Sign Up
Login
Try for Free
Login
A 42 CFR Part 2 consent is the written patient authorization, required by federal regulation, that lets a substance use disorder treatment program share a patient's SUD records. Clinicians and records staff in federally assisted SUD programs complete it before any consent-based disclosure. Since February 16, 2026, one consent can cover all treatment, payment, and operations uses until the patient revokes it in writing.
SUD program clinicians, counselors, and records staff prepare it; the patient, or a person authorized under 2.14 or 2.15, signs
The disclosing program and its records office, recipients including providers, health plans, and HIEs, OCR reviewers, auditors
300 to 700 words · 10 to 20 minutes by hand (clinical team estimate)
Consent and privacy documentation (compare: release of information, psychotherapy notes authorization)
Before any consent-based use or disclosure of SUD records; a TPO consent may be signed once at intake and lasts until revoked in writing
The eight consent elements are federal law (42 CFR 2.31); the form itself is not mandated, and OCR civil enforcement began February 16, 2026
A 42 CFR Part 2 consent is the written authorization, on paper or electronic, that permits a federally assisted substance use disorder program, or another lawful holder of its records, to use or disclose those records. Its required contents are enumerated at 42 CFR 2.31. The confidentiality scheme behind it dates to federal statutes of 1970 and 1972 and to regulations first issued on July 1, 1975, now codified at 42 U.S.C. 290dd-2; the CARES Act of 2020 ordered the regime aligned with HIPAA, and the 2024 final rule (89 FR 12472) carried that out, with a compliance date of February 16, 2026 that has now passed. Clinicians and payers call the document a Part 2 consent, a SAMHSA consent, a 42 CFR release, or an SUD release of information under Part 2.
The load-bearing distinction is with the ordinary HIPAA authorization behind a general release of information. HIPAA lets treatment, payment, and operations disclosures proceed with no authorization at all; Part 2 requires signed consent before those same disclosures whenever the records come from a Part 2 program, and a generic medical-records release does not satisfy 2.31. The two instruments also part ways on conditioning: a HIPAA authorization generally cannot be made a condition of treatment, while a Part 2 consent for treatment, payment, and operations can be. One newer neighbor matters too: the 2024 rule created SUD counseling notes, a Part 2 twin of the psychotherapy notes HIPAA already walls off behind a separate psychotherapy notes authorization. Both kinds of notes need their own standalone consent that cannot be combined with any other.
Programs that meet the regulation's two-part test: federally assisted, a status most providers hold through Medicare or Medicaid participation, federal tax exemption, DEA registration, or grant funding, and holding themselves out as providing SUD diagnosis, treatment, or referral. That reaches opioid treatment programs regulated under 42 CFR Part 8, outpatient and residential SUD programs, withdrawal management services, and the SUD arms of integrated care practices. The trigger is any consent-based use or disclosure: records to a primary care physician, a health plan, an HIE, a family member, or a court. A general therapy practice that neither takes federal assistance nor advertises SUD care is usually outside Part 2 and documents releases with a standard release of information; a substance use assessment written inside a Part 2 program, by contrast, is a Part 2 record from the moment it exists. The pressure point is care coordination: a 2017 qualitative study across 76 Oregon stakeholders found the pre-reform consent rules "perceived as a barrier to care coordination and integration," the burden the one-time TPO consent now exists to remove.
Patient and disclosing program. Name the patient, then the program or person authorized to make the disclosure. Both are enumerated elements, and the discloser line is what distinguishes this from a form the recipient drafted for its own purposes. Pitfall: assuming another agency's form covers you. The SSA-827 the Social Security Administration sends does not satisfy 2.31; a Part 2 program responding to SSA still needs its own compliant consent.
Information to be used or disclosed. The regulation requires a description that identifies the information in a specific and meaningful fashion: record types, the treatment episode, date ranges. Pitfall: any-and-all boilerplate. A description that would fit every chart in the building identifies nothing in a specific and meaningful way, and it invites the recipient to take more than the patient understood.
Recipients. Name the person or class receiving the records. Since the 2024 rule, a consent for treatment, payment, and operations may use a general designation, in the regulation's example wording, "my treating providers, health plans, third-party payers, and people helping to operate this program." When records flow through an intermediary such as an HIE, ACO, or care management organization, the consent must name the intermediary and either name the member participants or limit them to those with a treating relationship. Pitfall: naming the HIE alone. An intermediary designation without the participant limitation fails the recipient element even when everything else is right.
