Atlantic Health StrategiesWest Palm Beach, Florida, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for 42 CFR Part 2, HIPAA, CARF, Joint Commission.
- Standards
- Pricing
- Not published
42 CFR Part 2
42 CFR Part 2 is the federal confidentiality rule for substance use disorder treatment records held by federally assisted programs. It is stricter than HIPAA: records identifying a person as a patient in an SUD program cannot be disclosed without written consent except in narrow circumstances, and recipients cannot redisclose them.
A February 2024 final rule, required by the CARES Act, moved Part 2 closer to HIPAA by allowing a single consent for treatment, payment, and health care operations, adding HIPAA-style breach notification and patient notice requirements, and applying HIPAA civil and criminal penalties to violations. The rule took effect April 16, 2024 with a compliance date of February 16, 2026.
In writing, a Part 2 program needs a patient notice (which may be combined with the HIPAA notice of privacy practices), consent forms that carry every element in section 2.31, the redisclosure prohibition notice attached to disclosures, written policies and procedures for security of records and for breach notification, qualified service organization agreements, and staff training records.
Programs must also be ready for the accounting of disclosures obligation when it becomes enforceable.
Share
Ad from the publisher
Policy Acknowledgment Proof
AcknowledgedPart 2 policy v3by name, on record
Consent Documentedwith AllyMatter
Keep It Quiet the Modern WayPart 2 policies, acknowledged by everyone with record access
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every counselor and clerk on record
Who read which version, and when
03
Show SAMHSA the trail
From $29/mo, 20 editors, unlimited staff (published)
Who has to comply
Federally assisted programs that hold themselves out as providing SUD diagnosis, treatment, or referral: specialty treatment providers, opioid treatment programs, and identified SUD units or staff within general medical facilities. Lawful holders who receive Part 2 records with consent, including health plans, are bound by the redisclosure rules.
What you have to write
Documents on this site that 42 CFR Part 2 requires or expects, each with who must have it, the review cycle and the obligations that cite it.
- 42 CFR Part 2 Consent and Redisclosure Policy Healthcare
- Notice of Privacy Practices Healthcare
What the assessor asks to see
An investigator asks for the patient notice and how it is given, the consent form and a sample of executed consents, the redisclosure notice used on disclosures, written security policies for paper and electronic records, breach risk assessments and notifications, QSOAs and business associate agreements, staff training records, disclosure logs, and the program's procedure for responding to subpoenas and court orders.
Where the requirement sits: 42 CFR 2.16 security policies and procedures; 2.22 patient notice; 2.31 consent; 2024 final rule alignment with HIPAA
Key dates
Final rule published February 16, 2024; effective April 16, 2024; compliance required by February 16, 2026. HHS has indicated the accounting of disclosures provision will not be enforced until the related HIPAA standard is finalized.
Every internal policy in one place
AllyMatter is a full system for every internal policy your company keeps, including the ones 42 CFR Part 2 turns on. Build the whole library in one place, across every department, and prove who has read what.
Policies you can run here
How it works
Every document is approved by someone other than its author, versioned, distributed to the people it covers and acknowledged by name. Sign it where a signature is what the standard wants, send a set out together as a package, and export a dated record of who read which version when an assessor asks.
Most of what an assessor reads for this standard is written policy and proof that people acknowledged it. That is the layer AllyMatter owns.
Who helps with 42 CFR Part 2
Health care privacy consultants, behavioral health compliance firms, and law firms that write joint HIPAA and Part 2 policy sets; EHR and HIE vendors help with segmentation. Typical engagement shape is a policy and consent-form rewrite, staff training, and updating QSOAs and business associate agreements before the compliance date.
Firms that name this framework in their own material. A listing is not a recommendation. Each firm can confirm its own.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
Who assesses 42 CFR Part 2
HHS Office for Civil Rights investigates complaints and breaches and can impose civil money penalties; the Department of Justice can bring criminal cases. State licensing surveys and accreditors (CARF, Joint Commission) check Part 2 practices as part of broader surveys. There is no certification.
Assessors
Be the first 42 CFR Part 2 assessor listed here
This page is read by the organizations looking for someone to certify them.
Tools for 42 CFR Part 2
Tools that name this framework in their own material.
Grouped by type. Inside each group the order is random, reshuffled each time the page loads. AllyMatter, the publisher of this site, is always first.
AllyMatterPolicy management tool, the policy and acknowledgment layerPublisher of this siteRelated reading
- Final Rule: 42 CFR Part 2, Confidentiality of Substance Use Disorder Patient RecordsClinician-facing summary of what the 2024 final rule changed, including the single consent for treatment, payment and operations.American Psychiatric Association
- Substance Abuse Disorder Records (42 CFR Part 2) Final Rule Is Here!Health lawyers walk through the new enforcement exposure, breach notification and consent mechanics programs now have to operate.Quarles & Brady
- Understanding and Implementing the Updates to 42 CFR Part 2Implementation guide covering consent forms, patient notice and how Part 2 now sits alongside the HIPAA Privacy Rule.Network for Public Health Law
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for 42 CFR Part 2
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Run the Policy Side of 42 CFR Part 2 in AllyMatter
Approve the policies 42 CFR Part 2 asks for, keep every version, and record a named acknowledgment from each person who has to read them.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff