By Fisher, JD, CHC, CCEP

SAMHSA Revises Part 2 Re-Disclosure Notice Requirements

Key Takeaway. Recent updates to 42 CFR Part 2 affect the notice that must accompany disclosures of substance use disorder treatment records. The most practical change is the availability of a shorter re-disclosure notice that can be used more easily in electronic health record systems. At the same time, the notice requirement remains part of a broader confidentiality framework that limits how Part 2 information may be used and re-disclosed. Providers, health plans, contractors, intermediaries, and other lawful holders of Part 2 records should confirm that their consent forms, disclosure workflows, EHR templates, and downstream recipient notices reflect the current rules.

Background: Why the Re-Disclosure Notice Matters

Part 2 applies to records that identify a patient as having or having had a substance use disorder and that are maintained by a federally assisted substance use disorder program. For many clients, the key point is that Part 2 can impose stricter confidentiality obligations than HIPAA. Those obligations may follow the information after it leaves the originating program, which makes the re-disclosure notice an important operational and compliance tool.

Under the 2017 revisions, disclosures made with patient consent had to include a written warning explaining that the information was protected by federal confidentiality rules and generally could not be further disclosed unless Part 2 or the patient’s written consent allowed it. In practice, that required language was difficult to fit into common electronic transmission formats, creating challenges for providers, health information exchanges, and other organizations that routinely share patient information electronically.

The 2018 Final Rule: Abbreviated Notice Option

The 2018 Final Rule responded to that problem by allowing an abbreviated notice suitable for standard free-text fields in health care electronic systems. The abbreviated notice stated: “42 CFR part 2 prohibits unauthorized disclosure of these records.” This change made compliance easier to operationalize, but it did not loosen the underlying restriction on unauthorized re-disclosure. Organizations should therefore treat the shorter notice as a formatting option, not as a substantive expansion of permitted uses or disclosures.

Current Rule: Notice and Copy of Consent to Accompany Disclosure

Current § 2.32 requires disclosures made with the patient’s written consent to be accompanied by both the required notice and either a copy of the consent or a clear explanation of the scope of the consent. The notice may be provided through the longer regulatory statement or the shorter statement that “42 CFR part 2 prohibits unauthorized use or disclosure of these records.” Clients should make sure their systems consistently attach the appropriate notice and provide recipients with enough information to understand the scope of the patient’s consent.

Practical Implications for Covered Entities, Part 2 Programs, and Lawful Holders

The abbreviated notice is useful, but it should not be read as permission to freely re-disclose Part 2 records. Organizations that receive Part 2 information should evaluate the basis for the disclosure, the scope of the patient’s consent, the recipient’s role, and the purpose of any proposed use or disclosure. This analysis is especially important when information may be used for treatment, payment, or health care operations, or when records could be sought in connection with a civil, criminal, administrative, or legislative proceeding involving the patient.

Recommended Compliance Steps

• Update consent workflows. Confirm that Part 2 consents include the required elements and clearly describe the recipients, information to be disclosed, purposes of disclosure, and scope of any permission for future use or disclosure.
• Review EHR and HIE templates. Make sure electronic disclosure templates include an approved Part 2 notice in a location that downstream recipients are likely to see.
• Train workforce members. Reinforce that the shorter notice does not relax Part 2’s substantive limits on use or re-disclosure.
• Assess downstream recipient obligations. Confirm that contractors, subcontractors, intermediaries, covered entities, business associates, and other lawful holders understand when they may use or re-disclose Part 2 records.
• Coordinate Part 2 and HIPAA compliance. Evaluate how Part 2’s consent and re-disclosure rules apply alongside HIPAA permissions, particularly for treatment, payment, and health care operations.
• Document implementation decisions. Keep records showing which notice language is used, where it appears in electronic systems, and how the organization communicates Part 2 restrictions to recipients.

Bottom Line

The revised § 2.32 notice requirement is intended to preserve Part 2’s strong confidentiality protections while making electronic information exchange more workable. For clients, the practical takeaway is straightforward: the shorter notice can ease implementation, but it does not replace the need for careful consent management, system configuration, recipient education, and documentation of Part 2 compliance decisions.