Purpose, and the two TPO statements. State why the disclosure is being made. A TPO consent must also carry the two statements at 2.31(a)(10): that records may be redisclosed by the recipient and may then lose Part 2 protection, and what the consequences of declining to sign would be. Pitfall: a form last revised before 2024. Pre-final-rule consents almost never carry either statement, and the compliance date has passed.
Expiration and revocation. Give an expiration date or an expiration event, plus the patient's right to revoke in writing, except to the extent the program has already acted in reliance, and how to revoke. For a TPO consent the regulation expressly accepts "none" or "end of the treatment," so no fixed date is required. Pitfall: importing an annual-renewal rule that is not in the regulation. A TPO consent lasts until written revocation; letting it lapse on an invented schedule interrupts lawful data flow for no compliance gain.
Signature and date. The patient signs and dates the consent; for minors, a person authorized under 2.14, and for patients adjudicated to lack capacity or deceased, a person authorized under 2.15. Paper or electronic consent is valid, and electronic signatures are acceptable where other law does not prohibit them. Pitfall: holding disclosures for a wet-ink original. SAMHSA guidance accepts a photocopy, fax, or valid e-signature; no witness or notary appears anywhere in the rule.
The 2.32 notice that travels with every disclosure. Each consent-based disclosure must be accompanied by one of two written statements, long form or short, and, since the 2024 rule, by a copy of the consent or a clear explanation of its scope (42 CFR 2.32). The section was renamed from "Prohibition on redisclosure" to reflect the addition. Pitfall: stamping the old redisclosure paragraph alone. Without the consent copy or scope explanation the disclosure fails the amended rule, HIEs included.
42 CFR PART 2 CONSENT FOR RELEASE OF SUD RECORDS
Written consent (paper or electronic) is required before a
federally assisted SUD program uses or discloses patient
records (42 CFR 2.31). No federal form is mandated; adapt
this to your program, your EHR, and any stricter state law.
Verbal consent is never sufficient.
PATIENT AND DISCLOSING PROGRAM
Patient name: ______________________ DOB: _________________
Program or person authorized to disclose: _________________
___________________________________________________________
INFORMATION TO BE USED OR DISCLOSED
Describe in a specific and meaningful way (types, dates):
___________________________________________________________
___________________________________________________________
SUD counseling notes are NOT covered; they require their
own separate consent.
RECIPIENT(S)
Name or class of recipients: ______________________________
For a TPO consent, a general designation is permitted:
[ ] My treating providers, health plans, third-party
payers, and people helping to operate this program
Intermediary (HIE, ACO), if any, plus named participants
or a treating-relationship limit: _________________________
PURPOSE
[ ] Treatment, payment, and health care operations (TPO)
[ ] Other (state it): _____________________________________
TPO CONSENT STATEMENTS (2.31(a)(10))
[ ] Records disclosed under this consent may be redisclosed
by the recipient and may no longer be protected by
42 CFR Part 2.
[ ] Consequences of declining to sign were explained:
___________________________________________________________
EXPIRATION AND REVOCATION
Expires on (a date or an event; "none" or "end of the
treatment" is sufficient for a TPO consent): ______________
I may revoke this consent in writing at any time, except to
the extent the program has already acted in reliance on it.
How to revoke: ____________________________________________
SIGNATURE
Patient (or person authorized under 2.14 or 2.15): ________
Signature: ____________________ Date signed: ______________
Attach the 2.32 notice plus a copy of this consent, or a
clear explanation of its scope, to every disclosure made
under it.Free to use and share, no signup. The PDF includes a one-page cheat sheet with section-by-section pitfalls and a pre-sign checklist; the DOCX is the blank template, ready to adapt.
Scenario: an adult in outpatient SUD treatment authorizes his program to share records with his primary care physician so ongoing care can be coordinated. All details are fictional.
42 CFR Part 2 consent. Cedarline Recovery Services · Patient: M.T. · Signed: 07/14/2026 · Disclosure logged: 07/16/2026
Patient and disclosing program: M.T., date of birth 05/22/1988. Discloser: Cedarline Recovery Services, an outpatient substance use disorder treatment program and Part 2 program.
