permit must not reveal that the person is or was a patient (§ 2.13(c)). "We cannot release Mr. Brandt's treatment records under 42 CFR Part 2" does exactly that. The § 2.32 notice works the same way: it names Part 2, so a copy left in a file released for another purpose tells the reader what kind of record follows.

A checklist before a Part 2 record leaves

• Every page has been read, including scans, faxes and lab printouts, and the pages that came from a Part 2 program are identified wherever they sit in the chart.
• The release rests on a § 2.31 consent, a subpart E court order or another exception in the rule, not on a subpoena alone.
• A release made with consent carries a § 2.32 statement and the consent or a clear explanation of it; under a court order, only the parts the order calls essential go out.
• Where Part 2 information has to come out, so do the program's name in letterheads and fax headers, its billing codes, its messages and its dosing and lab entries.
• Any refusal is worded so it doesn't confirm that the person is or was a patient.
• Data for a public health authority or a research report meets 45 CFR 164.514(b), with no reasonable basis to believe a patient could be identified.
• Redacted text is removed, not covered, and document properties, comments and attachments are clean.

Where DocArmor fits

DocArmor's HIPAA Safe Harbor template is mapped to the 18 identifiers in 45 CFR 164.514(b)(2), the standard Part 2 now uses for de-identification, and you can adjust it to your own policies before a job runs. Context-aware AI reads narrative text, not just patterns, and OCR reads scanned and faxed pages. Redacted content is removed and checked on every page, and metadata, attachments and form values are stripped. Every finding goes to a reviewer before export, because whether a line marks someone as a Part 2 patient often depends on context a person has to judge.

This post is general information about 42 CFR Part 2, not legal advice. State law can be stricter, so check it and your program's policies with your privacy officer or counsel.