Navigating the New “Part 2” SUD Rules

Mar 6

A Stress-Free Guide for Your Private Practice

A Deep Breath for the Overwhelmed

If you’re a clinician in private practice, the words “new federal compliance rules” probably land somewhere between eye roll and existential dread.

Between sessions, notes, insurance issues, and just being a human with a nervous system, hearing that 42 CFR Part 2 rules are changing might feel like one more administrative brick on the pile.

Take a breath. This is actually one of those rare regulatory updates that is meant to make life easier for clinicians.

I’ve spent the last twenty years mentoring therapists and helping practices navigate the not-so-fun parts of running a practice. One thing I’ve learned is that most compliance issues feel overwhelming because they’re written in legal language instead of therapist language.

So let’s translate.

Quick Refresher: What Is “Part 2”?

42 CFR Part 2 is the federal law that protects the confidentiality of Substance Use Disorder (SUD) treatment records.

It exists for a very good reason:
Fear of stigma, discrimination, or legal consequences can stop people from seeking help for substance use. These rules ensure patients can pursue treatment without fear that their records will be used against them.

Part 2 applies to federally assisted programs that provide services related to substance use disorder, including:

Diagnosis
Treatment
Referral for treatment
Prevention or education programs
Rehabilitation or research

For private practice clinicians, it may also apply to any records documenting SUD treatment, and it extends to outside entities that help run your practice (called Qualified Service Organizations), such as:

Billing companies
IT providers
Legal counsel
Practice management vendors

The Good News: Part 2 Is Finally Aligning With HIPAA

For years, clinicians had to juggle two different privacy systems:

HIPAA for most healthcare information
Part 2 for substance use treatment records

That meant extra forms, separate authorizations, and unnecessary administrative friction.

The 2024 Final Rule, created through the CARES Act, changes this by aligning Part 2 much more closely with HIPAA.

The biggest change: TPO Consent

You can now obtain one written consent that allows SUD information to be shared for:

Treatment
Payment
Healthcare Operations

Once that consent is in place, records can move through healthcare systems much more easily.

That means fewer repeated authorizations, smoother coordination with other providers, and fewer headaches navigating EHR systems and insurance processes.

The Safety Net Still Exists (And It’s Important)

While clinical sharing has become easier, the legal protections around these records remain very strong.

Even with TPO consent, SUD records cannot automatically be used in legal proceedings against a patient.

To disclose records for legal purposes, you must have:

Specific written consent from the patient for that legal purpose, OR
A court order combined with a subpoena or other legal mandate

Therapist Tip

Think of TPO consent as a clinical passport.

It helps records travel within the healthcare system so patients can receive care and insurance claims can be processed.

But it is not a legal key.

If a subpoena arrives or an attorney calls, that original TPO consent is not enough.

The Timeline (So You Can Relax)

Here’s the part most clinicians want to know.

Final Rule Effective: April 16, 2024
Full Compliance Required: February 16, 2026

That means you still have time to update:

Privacy notices
Consent forms
Intake paperwork

And the agency responsible for enforcement — the U.S. Department of Health and Human Services Office for Civil Rights — has stated their focus is on voluntary compliance and education, not surprise punishment.

Translation: you have breathing room.

Your Low-Stress Compliance Checklist

If you want to start preparing now, here are the practical steps:

✔ Update Your Privacy Notice

Your practice should include language explaining:

SUD confidentiality protections
Patient rights related to these records
Redisclosure limitations

If you already have a HIPAA notice, you can combine both policies into one document.

✔ Update Your Consent Forms

Move toward the single TPO consent model for SUD records.

This allows future sharing for treatment, payment, and healthcare operations without repeated paperwork.

✔ Review Vendor Agreements

Make sure your agreements with vendors who may access records (billing, EHR, IT support) reflect updated confidentiality requirements.

✔ Understand Breach Notification Requirements

If a breach involving SUD records occurs, you may need to notify:

The affected individuals
The Secretary of Health and Human Services
In some larger breaches, media outlets

Fortunately, these situations are rare — but it’s good to know the rule exists.

Helpful Source Material

If you want to read the official government explanations (with a cup of coffee and maybe a stress ball), start here:

They also provide model notices and templates clinicians can use as a starting point.

Want to Skip the Compliance Rabbit Hole?

Let’s be honest.

Most clinicians do not want to spend their weekend reading federal regulatory guidance.

If you’d rather not reinvent the wheel, I’m currently putting together an updated “Steal My Privacy Policy” script you can easily adapt for your own practice.

It’s written therapist-to-therapist, not lawyer-to-lawyer.

You’ll be able to grab it on Therapist 2 Therapist, customize it, and move on with your life.

If You Want Ongoing Updates Without the Overwhelm

Regulations change. Ethics requirements shift. Documentation expectations evolve.

Trying to keep up with all of it alone can feel exhausting.

That’s exactly why I created the continuing education cohort through Therapist Institute for Continuing Education

Inside the cohort you get:

Planned CE trainings (no hunting for credits)
Content designed specifically for solo and small practice clinicians
Compliance updates explained in plain English
Community with other therapists navigating the same challenges

Basically: stay current without burning out.

Final Encouragement

These Part 2 updates are actually a step toward making our administrative lives easier, not harder.

By aligning with HIPAA, they support better coordination of care while still protecting the privacy of patients seeking help for substance use.

Take this one step at a time.

Update one form. Adjust one policy. Bookmark the resources.

You don’t have to tackle the entire compliance landscape in one sitting.

And if you want a shortcut, keep an eye out for the “Steal My Privacy Policy” template or join us inside the Therapist Institute cohort so staying up to date doesn’t become another item on your burnout list.

Jennifer Hama