Atlantic Health StrategiesWest Palm Beach, Florida, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for 42 CFR Part 2, CARF, HIPAA, Joint Commission.
- Standards
- Pricing
- Not published
42 CFR Part 2 Consent and Redisclosure Policy
42 CFR Part 2 protects records that identify a person as having or having had a substance use disorder when the record comes from a federally assisted program.
The regulation is written around three documents: a written consent form with fixed content (2.31), a notice that travels with every disclosure made under consent (2.32), and formal written security policies and procedures for the records themselves (2.16).
Programs fold these into one policy that also covers the 2.22 patient notice, the exceptions that allow disclosure without consent, and breach notification.
The 2024 final rule moved Part 2 closer to HIPAA: one consent can now cover all future treatment, payment and operations uses, breach notification follows the HIPAA Breach Notification Rule, HIPAA-style penalties apply, and the Office for Civil Rights enforces. The compliance date was February 16, 2026. Programs that wrote their policy before 2024 need a rewrite, not an edit.
Also called: Part 2 confidentiality policy, SUD records policy, Part 2 consent form and procedures
Share
Ad from the publisher
Policy Acknowledgment Proof
AcknowledgedPart 2 policy v3by name, on record
Consent Documentedwith AllyMatter
Redisclose Nothing the Modern WayYour Part 2 policy, acknowledged by everyone with record access
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every counselor and clerk on record
Who read which version, and when
03
Show SAMHSA the trail
From $29/mo, 20 editors, unlimited staff (published)
Who requires it, and what each one says.
| Source | Applies when | What it requires | Status |
|---|---|---|---|
| 42 CFR Part 2, consent requirements 42 CFR 2.31 | You disclose Part 2 records with patient consent | Written consent naming the patient, the discloser, the recipient, the purpose, how much and what kind of information, a revocation statement, an expiration event or date, a redisclosure statement, and the patient signature and date. A single consent for all future TPO uses is permitted. Legally required. | Mandatory |
| 42 CFR Part 2, notice to accompany disclosure 42 CFR 2.32 | Every disclosure made with written consent | Accompany the disclosure with a copy of the consent or a clear explanation of its scope, plus a statement that the record is protected by federal law and may not be redisclosed except as permitted. Legally required. | Mandatory |
| 42 CFR Part 2, security for records 42 CFR 2.16 | You are a Part 2 program or lawful holder | Formal policies and procedures to protect against unauthorized use and disclosure and reasonably anticipated threats, covering paper records (transfer, removal, destruction, secure storage) and electronic records (access, transmission, storage, sanitizing media). Legally required. | Mandatory |
| 42 CFR Part 2, patient notice 42 CFR 2.22 | You are a Part 2 program | Plain-language notice at admission of the program's legal duties and privacy practices. Legally required. | Mandatory |
| Part 2 final rule, breach notification 42 CFR 2.16(b), 89 FR 12472 | Breach of unsecured Part 2 records | Notify under the HIPAA Breach Notification Rule (45 CFR Part 164 Subpart D). Legally required from Feb 16, 2026. | Mandatory |
| CARF accreditation standards (ASPIRE to Excellence, all programs) CARF Standards 1.E.3.(b), (d), (e) and 1.J.1.e.(2) | You seek or hold CARF accreditation and are a Part 2 program or lawful holder | Written policies and procedures on the records of persons served, confidentiality of records and compliance with applicable laws concerning records, plus policies on informed consent, refusal and withdrawal of consent for release of information. CARF does not name 42 CFR Part 2; for a Part 2 program, Part 2 is the applicable records law. Accreditation requirement. | Mandatory |
Required sections
- Scope: which records and which staff are covered; definition of federally assisted program
- Patient notice procedure at admission (2.22) and how capacity is handled
- Consent form content and the nine elements of 2.31, including the TPO single-consent option and the SUD counseling notes exception
- Revocation handling and expiration events
- Redisclosure notice that accompanies every consented disclosure (2.32)
- Disclosures permitted without consent: medical emergency, research, audit and evaluation, court order under Subpart E, crimes on premises, child abuse reporting
