42 CFR Part 2 explained for treatment programs' marketing and intake

What 42 CFR Part 2 is and who it applies to

Part 2 applies to a "Part 2 program": a federally assisted program that holds itself out as providing, and provides, SUD diagnosis, treatment or referral for treatment (42 CFR 2.11 (opens in a new tab)). That includes stand-alone programs, identified SUD units inside general medical facilities, and staff in those facilities whose primary function is SUD care.

"Federally assisted" is broad under 42 CFR 2.12 (opens in a new tab). Any one of these can qualify a program:

• participation as a Medicare provider;
• authorization to provide maintenance treatment or withdrawal management;
• DEA registration to dispense controlled substances used to treat SUD;
• federal funds of any kind, including through a state or local government;
• tax-exempt status, or tax deductions for contributions.

Covered examples include treatment programs, employee assistance programs and private practitioners who hold themselves out as providing SUD services. The protections also follow the records: anyone who receives them with the required notice becomes a "lawful holder" bound by the rule, which can include your vendors.

For practices that prescribe buprenorphine inside broader primary care or psychiatry, the "holds itself out" test is the hinge, and how your website describes your services is part of that facts question. Involve counsel before relaunching it. For the wider picture, see our addiction treatment marketing map.

Part 2 vs HIPAA: what's stricter

Many Part 2 programs are also HIPAA covered entities, so both rules apply. Where they differ, Part 2 is usually stricter.

Part 2's definition of "records" explicitly includes emails, voicemails and texts, so a shared intake inbox or texting app is in scope.

For the baseline rules, see the HIPAA Privacy Rule.

What changed in the 2024 final rule

HHS published the final rule on February 16, 2024 (89 FR 12472). It took effect on April 16, 2024, and the Federal Register text (opens in a new tab) set the compliance date: "Persons subject to this regulation must comply with the applicable requirements of this final rule by February 16, 2026." We checked that text and the HHS fact sheet (opens in a new tab) on October 22, 2026. The compliance date for the patient's right to an accounting of disclosures will be set later.

The main changes:

• Single consent. One consent can cover all future treatment, payment and health care operations, and HIPAA entities receiving records this way may redisclose them as HIPAA permits, except in proceedings against the patient.
• SUD counseling notes. A new category of separately kept counseling notes needs its own consent, similar to HIPAA's psychotherapy notes.
• Breach notification. HIPAA's breach rules now apply to Part 2 records.
• Enforcement. Part 2's old criminal penalties are replaced by HIPAA's civil and criminal enforcement authorities, and patients can complain directly to HHS.
• Notice and fundraising. The patient notice is aligned with HIPAA's Notice of Privacy Practices, and patients can opt out of fundraising.

What didn't change: the rule created no marketing permission.

Consent, redisclosure and what that means for intake forms

Under 42 CFR 2.31 (opens in a new tab), a written consent must name the patient, who may disclose, the information (described "in a specific and meaningful fashion"), the recipients and each purpose, and must include the right to revoke, an expiration date or event, a signature and the date. A consent for treatment, payment and operations must also say that records may be redisclosed and no longer protected by Part 2, and explain the consequences of refusing. Each disclosure made under consent must carry a notice under 42 CFR 2.32 (opens in a new tab); the short form reads "42 CFR part 2 prohibits unauthorized use or disclosure of these records."

What that means for a website intake form:

• The submission may itself be a record. Because "patient" includes applicants, a completed admissions or insurance-verification form at a Part 2 program can be protected the moment it arrives.
• Ask for the minimum at first contact. Name, a safe phone number, the best time to call and insurance carrier are usually enough. Leave substance history for the clinical assessment.
• Don't route submissions into ordinary tools. Plain email inboxes, spreadsheets and general CRMs without the right agreements are where intake data leaks.
• Keep confirmations neutral. An auto-reply or text should not mention SUD, a program name that reveals it, or the services requested.

Websites, analytics and tracking pixels on treatment pages

HHS OCR's guidance on online tracking technologies (opens in a new tab) says tracking on user-authenticated pages generally has access to PHI and needs a BAA, and that pages for scheduling, symptom checking and portal login or registration can involve PHI. On June 20, 2024, a federal court in American Hospital Association v. Becerra vacated the guidance to the extent it said HIPAA is triggered when technology connects an IP address with a visit to an unauthenticated public page about health conditions or providers. HHS says it is evaluating next steps.