Information to be used or disclosed: Attendance summary, current medication list, treatment plan status, and discharge recommendations from the outpatient treatment episode that began 03/09/2026. SUD counseling notes are excluded; disclosing them would require a separate consent.
Recipient: Dr. A. Patel, Fairhaven Family Medicine, the patient's primary care physician.
Purpose: Treatment: coordination of ongoing medical care, including prescribing decisions that depend on current treatment status.
TPO statements: M.T. acknowledged in writing that records disclosed under this consent may be redisclosed by the recipient and may then no longer be protected by Part 2, and that declining to sign would not affect his treatment at Cedarline.
Expiration and revocation: Expires at the end of the current treatment episode. M.T. may revoke in writing at any time through the records office, except to the extent Cedarline has already acted in reliance on the consent.
Signature: Signed electronically by M.T. on 07/14/2026; identity verified at check-in. Electronic signature accepted under program policy and applicable law.
Disclosure processing: Records sent to Dr. Patel on 07/16/2026 with the 2.32 notice and a copy of this consent attached; the disclosure was entered in the program's log.
This sample is fictional and for educational purposes. It does not describe a real patient, program, or practice.
Writing these after every session? BastionGPT drafts complete notes from bullets, dictation, or a transcript.
Generate a note from bulletsThe enforcement ground shifted while many consent forms stood still. For five decades Part 2 violations were criminal matters, rarely prosecuted, with fines capped at $500 for a first offense and $5,000 for repeats under the pre-2024 statute. The CARES Act imported HIPAA's civil machinery instead: the HHS Secretary delegated Part 2 enforcement to the Office for Civil Rights on August 25, 2025, OCR announced a Part 2 Civil Enforcement Program on February 13, 2026, and complaints and breach reports have been accepted since February 16, 2026, under the tiered civil money penalty schedule, a range 2026 law firm alerts summarize as roughly $141 to $2.1 million per violation depending on culpability. Two facts keep the picture in proportion: OCR has said it will not investigate conduct predating February 16, 2026, and as of mid-2026 no Part 2 resolution agreement or civil penalty had been announced, so the first action will set the practical tone. What belongs in the record now: the signed consent itself, the disclosures made under it with the notice attached, and care coordination entries that state the consent's scope rather than assuming it.
Around the consent sit layers of different weight, and the differences are the compliance program. The eight consent elements, the two TPO statements, and the 2.32 notice are law. The form is not: HHS and SAMHSA publish only voluntary model documents, refreshed most recently on February 13, 2026, and no regulation prescribes a form, a font, a witness signature, a wet-ink original, or a retention period for the consent itself. Retention arrives from elsewhere: HIPAA's six-year documentation rule at 45 CFR 164.530(j) reaches consents held by covered entities, and state licensing and payer rules commonly run five to ten years. State confidentiality statutes can be stricter than Part 2 and control when they are; New York's Mental Hygiene Law 33.13 is the standing example. One interaction catches even careful programs: under 42 CFR 2.36, reporting a patient's SUD medications to a state prescription drug monitoring program requires patient consent under 2.31, even where state law mandates PDMP reporting. Canada and Australia have no Part 2 equivalent; SUD records there fall under PIPEDA and provincial acts such as Ontario's PHIPA, or the Privacy Act 1988 and its Australian Privacy Principles, but a clinician in either country who receives US Part 2 records takes them subject to the redisclosure restriction carried by the accompanying notice. These questions always sit on top of state law and program policy, so consult your attorney or board; state rules vary. If you or a client needs immediate support: call or text 988 (US), 9-8-8 (Canada), or Lifeline 13 11 14 (Australia).
Part 2 consent defects rarely surface as claim denials; no claim adjustment or remark code specific to a Part 2 consent exists, and no published study measures consent error rates. The pressure arrives as enforcement exposure and blocked coordination instead, and the scale is documented: SAMHSA's 2023 national survey collected data from 20,681 substance use and mental health treatment facilities (84.9 percent response rate), all of them now inside the civil enforcement perimeter; an OCR paperwork notice from September 2025 estimated 1,864,367 patients in SUD treatment annually and projected roughly 1,864 Part 2 complaints a year at 45 minutes each; and a 2017 Psychiatric Services study built on 114 interviews with 76 Oregon stakeholders documented the consent regime itself as a coordination barrier, the finding that drove the one-time TPO consent. The BastionGPT Clinical Advisory Board sees the same errors most often in Part 2 consent reviews:
BastionGPT is specifically trained, tuned, and clinically tested on 42 CFR Part 2 consents.
