Navigating 42 CFR Part 2 (Part 2) can be challenging for healthcare providers that diagnose or treat patients with a substance use disorder (SUD). Understanding whether your organization is subject to Part 2 and to what extent it must comply is a critical first step, especially since revised regulations take effect on February 16, 2026.
Part 2 establishes strict federal confidentiality rules for SUD records that Part 2 Programs create or receive (Part 2 Records). These rules apply both to providers that operate as “Part 2 Programs” and to “lawful holders” of Part 2 Records.
Note: I use the terms “provider” and “healthcare provider” broadly to include healthcare organizations, practices, facilities, and solo practitioners. When referring to individual clinicians or staff within an organization, I use the terms “medical personnel” or “other staff.”
Part 2 Program v. Lawful Holder
Providers should begin by assessing whether they qualify as a Part 2 Program, a lawful holder or neither. Both Part 2 Programs and “lawful holders” have compliance responsibilities under Part 2, but the scope of those obligations differs.
Part 2 Programs must adopt a complete Part 2 compliance infrastructure. By contrast, lawful holders are not subject to the full scope of Part 2, but they must protect the confidentiality of those records in compliance with Part 2. A provider that does not provide SUD diagnosis, treatment or referral services (SUD Services) and never receives Part 2 Records has no obligations under Part 2.
What’s a Lawful Holder?
Any individual or organization that obtains Part 2 Records with the consent of the patient or pursuant to an exception to consent requirements is a “lawful holder” under Part 2. This includes a primary care provider who receives Part 2 Records from a Part 2 Program.
What’s a Part 2 Program?
Not every provider that provides SUD Services is a Part 2 Program. The determination depends on whether the organization, unit within an organization or clinician (solo practitioner or medical personnel) is “federally assisted” and meets the regulatory definition of a “program” under 42 CFR §2.11.
Is the Provider Federally Assisted?
Most providers meet this test. A provider is federally assisted if it:
- Receives Medicare or Medicaid reimbursement;
- Holds a federal license or registration;
- Receives federal funding, including HRSA grants or other federal financial assistance; or
- Has tax-exempt status from the IRS.
Because these categories are broad, most providers that provide SUD Services satisfy the federal assistance requirement.
Does the Provider Meet the Definition of a “Program”?
The more complicated analysis is whether the provider qualifies as a “program.” According to Substance Abuse and Mental Health Services Administration (SAMHSA) guidance and federal regulations:
- If a provider is nota general medical care facility, then the provider meets Part 2’s definition of a “program” if it is an individual or entity that holds itself out as providing, and provides alcohol or drug abuse diagnosis, treatment or referral for treatment.
- If the provider is an identified unit within a general medical care facility, it is a “program” if it holds itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment or referral for treatment.
- If the provider consists of medical personnel or other staff in a general medical care facility, it is a program if its primary function is the provision of alcohol or drug abuse diagnosis, treatment or referral for treatment and is identified as such specialized medical personnel or other staff within the general medical care facility.
See https://www.samhsa.gov/about/faqs/confidentiality-regulations (FAQ #10) (last visited 9/8/2025)
What Qualifies as a General Medical Facility?
The term is not defined in Part 2, but guidance from SAMSHA provides some clarity. On its website, SAMSHA identifies hospitals, trauma centers, federally qualified health centers, and primary care practices as “general medical facilities.”
As noted above, in a general medical facility, only an identified unit or individual provider whose primary function is substance use disorder diagnosis, treatment, or referral may qualify as a Part 2 Program. When less than the entire organization qualifies as a Part 2 Program, administrative controls must be in place to protect Part 2 Records internally.
What Does “Holding Itself Out” Mean?
SAMHSA interprets “holding out” broadly. A provider may be considered a Part 2 Program if it signals to patients or the public that it provides SUD Services, for example, through:
- Licenses or certifications in addiction medicine
- Advertisements, brochures, or website statements
- Inclusion in treatment directories or registries
- Information presented to patients and families
Using the above guidance from SAMSHA, providers can determine whether they qualify as a Part 2 Program.
Conclusion
Determining whether your organization is a Part 2 Program, a lawful holder, or outside the scope of Part 2 is the foundation of Part 2 compliance. With the revised regulations becoming enforceable in February 2026, providers should not delay in assessing their status and preparing the appropriate policies, procedures, and safeguards.
Join our HIPAA Helpline session on October 14, 2025 at 1pm ET – 42 CFR Part 2 Compliance Countdown: Key Steps Before the February 2026 Deadline
Registration Link: https://us06web.zoom.us/meeting/register/6qeJ1Kr0RTelB3betHmW_g