Does 42 CFR Part 2 apply to general hospital behavioral health departments?

Generally no, unless an identified unit inside the hospital holds itself out as a primary SUD treatment provider. A hospital-wide behavioral health department that treats both mental health and SUD usually falls inside Part 2 for the SUD-related records. The 'held out' test in the regulation is the deciding factor. The practical implication is that hospitals have to map which units, programs, or clinics qualify as Part 2 programs and which do not. SUD records inside Part 2 units are subject to the stricter rule. Records inside general medical departments are governed by HIPAA alone. Hospitals that operate detox units, inpatient rehab floors, or outpatient addiction clinics should assume those units are Part 2 programs and build consent and disclosure workflows around the stricter standard.

Do I need separate consent for 42 CFR Part 2 and HIPAA?

After the 2024 Final Rule, a single patient consent can cover both Part 2 and HIPAA uses for treatment, payment, and healthcare operations. The consent has to meet Part 2's specific content requirements, including naming the recipient, the information disclosed, the purpose, and the right to revoke. For uses outside TPO (marketing, fundraising, research, legal proceedings) Part 2 still requires a separate, specific written authorization. A consent that bundles TPO uses with marketing uses is not Part 2-compliant. The simplest compliant design is one TPO consent at intake plus separate marketing and research authorizations as needed.

What changed in 2024 that affects treatment center marketing?

The 2024 Final Rule did not loosen the marketing standard. Part 2 still prohibits using patient information for marketing or fundraising without specific written authorization, with the same strict consent content requirements as before. The Final Rule's TPO alignment with HIPAA does not extend to marketing uses. What changed is enforcement context. With the Final Rule's HIPAA-style breach notification now in place, a marketing-related disclosure that violates Part 2 also triggers the breach notification clock. That raises the operational stakes for any marketing workflow that touches patient information without a compliant authorization.

Are retargeting pixels a 42 CFR Part 2 violation?

A retargeting pixel that fires on a Part 2 program's intake, scheduling, or confirmation page transmits identifying information about a patient or prospective patient to a third-party ad network. Under Part 2, that transmission is a disclosure of protected information and requires patient consent. Most pixel implementations on treatment center sites do not meet the standard. The fact that the ad network treats the data as anonymized does not change the analysis. Compliant designs include moving pixels off Part 2-sensitive pages, using server-side conversion APIs with hashed identifiers and explicit consent, or obtaining specific Part 2 authorization before pixel firing.

What are the penalties for a 42 CFR Part 2 violation?

The 2024 Final Rule brought Part 2 enforcement under the same civil monetary penalty structure HHS uses for HIPAA. Penalty tiers run from roughly $137 per violation for unknowing violations up to more than $68,000 per violation for willful neglect that is not corrected, with annual caps in the millions for repeated identical conduct. HHS Office for Civil Rights handles enforcement, the same agency that enforces HIPAA. Penalties stack across each affected patient record, so a single workflow defect can produce six- and seven-figure exposure on a moderate patient census.

42 CFR Part 2: Definition + 2024 Final Rule Explained

42 CFR Part 2 is a federal regulation that protects the confidentiality of substance use disorder treatment records held by federally assisted Part 2 programs. The 2024 Final Rule aligned Part 2 more closely with HIPAA on many uses but kept stricter standards on disclosures, redisclosures, and marketing communications.

For treatment center operators, Part 2 sits on top of HIPAA, not next to it. Any program that meets the Part 2 definition has to follow both rule sets, with Part 2 controlling where they conflict.

That layered structure is what trips up marketing, intake, and advertising workflows built around HIPAA alone. SEO programs and ad accounts often need a Part 2 review on top of their HIPAA posture.

