The Compliance Deadline for 42 CFR Part 2 Amendments Is Looming: Preparing for Changes to Patient Consent

Healthcare organizations that provide substance use disorder (SUD) services should ensure they are complying with new patient consent requirements before the compliance deadline hits for the recent amendments to 42 CFR Part 2. The compliance deadline is February 16, 2026.

42 CFR Part 2 is a federal law that protects the confidentiality of substance use disorder (SUD) records and information. As summarized in our previous Pulse Check alert, Part 2 underwent significant amendments in a Final Rule published on February 16, 2024, by the U.S. Department of Health and Human Services. In this alert, we highlight key changes related to patient consent.

The New Requirements

TPO consent: Part 2 now allows patients to execute a single consent form to authorize all future uses and disclosures of their SUD information for treatment, payment, and healthcare operations (TPO) purposes. Unlike HIPAA, Part 2 requires the written consent of the patient before a provider can disclose SUD information for treatment, payment, and healthcare operations purposes. By allowing patients to execute a blanket consent form for all future TPO disclosures, the Part 2 amendments ease administrative burdens on providers. For the TPO consent form to be valid, however, it must contain specific language required by Part 2, including a warning to patients that the records may be redisclosed and no longer protected by Part 2, and a statement describing the consequences of a patient’s refusal to sign the consent.

Copy of consent form must be provided with disclosures: The amendments include a new requirement that imposes a significant administrative change on regulated entities. When an entity makes a disclosure of SUD information pursuant to a patient consent form, the entity must provide the recipient with a copy of that consent form (or a clear explanation of the scope of consent provided). The intent of this change is to ensure that recipients of SUD records are informed of the scope of consent provided by the patient. This also helps ensure SUD information is only used for authorized purposes.

Legal proceedings: Under the amendments, if a patient signs a consent form authorizing disclosure of their SUD information for legal proceedings, the consent form cannot authorize the disclosure of their SUD information for any other purposes. In other words, patients must execute a standalone consent form authorizing disclosures for legal proceedings.

SUD counseling notes: Part 2 provides heightened protection to “SUD Counseling Notes”, which is very similar to the protection HIPAA provides to “psychotherapy notes.” SUD counseling notes refer to the provider’s notes documenting or analyzing the contents of a conversation during a private or group SUD counseling session that are separated from the rest of the patient’s record. With limited exceptions, regulated entities must obtain patient consent prior to disclosing SUD counseling notes. Consents authorizing disclosure of SUD counseling notes cannot be combined with any other consents.

Next Steps for Providers

With the February compliance deadline looming, regulated entities should ensure that their policies and procedures have been updated to reflect Part 2’s changes to patient consent requirements. Among the steps to take now:

• Review your TPO consent form to ensure it complies with the Part 2 amendments.
• Prepare patient education to accompany the new TPO consent form, as the change will likely lead to questions from patients about how their information is being used and protected.
• Implement a new administrative process to ensure recipients of SUD information receive a copy of the patient consent form authorizing the disclosure.
• Train employees on the new patient consent requirements to promote compliance within your organization.

The Woods Rogers Pulse Check offers concise, timely insights on emerging trends and key developments in healthcare law—keeping you informed and ahead of change. Our multidisciplinary team understands the complexities of the healthcare industry and provides strategic legal guidance tailored to your needs. Whether you're facing a challenging compliance issue, a critical business transaction, a government investigation, or potential litigation, we deliver clear, coordinated solutions. With deep experience in regulatory, transactional, and litigation matters, our attorneys work collaboratively to help healthcare organizations navigate risk and move forward with confidence. 

Want the latest healthcare updates delivered directly to your inbox? Sign up for our Health Law mailing list.