42 CFR Part 2 is a U.S. federal rule that gives substance-use-disorder (SUD) treatment records extra protection, stricter than baseline HIPAA, when those records come from a federally assisted SUD program. The reason for the heightened protection is the real-world risk that disclosure of addiction treatment can lead to criminal, employment, or social harm, which historically discouraged people from seeking care. Where HIPAA permits many disclosures for treatment, payment, and operations without specific patient sign-off, Part 2 has historically required the patient's specific consent for each disclosure, with tight controls on passing the data along.
The rule was significantly revised in 2024 to align more closely with HIPAA — easing some consent flows, for example allowing a single consent to support treatment, payment, and operations — while preserving the heightened floor of protection and the prohibition on using these records against the patient. The result is alignment, not elimination: Part 2 data still carries obligations that ordinary HIPAA data does not.
For a telemedicine product serving addiction care, the impact is concretely architectural. Part 2 records have to be segmented and tagged, not just dumped into the same chart as everything else, because the system must honor the scope of each consent when data is queried, displayed, or shared through integrations, and must prevent redisclosure to parties the patient did not authorize. The common pitfall is building a HIPAA-tuned platform and assuming it covers Part 2 — it does not. These records need their own consent model, access paths, and redisclosure controls layered inside an otherwise HIPAA-compliant system, and getting that wiring wrong is both a compliance failure and a betrayal of a particularly vulnerable patient population.