Key Takeaways

42 CFR Part 2 is the federal confidentiality rule for substance use disorder treatment records, enforced by SAMHSA and HHS. It applies to federally assisted programs that hold themselves out as providing SUD diagnosis, treatment, or referral.
Part 2 is stricter than HIPAA on consent, redisclosure, and marketing. Records cannot be redisclosed without specific patient consent, and patient information cannot be used in marketing or fundraising without express written authorization.
The 2024 Final Rule aligned Part 2 with HIPAA on treatment, payment, and healthcare operations, allowing a single patient consent to cover those uses. It kept the stricter redisclosure and marketing standards in place.
Not every treatment center is a Part 2 program. A general hospital with a behavioral health unit may fall outside Part 2 unless the unit holds itself out as a primary SUD provider. The “held out” test is the hinge for coverage.
Part 2 has direct implications for treatment center marketing. Testimonials, retargeting pixels, alumni outreach, and intake follow-up workflows all need Part 2-compliant consent flows, not just HIPAA Business Associate Agreements.

What 42 CFR Part 2 Is

42 CFR Part 2 is the section of the Code of Federal Regulations governing the confidentiality of substance use disorder patient records. The full title is “Confidentiality of Substance Use Disorder Patient Records,” and it sits under Title 42 (Public Health).

It applies to records held by federally assisted programs that diagnose, treat, or refer patients for SUD. The rule was first enacted in 1975 to address a specific concern: people would avoid treatment for addiction if they feared their records could be released without consent.

Congress wanted to lower that barrier to care. The regulation has been updated several times since, with the most recent major revision finalized in February 2024.

SAMHSA writes the rule, and HHS enforces it through the Office for Civil Rights. The SAMHSA confidentiality regulations FAQ is the canonical regulator source for plain-language interpretation.

Violations carry civil monetary penalties under the same enforcement structure HHS uses for HIPAA. Tiers range from roughly $137 per violation for unknowing conduct up to more than $68,000 per violation for willful neglect, with annual caps in the millions.

Who 42 CFR Part 2 Covers (Part 2 Programs vs General Healthcare)

Part 2 applies to “Part 2 programs,” a defined term inside the regulation. A program qualifies when it is federally assisted and holds itself out as providing, and provides, SUD diagnosis, treatment, or referral for treatment.

The definition also covers an identified unit within a general medical facility that does the same work. The unit-level test is what brings hospital detox floors and inpatient rehab programs inside the rule.

The “federally assisted” piece is broad. It includes any program that receives federal funding directly or indirectly, has tax-exempt status, is licensed or certified by a federal agency, or is authorized to dispense controlled substances. Most SUD centers meet at least one condition.

The “held out” test is the part most operators miss. A residential addiction treatment facility clearly qualifies. A primary care practice that occasionally screens for substance use generally does not. The dividing line is how the entity publicly presents itself.

General hospitals occupy a middle ground. A hospital itself usually is not a Part 2 program, but an identified SUD unit inside it (a detox unit, an inpatient rehab floor, an outpatient addiction clinic) typically is. Records held by that unit are Part 2 records.

Records held by the hospital’s general medical departments are not, unless they reference the SUD unit’s treatment.

Behavioral health programs that focus on mental health without SUD treatment fall outside Part 2 by definition. Co-occurring disorder programs that treat both fall inside Part 2 for the SUD records and inside HIPAA for the rest.

That dual-coverage reality is why so many YMYL-sensitive workflows in dual-diagnosis settings need to be designed around the stricter standard from the start.

The 2024 Final Rule, What Changed

The most recent major revision to Part 2 was finalized by HHS on February 8, 2024, with a compliance deadline of February 16, 2026. The Final Rule was published in the Federal Register and represented the largest alignment of Part 2 with HIPAA in the regulation’s history.

Single-Consent Model for Treatment, Payment, and Healthcare Operations

Before the 2024 rule, patients had to sign a new Part 2 consent every time a covered record was shared, even between providers in the same care continuum.

The Final Rule allows a single patient consent to cover all future uses for treatment, payment, and healthcare operations (TPO), matching the HIPAA framework. The consent is revocable and must still meet Part 2’s specific content requirements.

Breach Notification Now Mirrors HIPAA

The Final Rule applied HIPAA’s breach notification rule to Part 2 records. Programs that experience a breach of unsecured Part 2 records now have to notify affected patients, HHS, and (for large breaches) the media on the same timelines.

