42 CFR Part 2 is a U.S. federal rule that gives substance-use-disorder (SUD) treatment records extra protection, stricter than baseline HIPAA, when those records come from a federally assisted SUD program. The reason for the heightened protection is the real-world risk that disclosure of addiction treatment can lead to criminal, employment, or social harm, which historically discouraged people from seeking care. Where HIPAA permits many disclosures for treatment, payment, and operations without specific patient sign-off, Part 2 has historically required the patient's specific consent for each disclosure, with tight controls on passing the data along.
The rule was significantly revised in 2024 to align more closely with HIPAA — easing some consent flows, for example allowing a single consent to support treatment, payment, and operations — while preserving the heightened floor of protection and the prohibition on using these records against the patient. The result is alignment, not elimination: Part 2 data still carries obligations that ordinary HIPAA data does not.
For a telemedicine product serving addiction care, the impact is concretely architectural. Part 2 records have to be segmented and tagged, not just dumped into the same chart as everything else, because the system must honor the scope of each consent when data is queried, displayed, or shared through integrations, and must prevent redisclosure to parties the patient did not authorize. The common pitfall is building a HIPAA-tuned platform and assuming it covers Part 2 — it does not. These records need their own consent model, access paths, and redisclosure controls layered inside an otherwise HIPAA-compliant system, and getting that wiring wrong is both a compliance failure and a betrayal of a particularly vulnerable patient population.
The handbook · 7 volumes
Fora Soft Video Engineering Handbook
42 CFR Part 2 raises the bar on substance-use-disorder records, so session recordings and transcripts need tighter controls than standard HIPAA data. We wrote seven volumes covering the whole video stack, and for platforms under 42 CFR Part 2 start with Volume 5: recording, transcription and incident triage by symptom. Volume 3 covers WebRTC calls and Volume 7 compliance and production AI. Written by Nikolay Sapunov, CEO at Fora Soft.
Running SUD treatment sessions on video and unsure what 42 CFR Part 2 means for recordings?
We will review how your platform records, stores and shares session data and give you a 42 CFR Part 2 gap list with an engineering plan. 250+ video products shipped since 2005.
