42 CFR Part 2 Just Changed. Here’s What SUD Programs Need to Know.

On February 16, 2026, the most significant change to substance use disorder privacy law in decades went into effect. The updated 42 CFR Part 2 rule, driven by Section 3221 of the CARES Act, aligns SUD patient record protections with HIPAA and introduces a Single Consent model that fundamentally changes how substance use treatment data moves through the healthcare system.

For behavioral health organizations running SUD programs, this is not a minor policy update. It is a structural shift in how patient information is shared, who can access it, and what organizations must do to stay compliant.

Here is what leadership teams need to understand right now.

What Actually Changed

For decades, 42 CFR Part 2 maintained a separate, more restrictive consent framework for substance use disorder treatment records. The original intent was to protect patients from stigma, discrimination, and legal exposure. But that same protection created dangerous blind spots. Emergency clinicians treating overdose patients had no access to their SUD treatment history. Care coordinators could not see medication lists across programs. Prescribers made decisions without a complete clinical picture.

The CARES Act alignment changes that. The biggest shift is the introduction of a Single Consent model. One patient signature now authorizes the sharing of SUD treatment records for treatment, payment, and healthcare operations. One consent. Valid until revoked in writing.

This means SUD treatment data, including medications, diagnoses, and lab results, can now flow through Health Information Exchanges when queried by an authorized treating provider. For the first time, an ER clinician treating a patient in crisis can see that the patient is on buprenorphine, see the dosage, see the most recent drug screen results, and make informed treatment decisions instead of guessing.

The HHS Final Rule, issued in February 2024, gave the industry exactly two years to prepare. The economic analysis estimated approximately $12.7 million in first-year implementation costs industry-wide, with annualized net savings of approximately $4.9 million through administrative simplification once operational.

What the Single Consent Does and Does Not Cover

This distinction matters enormously, and it is where many organizations will get tripped up.

The Single Consent covers SUD treatment data: medications, diagnoses, lab results, provider contacts, and other clinical information generated through SUD treatment. This is the data that can now flow to authorized treating providers, health plans, and entities involved in healthcare operations.

The Single Consent does not cover SUD counseling notes. Therapy session content, clinical impressions from individual sessions, and detailed psychotherapy documentation remain a legally distinct and separately protected category. These require their own written authorization and are not released under the Single Consent.

The Single Consent does not authorize disclosure for legal proceedings. This is a critical point for patients and for staff explaining the consent. Signing the Single Consent does not open SUD records to courts, attorneys, or law enforcement.

Organizations that cannot distinguish between disclosable treatment data and protected counseling notes in their systems face a binary choice that compliance experts have flagged as the highest-risk failure point: share everything and risk violating counseling note protections, or share nothing and defeat the purpose of the Single Consent.

Revocation: The Part Nobody Is Talking About

Patients can revoke the Single Consent at any time, in writing. When they do, future disclosures of Part 2-protected SUD treatment data must stop immediately.

But revocation does not retroactively "un-share" data that was already disclosed while the consent was active. Information lawfully shared during the consent period, such as medications and diagnoses sent to an ER during a crisis visit, now exists in the receiving provider's record. Revocation does not require those providers to delete previously received information.

This is the hardest conversation to have with patients. And it is the area where EHR systems and consent workflows will be most tested. Organizations need the ability to generate a clear summary of all prior disclosures made under a now-revoked consent: dates, recipients, and data categories shared. That transparency is not just good practice. It is what preserves trust with a population that has every reason to be cautious about how their information is used.

Where Organizations Will Get Caught

Consent workflows that are partially manual. If staff are scanning consent forms but not updating a system flag that controls data flow, the consent exists on paper but not in practice. Data either flows when it should not, or does not flow when it should.

No segmentation between treatment data and counseling notes. If the EHR cannot distinguish between a medication list and a therapy session note, the organization is exposed. This is the single highest-risk technical failure point of the new rule.

Revocation that does not suppress in real time. If revoking consent requires a manual IT ticket or a 48-hour processing window, disclosures made during that gap are potentially non-compliant.

No disclosure audit trail. Without detailed logging of every disclosure (timestamps, recipients, data categories, legal basis), organizations cannot demonstrate compliance, respond to patient inquiries, or defend against complaints. The regulation requires it.

Staff who cannot explain the consent in plain language. Technology is only as effective as the people operating it. If care coordinators and front-desk staff cannot clearly explain what the patient is signing, what it means, and what happens if they change their mind, the consent process is compromised from the start.