Before the change, Part 2 breach response was governed by a separate, looser framework.

Stricter Standards That Survived

Several Part 2 protections did not move toward HIPAA. Redisclosure of Part 2 records by recipients is still prohibited without separate patient consent. Use of Part 2 records in legal proceedings still requires a court order.

The prohibition on using patient information for marketing or fundraising without specific written authorization is also still in place.

New Patient Rights

Patients gained the right to request an accounting of disclosures and the right to restrict disclosures to health plans for services paid out of pocket in full. Both rights match parallel HIPAA provisions added to bring Part 2 closer to the rest of the federal health privacy framework.

42 CFR Part 2 vs HIPAA

HIPAA and Part 2 cover overlapping territory but with different standards. Both apply to SUD treatment programs that are also HIPAA-covered entities, which is the typical case.

The 2024 Final Rule narrowed the gap between the two, but Part 2 is still the more restrictive rule in five specific areas:

Redisclosure: HIPAA permits downstream sharing within the TPO framework. Part 2 prohibits any redisclosure of covered records without a new patient consent that meets Part 2 standards.
Marketing and fundraising: HIPAA allows several marketing communications without authorization. Part 2 prohibits using any patient information for marketing or fundraising without specific written authorization.
Legal proceedings: HIPAA allows disclosure in response to a subpoena with satisfactory assurances. Part 2 requires a court order that meets specific findings before records can be released.
Consent content: A Part 2 consent must name the specific recipient, the specific information to be disclosed, the purpose, and the patient’s right to revoke. HIPAA authorizations are broader and easier to draft.
Acknowledgment of receipt: Recipients of Part 2 records must be notified in writing that the records are protected by Part 2 and cannot be redisclosed without consent. HIPAA has no parallel notice requirement.

Where Part 2 and HIPAA cover the same conduct, Part 2 controls. A program built around HIPAA alone will violate Part 2 in every situation where the stricter rule applies.

Why It Matters for Treatment Centers

For treatment center marketing, Part 2 changes how testimonials, retargeting, alumni outreach, and intake follow-up can be designed. A retargeting pixel that fires on a confirmation page after an intake call is a Part 2 disclosure to the ad network.

An alumni email that references a former patient’s treatment is a Part 2 use of patient information. Neither is HIPAA-compliant either, but Part 2 raises the consent bar above what most current workflows meet.

The practical implication is that admissions and billing operations need Part 2-aware consent flows from the first touchpoint, and the marketing stack needs to be audited against Part 2 specifically, not just HIPAA.

A LegitScript-certified facility (see LegitScript) has typically done some of this work, but Part 2 compliance is broader than LegitScript’s ad-platform requirements. E-E-A-T signals like author credentials and clinical review intersect Part 2 when patient stories are involved.

For the operational layer, see the companion guide on 42 CFR Part 2 treatment center marketing compliance, which covers the 30-day compliance audit and the marketing stack changes most facilities need to make ahead of the February 2026 deadline.

Programs producing clinical content for organic search should also review how to build clinical content Google trusts, since author attribution and clinical review intersect Part 2 when SUD treatment details are involved.

Common 42 CFR Part 2 Misconceptions

Four mistakes show up repeatedly in treatment center compliance reviews:

“HIPAA covers us, so we’re fine.” HIPAA is the floor, not the ceiling. A Part 2 program has to meet HIPAA and Part 2. A HIPAA-only workflow will violate Part 2 every time the stricter rule applies.
“The 2024 Final Rule made Part 2 the same as HIPAA.” The Final Rule aligned the two on TPO uses and breach notification. Redisclosure, marketing, and legal-process standards are still stricter under Part 2.
“We can use patient testimonials with a basic consent form.” Part 2 marketing use requires specific written authorization that meets the regulation’s content standards. A generic photo or video release does not satisfy Part 2.
“Retargeting pixels are a marketing tool, not a record disclosure.” A pixel that fires on a Part 2 program’s intake confirmation page transmits identifying information about a patient relationship to a third party, which is a Part 2 disclosure. Anonymization to the ad network does not change the analysis.

42 CFR Part 2