Guide

Part 2 and the private practice: the 'program' test

Summary

42 CFR Part 2 does not apply to most private practices. It reaches only a 'program' — a person or unit that both holds itself out as providing substance-use-disorder diagnosis, treatment, or referral and is federally assisted. A general therapy practice that occasionally treats a client's substance use is usually outside Part 2; a practice advertised as addiction treatment, or a prescriber holding out as treating opioid use disorder, is likely inside. HIPAA and your ethics code still apply either way.

By Gale Editorial · Updated 2026-07-26. Every figure cited to a dated source. How we write.

Does Part 2 apply to my practice?

Part 2 applies only if your practice is a 'program' under the regulation and that program is federally assisted — both must be true. Most solo behavioral-health practices meet neither element and are governed by HIPAA alone. The regulation defines a program as an individual or entity that holds itself out as providing, and does provide, substance-use-disorder diagnosis, treatment, or referral for treatment 1Ref 1Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The definition of a Part 2 'program' (holding-out plus provision of SUD diagnosis, treatment, or referral) and the consent, redisclosure, and court-order obligations a program takes on.. If that description does not fit how you advertise and practice, Part 2 does not reach you 1Ref 1Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The definition of a Part 2 'program' (holding-out plus provision of SUD diagnosis, treatment, or referral) and the consent, redisclosure, and court-order obligations a program takes on..

It helps to run this alongside the covered-entity test you already did for HIPAA. HIPAA asks whether you are a covered entity; Part 2 asks the narrower question of whether you are an SUD program. Passing the first says nothing about the second — you can be a HIPAA covered entity and not a Part 2 program, which is the ordinary situation for a general therapy practice. Below, each element is broken out, then applied to the scenarios a solo clinician actually faces 1Ref 1Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The definition of a Part 2 'program' (holding-out plus provision of SUD diagnosis, treatment, or referral) and the consent, redisclosure, and court-order obligations a program takes on..

The 'program' test: what 'holding out' means

Holding out is about how you present your services to the public and to patients, not about which clients happen to walk in. A practice holds itself out as an SUD program when its advertising, website, intake language, or professional identity tells the world it provides substance-use diagnosis, treatment, or referral 1Ref 1Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The definition of a Part 2 'program' (holding-out plus provision of SUD diagnosis, treatment, or referral) and the consent, redisclosure, and court-order obligations a program takes on.. Treating a depressed client who also drinks too much does not make you a program; marketing an addiction-treatment service does 1Ref 1Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The definition of a Part 2 'program' (holding-out plus provision of SUD diagnosis, treatment, or referral) and the consent, redisclosure, and court-order obligations a program takes on..

The distinction is deliberate. Congress and the regulators wanted the heightened confidentiality to attach to settings a patient would recognize as addiction treatment — the settings where a leaked record can cost someone a job, custody, or their freedom. So the analysis looks at your outward presentation: what your directory listing says, how your intake describes the service, whether 'recovery' or 'addiction' is your specialty claim. If your public face is general mental health, incidental SUD treatment does not convert you into a program 1Ref 1Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The definition of a Part 2 'program' (holding-out plus provision of SUD diagnosis, treatment, or referral) and the consent, redisclosure, and court-order obligations a program takes on..

The 'federally assisted' element

Even a practice that holds itself out as SUD treatment is a Part 2 program only if it is also federally assisted, and that term is broad. It includes receiving federal funds, tax-exempt status, authorization to bill Medicare or Medicaid, and — importantly for prescribers — holding a DEA registration to dispense or prescribe controlled substances used to treat substance use disorder 1Ref 1Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The definition of a Part 2 'program' (holding-out plus provision of SUD diagnosis, treatment, or referral) and the consent, redisclosure, and court-order obligations a program takes on.. Most practices touch at least one of these, so the program test usually does the real work 2Ref 2Substance Abuse and Mental Health Services Administration (2024).Confidentiality of Substance Use Disorder (SUD) Patient Records.The 'federally assisted' element as described in the final rule, and confirmation that the 2024 changes addressed consent and enforcement rather than the applicability definitions..

Because federal assistance is so broadly defined, do not treat it as your escape hatch. A cash-only practice with no federal funding, no Medicare or Medicaid enrollment, and no DEA registration can genuinely fall outside it — but a prescriber with a DEA number, or a practice that bills any federal program, will usually satisfy the element. When both elements are close, the safer read is to assume Part 2 may apply and confirm with counsel before you disclose anything 2Ref 2Substance Abuse and Mental Health Services Administration (2024).Confidentiality of Substance Use Disorder (SUD) Patient Records.The 'federally assisted' element as described in the final rule, and confirmation that the 2024 changes addressed consent and enforcement rather than the applicability definitions..

Common solo scenarios, decided

Apply both elements to the situations a solo practice actually hits, and most resolve cleanly. The table below is a starting map, not a legal opinion — a borderline case (a therapist whose caseload is mostly SUD, a group practice with a dedicated addiction track) is where you bring in counsel 1Ref 1Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The definition of a Part 2 'program' (holding-out plus provision of SUD diagnosis, treatment, or referral) and the consent, redisclosure, and court-order obligations a program takes on.. The single question that flips most cases is whether you hold yourself out as providing SUD treatment, not whether any given client has an SUD 1Ref 1Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The definition of a Part 2 'program' (holding-out plus provision of SUD diagnosis, treatment, or referral) and the consent, redisclosure, and court-order obligations a program takes on..

