The Department of Health and Human Services released a final rule updating the regulations around the use and disclosure of substance use disorder treatment records. Commonly known as "Part 2" records (as the regulations are found at 42 CFR Part 2), these records are subjec to different standards than other mental health treatment records. The goal of this final rule was to bring these standards closer to alignment with existing HIPAA regulations, allowing for a reduction in administrative burden and more focus on quality care.
Here are a the required updates that need to be done for HIPAA covered providers. The first one is required no later than February 16, 2026.
Please Note: If you subscribed to TherapyMate after March 9, 2026. these updates are already available to you.
- Add the following paragraphs to the client portal document called HIPAA Notice of Privacy Practices.
Substance Use Disorder Records. If applicable, your substance use disorder (“SUD”) records are protected by federal law under 42 C.F.R. Part 2 (“Part 2”). This law provides extra confidentiality protections and requires a separate patient consent for the use and disclosure of SUD counseling notes. Each disclosure made with patient consent must include a copy of the consent or a clear explanation of the scope of the consent. It must also be accompanied by a written notice containing the language in 42 CFR Part 2.32(a). Disclosure of these records requires your explicit written consent, except in limited circumstances such as: (a) Medical Emergencies: to the extent necessary to treat you, (b) Reporting Crimes on Program Premises, (c) Child Abuse Reporting: In connection with incidents of suspected child abuse or neglect to appropriate state or local authorities, and (d) Fundraising: We will provide you with an opportunity to decline to receive any fundraising communications prior to making such communications. You may revoke this consent at any time.
Prohibitions on Use and Disclosure of Part 2 Records. If applicable, SUD records received from programs subject to Part 2, or testimony relaying the content of such records, shall not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless based on your written consent, or a court order after notice and an opportunity to be heard is provided to you or the holder of the record, as provided in Part 2. A court order authorizing use or disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure before the requested SUD record is used or disclosed. If SUD records are disclosed to us or our business associates pursuant to your written consent for treatment, payment, and healthcare operations, we or our business associates may further use and disclose such health information without your written consent to the extent that the HIPAA regulations permit such uses and disclosures, consistent with the other provisions in this Notice regarding PHI.
(Cut and paste the two paragraphs above under the paragraph called "With Authorization")
2. Create a new client portal document called "Substance Use Disorder Treatment Information, 42 CFR Part 2"
Here is a sample you can cut and paste from:
Consent for uses and Disclosures of
Substance Use Disorder Treatment Information, 42 CFR Part 2
1. Patient Name:
I understand that my substance use disorder treatment records are protected under federal law, including 42 CFR Part 2 and HIPAA, and any applicable state laws. My treatment records can only be used or disclosed with my written consent, except as permitted by 42 CFR Part2, HIPAA, and applicable state law.
I understand that I have the right not to sign this consent form. If I do not sign, the consequences will be (write NONE or describe the applicable consequences):
[test box]
2. AUTHORIZATION
a. I authorize the following person or types of people to use and disclose my records:
[text box]
(Write the name(s) or specific identification of the person(s) or class of person authorized to use and disclose the records.)
b. I authorize the following person or types of people to receive my records:
[test box]
(Write the name(s) or other specific identification of the person(s) or class of persons authorized to receive the requested disclosure. For a single consent for all future uses and disclosures for treatment, payment, and health care operations, the recipient may be described as my treating providers, health plans, third-party payers, and people helping to operate this program, or a similar statement. If the recipient is an intermediary, the consent must include the name of the intermediary and either (A) the name(s) of the intermediary's member participants, or (B) a general designation of a participant or class of participants with a treating provider relationship to the patient (e.g. all my treating providers.)
c. I authorize the following records to be used and disclosed:
[test box]
(Describe the information to be used or disclosed in a specific and meaningful fashion.)
[checkbox] SUD COUNSELING NOTES: I agree to the use and disclosure of my substance use disorder (SUD) counseling notes. A Part 2 program may not require me to check this box as a condition of treatment, payment, enrollment in a health plan, or eligibility for benefits. If this box is checked, no other information may be listed above.
d. I authorize uses and disclosures for the following purpose(s) only:
[text box]
(Describe the purpose(s) of the requested use or disclosure. At the request of the patient is sufficient if the patient initiated the consent and did not specify a purpose. For Treatment, payment, and health care operations is sufficient when a patient consents once for all future uses and disclosures for those purposes.)
[checkbox] I do not wish to receive any fundraising communications from a Part 2 program providing treatment when it is fundraising on it own behalf.
[checkbox] I agree to the use and disclosure of my substance use disorder treatment records to be used in the criminal, civil legislative, or administrative proceeding identified below. If this box is checked, no other purposes may be listed above.
Case or Investigation No. (if known): [text box]
3. EFFECT
I understand that if HIPAA covered entities and business associates receive these records for treatment, payment, and health care operations purposes, the records may be re-disclosed in accordance with HIPAA, exept for uses or disclosures for civil, criminal, administrative, or legislative proceedings against me.
4. TIME PERIOD
Unless I revoke my consent, this consent will take effect immediately and expires on: [text box]
(Identify a date or event that relates to the patient or the purpose of the use or disclosure. End of treatment, none, or similar language is sufficient if the consent is for a use or disclosure for treatment, payment, or health care operations. End of the research study or similar language is sufficient if the consent is for a use or disclosure for research, including creating or maintaining a research database or repository.)
I have the right to revoke this consent in writing at any time, except to the extent that action has been taken in reliance upon it. I understand that I may revoke consent by:
[Enter information about how the client can revoke this consent]
I have been offered a copy of this form. It has been explained to me in a language I understand. I acknowledge that there is a potential for the records used or disclosed pursuant to this consent to be subject to re-disclosure by the recipient and no longer protected by Part 2.
Name of Person other than the patient completing this form (if applicable): [text box]
If you are signing as a personal representative of an individual, please describe your legal authority to act for this individual (power of attorney, healthcare surrogate, etc.).
[text box]
BY SIGNING, YOU INDICATE THAT YOU HAVE READ, UNDERSTAND AND AUTHORIZED TO THESE TERMS, YOU SHOULD RETAIN A COPY OF THIS DOCUMENT, AND THAT YOU ARE THE CLIENT, THE GUARANTOR, THE CLIENTS LEGAL REPRESENTATIVE, OR LEGALLY AUTHORIZED TO SIGN THIS AGREEMENT AND ACCEPT THESE TERMS.
If you have questions or need assistance please contact us at support@theraymate.com.