Part 2 training is circulating across behavioral health organizations right now. Some of it is genuinely useful. And some of it describes the regulation without telling you what to do when a provider is on hold asking for records, a family member is at the front desk, or a legal request lands in your inbox mid-shift.
The updated 42 CFR Part 2 rule has been in full effect since February 16, 2026, and OCR is now actively accepting complaints and investigating violations (HHS Office for Civil Rights, February 2026). Part 2 compliance happens in the moments you make disclosure decisions. Here is what good training should have left you able to do, and a clear process for the situations you will actually face.
What the Rule Change Means at Your Level
Part 2 protects substance use disorder treatment records with stricter requirements than standard HIPAA. Under HIPAA, providers can generally share records for treatment, payment, and healthcare operations without patient authorization. Part 2 requires the patient’s written consent before those same disclosures can happen, with limited exceptions.
The 2024 revisions did expand some flexibility. Patients can now sign a single consent covering future uses and disclosures for treatment, payment, and healthcare operations, which simplifies care coordination (HHS Fact Sheet, 42 CFR Part 2 Final Rule, 2024). That broader consent is useful. It only works when it was captured correctly at intake and documented in your EHR. If it was not, the stricter rules apply.
The practical risk in daily work is the casual workaround. A verbal confirmation to a family member. A fax sent before checking consent status. A record shared through personal email because the EHR pathway felt slow. Most Part 2 violations don’t come from bad intentions. They come from busy people taking shortcuts that feel harmless in the moment.
The One-Minute Three-Step Share Check
Good Part 2 training ends not with a policy summary but with newly-formed habits. Before releasing any information connected to a patient’s SUD treatment, run this check. It takes less than a minute.
Step one: Is the right consent captured in the EHR for this specific purpose? A consent for treatment coordination does not automatically cover a legal proceeding. A consent signed at intake may not cover a disclosure to a provider added to the care team afterward. Check the actual record.
Step two: Am I sharing only the minimum information needed? Part 2 requires that each disclosure be limited to what is necessary for the specific reason for sharing (HHS, HIPAA and Part 2, 2024). Sending a full treatment record when a referral summary was requested is not a safe workaround. It is a compliance exposure.
Step three: Am I using the approved EHR pathway? Phone calls, personal email, and text messages are not approved release channels. Your organization has a designated workflow for disclosures. Use it every time.
When you’re uncertain about any of these steps, that uncertainty is the system working. Pause, check, and escalate before sharing. Escalating is not a failure. It is the correct response.
Four Scenarios Worth Practicing Before They Happen
Warm handoff to an outside provider: This is where shortcuts appear most often. Even with a broad TPO consent in place, each disclosure must be accompanied by a copy of the consent or a clear explanation of its scope (HHS Fact Sheet, 42 CFR Part 2 Final Rule, 2024). Know where that documentation lives in your EHR and include it with every transfer.
Family member requesting information: Part 2 does not follow family assumption. A spouse, parent, or adult child does not have access to a patient’s SUD records by virtue of their relationship. Explicit written consent from the patient is required, and that consent must specifically name or designate the family member as an authorized recipient. When a family member asks, your answer is not a judgment about them. It is a requirement of federal law.
Court or legal request: A subpoena does not automatically override Part 2 protections. Records and testimony related to SUD treatment cannot be used in civil, criminal, administrative, or legislative proceedings against a patient without written consent or a court order meeting specific Part 2 requirements (HHS Fact Sheet, 42 CFR Part 2 Final Rule, 2024). When legal pressure arrives, slow down. Do not respond. Escalate to your supervisor or compliance officer before taking any action.
Care coordination in an integrated setting: A broader TPO consent may allow sharing with other care team members, but only if that consent was properly captured and remains active. Check the EHR before assuming it covers a new coordination request. Step one of the share check will tell you where you stand.
Practicing these scenarios in training means you’ve already made each decision once. When the real situation arrives, the right response feels like a workflow.
Xpio Health helps behavioral health organizations translate Part 2 requirements into practical EHR workflows so your staff can make the right call without interpreting policy mid-shift. If your training didn’t land there, contact Xpio Health to close the gap.
#BehavioralHealth #PeopleFirst #XpioHealth #42CFRPart2 #ClinicalWorkflow #BehavioralHealthCompliance
References:
- HHS Office for Civil Rights. Office for Civil Rights Announces Civil Enforcement Program for Confidentiality of Substance Use Disorder Patient Records. HHS.gov. February 13, 2026. https://www.hhs.gov/press-room/hhs-announce-civil-enforcement-program-sud-patient-records.html
- HHS Office for Civil Rights and SAMHSA. Fact Sheet: 42 CFR Part 2 Final Rule. HHS.gov. 2024. https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html
- HHS Office for Civil Rights. HIPAA and Part 2. HHS.gov. 2024. https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/hipaa-part-2/index.html