See how clinicians use it day to day on the AI therapy notes page.
Many BastionGPT users report saving more than 90 minutes per day on documentation.
HIPAA-compliant with a signed BAA on every plan. Your data is never used to train models. BastionGPT drafts, you review and sign.
Not a fixed one. The regulation asks for an expiration date or an expiration event, and for a consent covering treatment, payment, and operations it expressly accepts "none" or "end of the treatment." An open-ended TPO consent stays valid until the patient revokes it in writing. Many pages ranking for this form still call a fixed date mandatory; that requirement is not in the rule. If your program prefers dated consents for workflow reasons, that is policy, not law.
No, not when the records come from a Part 2 program. A general release of information rides on HIPAA, which permits treatment, payment, and operations disclosures without any authorization; Part 2 requires signed consent even for those, and its consent must carry elements a generic form lacks, including the redisclosure statement and, since 2024, the consent copy that travels with each disclosure. Use the Part 2 consent whenever a Part 2 program's records are involved, and the ordinary release for everything else.
That date ended the transition to the 2024 final rule and switched civil enforcement on. Programs must now use consents that track HIPAA's authorization elements, may rely on a single TPO consent signed once, must include the two 2.31(a)(10) statements, and must attach the renamed 2.32 notice plus a copy of the consent, or a clear explanation of its scope, to every consent-based disclosure. The same day, the Office for Civil Rights began accepting Part 2 complaints and breach reports under HIPAA-style penalties, while stating it will not investigate conduct from before that date.
Unlike a HIPAA authorization, a Part 2 TPO consent may lawfully be made a condition of treatment. HHS added a caution in the rule's preamble: programs should not condition treatment on the consent unless they have some capacity to honor patients' requests for restrictions. So the practice is permitted by the regulatory text and discouraged in some circumstances by the commentary. Document your program's choice either way, and remember the consent must state the consequences of declining to sign.
Verbal consent is never sufficient; Part 2 consent must be in writing. Beyond that, the rule is flexible: consent may be paper or electronic, electronic signatures are acceptable wherever other law does not prohibit them, and SAMHSA guidance confirms a photocopy or fax works. No witness, no notary, and no wet-ink original appear anywhere in the regulation.
No. The 2024 rule created SUD counseling notes, a category HHS said almost exactly matches HIPAA's psychotherapy notes: a clinician's private session analysis kept separate from the rest of the record. They need their own standalone consent that cannot be combined with a TPO consent or any other, just as psychotherapy notes need a separate authorization. Consents for use in civil, criminal, administrative, or legislative proceedings must stand alone as well.
Two things, under the 2.32 rule the 2024 final rule renamed and expanded. First, one of two written statements; the short form reads "42 CFR part 2 prohibits unauthorized use or disclosure of these records." Second, a copy of the consent itself or a clear explanation of its scope. The pre-2024 practice of stamping the old prohibition-on-redisclosure paragraph alone no longer satisfies the rule, and disclosures through an HIE are not exempt.
No equivalent exists in either country. Canadian SUD records fall under general health privacy law: PIPEDA federally and provincial statutes such as Ontario's PHIPA, which rely on implied consent inside the circle of care and express consent beyond it. Australia treats them as sensitive information under the Privacy Act 1988 and its Australian Privacy Principles, with state health records acts layered on. The catch is imported: a clinician in either country who receives records from a US Part 2 program takes them subject to the redisclosure restriction stated in the accompanying notice.
Yes. Give it the disclosure facts: who is disclosing, to whom, which records, and why, and it drafts a consent carrying all eight 2.31 elements, flags a missing TPO statement or an any-and-all description before signature, and produces the 2.32 notice packet for the outgoing disclosure. BastionGPT is HIPAA-compliant with a signed BAA on every plan, and your data is never used to train models.
Educational content, not legal or billing advice. Sample notes are fictional. Follow your organization's policies and your board, payer, and jurisdiction requirements.