- Prohibition on use in civil, criminal, administrative or legislative proceedings without consent or court order (2.12(d), 2.64, 2.65)
- Security policies and procedures for paper and electronic records, including destruction and media sanitization (2.16(a))
- Breach notification aligned to 45 CFR 164.400 to 164.414 (2.16(b))
- Qualified service organization agreements and business associate agreements
- Patient right to an accounting of disclosures made with TPO consent (from Feb 2026; single source: 2024 final rule)
- Complaint process and no-retaliation statement (2.4)
- Staff training and sanctions cross-reference
What the examiner asks for
Written planThe Part 2 policy with effective date, the current consent form, the redisclosure notice text, and the patient notice. Behavioral health compliance consultants and health law firms write; policy tools hold versions
AttestationSigned patient consents on file with expiration tracking; staff training completions on the Part 2 policy version in force. EHR consent modules; policy tools and LMS for staff
Operational recordsDisclosure log, revocation log, QSO and BA agreements, breach risk assessments, destruction certificates. The program; privacy officer; outsourced compliance services
Technical controlsSegmentation or flagging of Part 2 records in the EHR, access logs, encrypted transmission. EHR vendors, MSPs
Change log.
2026-02-16Compliance date for the 2024 final rule: single TPO consent, HIPAA-aligned breach notification and penalties, accounting of disclosures, updated patient notice, OCR enforcement.
2024-04-16Final rule effective date (published Feb 16, 2024 at 89 FR 12472).
2020-07-15SAMHSA final rule loosened consent rules for care coordination and clarified non-Part 2 provider records.
2017-01-18First major Part 2 update since 1987; allowed general designation of recipients in consent.
Where this document is required.
Where this document gets checked.
No one certifies a document like this on its own. It is read during the audits and inspections below, and by the agency behind each rule.
| Where it is looked at | Who looks at it |
|---|---|
| 42 CFR Part 2 | HHS Office for Civil Rights investigates complaints and breaches and can impose civil money penalties; the Department of Justice can bring criminal cases. State licensing surveys and accreditors (CARF, Joint Commission) check Part 2 practices as part of broader surveys. There is no certification |
| CARF | CARF surveyors, who are peer professionals employed in accredited or comparable organizations, trained and assigned by CARF. Surveys are scheduled and on site for two to three days |
Consultants.
Firms that name these standards in their own material.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
Circa Behavioral Healthcare SolutionsMission Viejo, California, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CARF, HIPAA, Joint Commission.
- Standards
- Pricing
- Not published
MVP Consulting GroupLong Beach, California, USA
- What they do
- Compliance consulting
- Who they help
- Its website offers consulting for CARF, HIPAA, AAAASF, AAAHC, CMS and more.
- Standards
- Pricing
- Not published
Software.
Tools that hold documents like this one and record who has read them.
Need a hand implementing it?
Find a Consultant for 42 CFR Part 2 Consent and Redisclosure Policy
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Manage This Document in AllyMatter
Route it for approval, keep every version, and record a named acknowledgment from everyone who has to read it.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
What people ask.
We are HIPAA compliant. Are we covered?
No. Part 2 has stricter consent rules, a redisclosure notice HIPAA does not have, and a prohibition on use in proceedings. HIPAA compliance is the floor; the Part 2 policy sits on top.
What changed in the consent form?
One consent can now cover all future treatment, payment and operations uses by any HIPAA covered entity or business associate. The form still needs every 2.31 element, including a revocation statement, an expiration event, and the redisclosure statement.
Does the old 'prohibition on redisclosure' notice still work?
The 2.32 notice text changed with the 2024 rule. Forms and EHR templates written to the 2017 language need updating.
Who enforces Part 2 now?
HHS Office for Civil Rights, with HIPAA-style civil and criminal penalties, from the February 2026 compliance date.