Scenario	Part 2 program?
General psychotherapy practice; some clients have SUDs	Usually no — not holding out as SUD treatment
Website advertises addiction or recovery counseling as a service	Likely yes, if also federally assisted
Prescriber with a DEA registration treating opioid use disorder and holding out as such	Likely yes
Cash-only therapist; no federal funds, no Medicare/Medicaid, no DEA, no SUD marketing	No
Dedicated SUD intensive-outpatient service	Yes

The honest answer for many readers is a firm no on the program element, which ends the inquiry. If yours is a maybe, resolve it in writing before your first SUD disclosure rather than in the moment a request arrives 1Ref 1Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The definition of a Part 2 'program' (holding-out plus provision of SUD diagnosis, treatment, or referral) and the consent, redisclosure, and court-order obligations a program takes on..

If you are not a program: what still applies

Not being a Part 2 program does not mean SUD information is unprotected — it means one specific federal layer does not attach. HIPAA still governs the records of any covered practice, professional ethics codes still require confidentiality of everything a client tells you, and state mental-health-confidentiality statutes may add their own protections 3Ref 3American Psychological Association (2017).Ethical Principles of Psychologists and Code of Conduct.That a professional ethics code independently requires confidentiality of all client information, so substance-use details remain protected even when Part 2 does not attach.. In day-to-day terms, you protect a client's substance-use history the same careful way you protect the rest of the chart 3Ref 3American Psychological Association (2017).Ethical Principles of Psychologists and Code of Conduct.That a professional ethics code independently requires confidentiality of all client information, so substance-use details remain protected even when Part 2 does not attach..

What you avoid, by not being a program, is Part 2's extra consent formalities and its special court-order rule — not the underlying duty of confidentiality. Substance-use details in a general mental-health record still deserve minimum-necessary discipline when a payer or a court comes asking, because those details carry the same real-world risk to the client whether or not Part 2 is the source of the protection 3Ref 3American Psychological Association (2017).Ethical Principles of Psychologists and Code of Conduct.That a professional ethics code independently requires confidentiality of all client information, so substance-use details remain protected even when Part 2 does not attach..

If you are a program: what you take on

If both elements are met, you take on Part 2's full apparatus: consent before you disclose, redisclosure limits, and special handling when records are sought in litigation. Since the 2024 final rule, a single patient consent can authorize future treatment, payment, and operations disclosures, which simplifies coordination without lowering the consent requirement 4Ref 4U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.The 2024 single-consent-for-future-TPO change and its February 16, 2026 compliance date, which define what a practice that is a program now takes on.. The pieces to build first are the part 2 consent form and a plan for how sud records in court get handled 1Ref 1Office of the Federal Register (2026).42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records.The definition of a Part 2 'program' (holding-out plus provision of SUD diagnosis, treatment, or referral) and the consent, redisclosure, and court-order obligations a program takes on..

Do not improvise these from a HIPAA template. Part 2's consent content, its prohibition on redisclosure without fresh authority, and its court-order requirement differ from HIPAA in ways that matter in an audit or a courtroom. The 2024 changes — part 2, aligned with HIPAA on penalties and patient rights — narrowed the gap but did not close it, so a program still needs Part 2-specific paperwork rather than a repurposed general-privacy form 4Ref 4U.S. Department of Health and Human Services (2024).Fact Sheet: 42 CFR Part 2 Final Rule.The 2024 single-consent-for-future-TPO change and its February 16, 2026 compliance date, which define what a practice that is a program now takes on..

Common questions

Usually not. Seeing clients who have substance-use disorders does not make you a program. Part 2 attaches only when you hold yourself out to the public as providing SUD diagnosis, treatment, or referral — your marketing and professional identity, not your caseload, decide it. A general practice that treats SUD incidentally is normally governed by HIPAA alone.

Not by itself. Medicaid or Medicare billing satisfies the 'federally assisted' element, but Part 2 requires both elements. Unless you also hold yourself out as providing substance-use treatment, the federal-assistance piece alone does not make you a program. Both the program test and the federal-assistance test must be met at the same time.

It can. A prescriber who holds out as treating opioid use disorder and is federally assisted — a DEA registration counts — is likely a program, because that presentation and that assistance meet both elements. A prescriber who treats other conditions and only occasionally addresses substance use, without advertising addiction treatment, generally is not.

No. HIPAA still governs your records, your professional ethics code still requires confidentiality of everything a client discloses, and many states add their own mental-health-confidentiality laws. Not being a Part 2 program only removes one federal layer's specific consent and court-order formalities; the underlying duty to protect the information remains fully in force.

The applicability definitions were left essentially intact; the 2024 final rule's changes were about consent, redisclosure, penalties, and patient rights, aligning them with HIPAA. So the program and federally-assisted tests you use to decide whether Part 2 reaches you are the same ones that applied before the rule took effect on February 16, 2026.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Office of the Federal Register (2026). 42 CFR Part 2 — Confidentiality of Substance Use Disorder Patient Records. eCFR. link ✓The definition of a Part 2 'program' (holding-out plus provision of SUD diagnosis, treatment, or referral) and the consent, redisclosure, and court-order obligations a program takes on.
2.Substance Abuse and Mental Health Services Administration (2024). Confidentiality of Substance Use Disorder (SUD) Patient Records. Federal Register. link ✓The 'federally assisted' element as described in the final rule, and confirmation that the 2024 changes addressed consent and enforcement rather than the applicability definitions.
3.American Psychological Association (2017). Ethical Principles of Psychologists and Code of Conduct. American Psychological Association. link ✓That a professional ethics code independently requires confidentiality of all client information, so substance-use details remain protected even when Part 2 does not attach.
4.U.S. Department of Health and Human Services (2024). Fact Sheet: 42 CFR Part 2 Final Rule. U.S. Department of Health and Human Services. linkThe 2024 single-consent-for-future-TPO change and its February 16, 2026 compliance date, which define what a practice that is a program now takes on.

https://www.gale.care/for-providers/pr-part2-applies-to-me · 4 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers