42 CFR Part 2 vs. HIPAA: what's the difference and why it matters
42 CFR Part 2 and HIPAA are both federal health-privacy regulations, but they protect different records and at different levels of strictness. Here is the side-by-side comparison — and how to know which one applies to your situation.
Agape Counseling Services6 min read
Last reviewed: August 1, 2026 — information reviewed by the Agape clinical team.
Key takeaways
- 42 CFR Part 2 protects substance use disorder treatment records at a federally assisted program. HIPAA protects most other health information.
- Part 2 is stricter than HIPAA. Part 2 requires explicit written consent for most disclosures, even for treatment, payment, and healthcare operations where HIPAA would permit it.
- Part 2 applies to the records, not to the person. Your depression records are HIPAA; your alcohol use disorder records are Part 2 — and the protection follows the records when they are shared.
- The same consent cannot be used to release both Part 2 and HIPAA records. The two regulations require separate consent forms with different content and different expiration rules.
- If you are in SUD treatment and you sign a release, ask which records the release covers and which regulation governs the release.
TL;DR
42 CFR Part 2 protects substance use disorder treatment records more strictly than HIPAA. Part 2 applies to federally assisted SUD treatment programs; HIPAA applies to most other health information. The two coexist, and the same person's records can be governed by Part 2 for SUD treatment and HIPAA for everything else.
If you have been reading about health-records privacy, you have probably encountered both 42 CFR Part 2 and HIPAA, and you may have come away confused about which one protects which records and at what level of strictness. The two coexist, and the same person’s records can be governed by Part 2 for substance use disorder (SUD) treatment and HIPAA for everything else. Knowing which regulation applies tells you what your consent actually permits.
Here is the side-by-side comparison.
What each regulation protects
| 42 CFR Part 2 | HIPAA | |
|---|---|---|
| Full name | Confidentiality of Substance Use Disorder Patient Records | Health Insurance Portability and Accountability Act Privacy Rule |
| Year enacted | 1975 (revised 2017, 2020, 2024) | 1996 (Privacy Rule 2003) |
| What it protects | Records held by a federally assisted substance use disorder treatment program | Most individually identifiable health information held by a covered entity |
| Who it applies to | Any SUD treatment program that holds itself out as providing SUD treatment and is federally assisted | Health plans, healthcare clearinghouses, and most healthcare providers |
| Level of strictness | Stricter than HIPAA | Baseline federal health-records privacy |
The two are not mutually exclusive. A federally assisted SUD treatment program is subject to both Part 2 and HIPAA. Part 2 wins where the two conflict.
Where the two overlap
The same person can have records governed by both regulations, often at the same provider. Consider a client at Agape who is being treated for both alcohol use disorder and major depressive disorder:
- The alcohol use disorder records are Part 2. They cannot be released without explicit written consent, except in narrow circumstances.
- The depression records are HIPAA. They can be released for treatment, payment, and healthcare operations without explicit consent, though most providers still ask.
The two record sets live in the same chart at Agape, and the clinical team uses both, but the legal rules that govern their release are different. When a release form is presented to the client, it has to specify which records the release covers and which regulation governs the release.
Where Part 2 is stricter than HIPAA
The three places where Part 2 is materially stricter than HIPAA are:
1. Disclosure for treatment, payment, and healthcare operations. HIPAA permits these disclosures without explicit consent. Part 2 requires explicit written consent for most disclosures, even for treatment, payment, and healthcare operations.
2. Re-disclosure. HIPAA permits a recipient of records to re-disclose them, subject to the recipient’s own HIPAA obligations. Part 2 prohibits re-disclosure of Part 2 records except with the patient’s separate written consent. The Part 2 protection follows the records.
3. Court-ordered disclosure. HIPAA permits disclosure in response to a court order, subpoena, or other judicial process, subject to certain conditions. Part 2 permits disclosure in response to a court order only in very specific circumstances, with strong protections against further disclosure, and only after the court has made specific findings.
Where the two permit the same disclosures
Both Part 2 and HIPAA permit disclosure without the patient’s consent in a narrower set of circumstances:
- Medical emergency. If the patient is incapacitated and another provider needs the information to treat them.