The guidance doesn't mention Part 2, but Part 2's definition of "disclose" covers communicating anything that identifies a person as having, or having been referred for, an SUD. An ad pixel that passes an email, phone number or click ID from an admissions form to an ad platform is the risk to design out.

Practical steps:

• Inventory every tag on intake, insurance-verification and thank-you pages, including chat widgets and session-replay tools. Remove third-party advertising tags from those pages.
• Watch URLs. Paths such as /thank-you-opioid-detox, or parameters carrying names, leak into analytics and ad platforms.
• Don't build remarketing audiences from treatment-page visitors. Google treats health as a sensitive interest category, and its personalized advertising policy (opens in a new tab) bars advertiser-curated audiences such as customer lists for it.

Our guide to tracking pixels and HIPAA covers tag audits in more detail.

CRMs, call centers and marketing vendors

Part 2 has its own vendor agreement, the qualified service organization agreement (QSOA). Under 42 CFR 2.11 (opens in a new tab), the vendor agrees in writing that it is fully bound by Part 2 and will resist efforts in judicial proceedings to obtain patient information except as Part 2 permits. The definition now includes HIPAA business associates of programs that are also covered entities; ask counsel whether your business associate agreements need Part 2 language.

Map your vendors by what they touch:

Lawful holders also need formal security policies under 42 CFR 2.16. If a vendor's pay rises with admissions, see patient brokering laws and the rehab advertising rules.

Where Medfy fits. Medfy signs a BAA with every practice and stores patient information in separate, encrypted HIPAA databases in the US or Canada. Its handling of 42 CFR Part 2 records is not confirmed, so Medfy makes no Part 2 claim, and substance-use intake should stay in your program's own Part 2-compliant systems. Medfy also does not provide LegitScript certification. Read how Medfy handles patient data, or start with the free marketing audit, which reads public information only and flags privacy risks such as pixels on patient forms.

A checklist for treatment program marketing teams

• Confirm with counsel whether you're a Part 2 program, and document the answer.
• List every intake path: web forms, chat, phone, voicemail, text, email and directory listings.
• Remove third-party ad tags and session replay from intake and thank-you pages, and check URLs for names or service details.
• Put a QSOA and/or BAA in place with every vendor that receives records.
• Cut first-contact forms to the minimum fields.
• Review consent forms against 42 CFR 2.31, with separate consents for SUD counseling notes and legal proceedings.
• Attach the 42 CFR 2.32 notice to every disclosure made under consent.
• Update the patient notice and breach plan for the 2024 rule.
• Script calls and review replies so no one confirms a person is a patient.
• Report marketing results in aggregate, and re-check this list whenever you add a tool or vendor.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

Does 42 CFR Part 2 apply to my practice?

It applies if you are a federally assisted program that holds itself out as providing substance use disorder diagnosis, treatment or referral. Federal assistance includes Medicare participation, a DEA registration to dispense controlled substances for SUD treatment, federal funding and tax-exempt status. A general practice that prescribes MAT without presenting itself as an SUD provider may fall outside the rule, but that is fact-specific. Ask a healthcare attorney to confirm.

What's the difference between HIPAA and 42 CFR Part 2?

HIPAA lets providers share health information for treatment, payment and operations without written authorization. Part 2 generally requires the patient's written consent, although one consent can now cover all future treatment, payment and operations uses. Part 2 also bars using records against patients in legal proceedings without consent or a court order, and it protects anyone who has merely applied for SUD care at a covered program. HIPAA breach rules now apply to both.

Can we use Google Analytics on an addiction treatment website?

On general information pages, with care; on intake pages, not with standard ad or analytics tags. HHS says tracking on scheduling, intake and login pages can involve protected information, and a court vacated only the part of its guidance about IP addresses on public pages. For a Part 2 program, an admissions inquiry can itself be a protected record. Keep third-party tags off forms and thank-you pages, and report in aggregate.

What changed in the 42 CFR Part 2 final rule?

The final rule, published February 16, 2024 with compliance required by February 16, 2026, lets patients sign one consent for all future treatment, payment and health care operations uses. It applies HIPAA breach notification and enforcement to Part 2 records, defines SUD counseling notes that need separate consent, aligns the patient notice with HIPAA's, lets patients complain to HHS and strengthens protections against use of records in legal proceedings.