Broader Data Flow Means Broader Risk

The updated rule opens data flows that were previously closed. That is its purpose and its promise. But broader data movement also means a broader attack surface.

The February 2024 cyberattack on Change Healthcare demonstrated what happens when interconnected healthcare systems are compromised. The attack disrupted 15 billion annual transactions. According to an AHA survey, 94% of hospitals reported financial impact, and 60% required between two weeks and three months to resume normal operations. Behavioral health providers operating on thin margins faced immediate cash flow crises when claims processing halted.

For SUD programs, a breach involving Part 2-protected data carries consequences beyond the financial. These are records that exist under heightened protection specifically because of the stigma and discrimination patients face. Organizations that are now sharing more data through HIEs and across provider networks need to ensure their cybersecurity posture, vendor agreements, and incident response plans account for Part 2-protected information specifically, not just HIPAA-covered data generally.

What Leadership Teams Should Be Doing Now

Test your consent workflows end to end. Sign a test consent. Trigger a simulated HIE query. Confirm that the right data flows and the right data does not. Then revoke the consent and test again. If you have not done this yet, do it this month.

Validate data segmentation with your EHR vendor. Request written confirmation that your system segments SUD counseling notes from SUD treatment data. If it does not, escalate immediately.

Train every role that touches the consent process. Front-desk staff, care coordinators, clinicians, billing teams, compliance officers. Everyone needs to understand what the Single Consent authorizes, what it excludes, and how revocation works.

Build disclosure log reviews into your compliance calendar. Audit a sample of disclosures monthly to ensure the prohibition-on-redisclosure notice was attached, consent was active at the time of disclosure, and counseling notes were excluded.

Prepare your clinical teams for the human conversation. The hardest part of revocation is not the technology. It is the moment when a patient asks, "Can you take it back?" Equip your staff with honest, empathetic language and a clear summary of what was previously shared.

The Bottom Line

The Single Consent model under the updated 42 CFR Part 2 is not just a regulatory change. It is a fundamental shift in how substance use disorder information moves through the healthcare system. It closes gaps that have endangered patients for decades. And it demands a level of precision from EHR systems, consent workflows, and workforce training that many organizations have not yet achieved.

The organizations that get this right will not just survive the transition. They will strengthen care coordination, reduce preventable gaps in treatment, and build trust with a population that has been underserved by fragmented systems for far too long.

The organizations that treat this as a compliance checkbox will learn the difference the hard way.

That's the tea.

Stay informed. Stay ahead. Stay compliant.

SOURCES AND FURTHER READING

1. Department of Health and Human Services. Confidentiality of Substance Use Disorder Patient Records: Final Rule. Federal Register. February 2024. https://www.federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-sud-patient-records

2. CARES Act, Section 3221. Alignment of 42 CFR Part 2 with HIPAA Privacy, Breach Notification, and Enforcement Rules. Public Law 116-136. https://www.congress.gov/bill/116th-congress/house-bill/748

3. HHS Regulatory Impact Analysis. Estimated first-year implementation costs of approximately $12.7 million industry-wide, with annualized net savings of approximately $4.9 million through administrative simplification. https://www.federalregister.gov/public-inspection/2024-02544/confidentiality-of-substance-use-disorder-patient-records

4. American Hospital Association. AHA Survey: Change Healthcare Cyberattack Significantly Disrupts Patient Care, Hospital Finances. March 2024. https://www.aha.org/2024-03-15-aha-survey-change-healthcare-cyberattack-significantly-disrupts-patient-care-hospitals-finances

5. SAMHSA. 42 CFR Part 2 Revised Rule: Frequently Asked Questions and Implementation Guidance for Substance Use Disorder Treatment Providers. https://www.samhsa.gov/about-us/who-we-are/laws-regulations/confidentiality-regulations-faqs

6. 42 CFR Part 2, Section 2.32. Prohibition on Re-disclosure. Requires that all disclosures of Part 2-protected records include a written notice that the information is protected by federal law and cannot be further disclosed without patient consent or as otherwise permitted. https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2

7. National Council for Mental Wellbeing. 42 CFR Part 2 Final Rule Implementation Resources and Compliance Toolkit for Behavioral Health Providers. https://www.thenationalcouncil.org

The Tea in Behavioral Health is a publication by Clinically AI covering the people, policy, technology, and compliance shaping the future of behavioral healthcare.