- Crimes on program premises or against program staff. Both regulations carve out an exception for serious crimes committed on site.
- Public health authorities. Both regulations permit disclosure to public health authorities for disease control and similar purposes.
- Health oversight activities. Both permit disclosure to health oversight agencies for audits, investigations, and inspections.
The Part 2 medical-emergency exception is narrower than the HIPAA medical-emergency exception, but the practical scope is similar.
How this affects you
If you are in SUD treatment and you sign a release form, three things are worth checking:
- Which records does the release cover? A release that covers “all my records” is broad; a release that covers “records from [specific program], for the period [date range], related to [specific treatment]” is narrow. Broader is not always better; narrower is often what you actually want.
- Which regulation governs the release? A release of Part 2 records must include specific Part 2 content; a release of HIPAA records follows HIPAA rules. The two cannot be combined into a single form.
- What is the expiration? Part 2 releases must include a specific expiration date or event. HIPAA releases can be open-ended but the practical expiration is governed by state law and by the recipient’s own policies.
If you are not sure which regulation applies to your records, ask the program that holds them. Any SUD treatment program that holds itself out as providing SUD treatment and is federally assisted is a Part 2 program and must tell you so.
What Agape does
Agape is a 42 CFR Part 2 program. We do not release information about your treatment without your written consent, except in the narrow circumstances the regulation allows. We will give you a copy of any consent form before you sign it. We will tell you, in plain language, what each consent lets us share and with whom.
If you have questions about how your information is handled before you call us, SAMHSA publishes a plain-language guide to Part 2 at samhsa.gov.
If you are ready to talk to someone, call us at (609) 242-0086. The intake call is confidential and free.
Sources
- SAMHSA: Applying the Substance Abuse Confidentiality Regulations (42 CFR Part 2) — the federal regulator’s plain-language guide
- HHS: The HIPAA Privacy Rule — for the contrast with general health-records privacy
- Legal Action Center: 42 CFR Part 2 — a nonprofit legal resource with plain-language summaries of Part 2
Frequently asked questions
- Is 42 CFR Part 2 the same as HIPAA?
- No. They are separate federal regulations that protect different records at different levels of strictness. Part 2 protects substance use disorder (SUD) treatment records at a federally assisted program. HIPAA protects most other health information. If you are in treatment for both depression and alcohol use disorder, your depression records are HIPAA, your alcohol use disorder records are Part 2.
- Which is stricter — 42 CFR Part 2 or HIPAA?
- Part 2 is stricter. HIPAA permits disclosure for treatment, payment, and healthcare operations without explicit consent. Part 2 requires explicit written consent for most disclosures, including for treatment, payment, and healthcare operations, with narrow exceptions for medical emergencies, qualifying court orders, and crimes on program premises.
- Can the same consent form cover both Part 2 and HIPAA records?
- No. Part 2 and HIPAA require separate consent forms with different content and different expiration rules. A release that covers your HIPAA records does not, by itself, cover your Part 2 records. If a provider hands you a single combined form, ask which records it actually covers.
- What happens if a Part 2 program shares my records without my consent?
- A Part 2 program that discloses your records without your written consent, outside the narrow exceptions the regulation allows, is in violation of federal law. The violation can carry civil and criminal penalties. You can file a complaint with SAMHSA, the federal regulator, and you can also pursue a private right of action under the regulation.
- How do I know if my records are Part 2 or HIPAA?
- Ask the program that holds the records. Any SUD treatment program that holds itself out as providing SUD treatment and is federally assisted is a Part 2 program and must tell you so. Your primary care doctor, your general hospital, and your non-SUD psychiatrist are HIPAA, not Part 2.
Continue reading
About the author
Written by the Agape clinical team. Agape Counseling Services is a 42 CFR Part 2 program offering state-approved outpatient substance use disorder treatment, individualized counseling, and anger management classes in Ocean County, NJ. Bilingual (English / Spanish) intake. Call (609) 242-0086 for a free, confidential intake.