42 CFR Part 2: Confidentiality of Substance Use Disorder Patient Records 2 CE

2026 Compliance Update

This course has been revised to reflect the 2024 Final Rule governing 42 CFR Part 2, the February 16, 2026 compliance date, and the current HHS Office for Civil Rights enforcement framework.  

42 CFR Part 2 is the federal confidentiality framework protecting records that identify a patient as having or having had a substance use disorder when those records are created or maintained by a federally assisted Part 2 program. The rule is designed to protect patient privacy and reduce barriers to seeking substance use disorder treatment while permitting appropriate information sharing for care and health care operations. 

This course reviews the history and scope of Part 2, current definitions and applicability, patient notice and security requirements, consent and redisclosure rules, disclosures permitted without consent, protections for SUD counseling notes and legal proceedings, breach notification and enforcement, and practical compliance issues. Particular attention is given to the 2024 Final Rule and the requirements that became mandatory on February 16, 2026. The course also includes a clinician disclosure-decision framework, applied clinical and administrative examples, practical appendices, and findings from recent peer-reviewed research on privacy, care coordination, and patient trust.

• Describe the purpose, statutory history, and current scope of 42 CFR Part 2.

• Identify when a program, record, patient, or recipient is subject to Part 2.

• Distinguish Part 2 from HIPAA while recognizing the areas in which the 2024 Final Rule aligned the two frameworks.

• Identify the required elements of a valid Part 2 consent and explain the single-consent option for treatment, payment, and health care operations (TPO).

• Explain current rules governing redisclosure, SUD counseling notes, medical emergencies, research, audits/evaluations, and disclosures required or permitted without patient consent.

• Describe patient notice, security, breach-notification, complaint, and enforcement requirements applicable in 2026.

Course number: #: 20-1410270