42 CFR Part 2, and how we handle it

Last updated 23 July 2026

Substance use disorder treatment records carry protections that go beyond HIPAA. This page explains what that means in practice and exactly how HopeConnect enforces it, so you can judge whether our handling meets your standard.

What Part 2 covers

42 CFR Part 2 is the federal regulation governing the confidentiality of substance use disorder patient records held by federally assisted programs. Its central principle is that these records generally cannot be disclosed without the patient's specific written consent, and that consent identifies who the information may go to and for what purpose.

The reason for the stricter standard is practical rather than bureaucratic. People avoid treatment when they fear that seeking help will expose them to employment, custody, housing, or criminal consequences. The regulation exists so that seeking treatment is safer.

Why it is stricter than HIPAA

HIPAA permits many disclosures for treatment, payment, and healthcare operations without separate patient authorization. Part 2 does not work that way for the records it covers. Consent is generally required, it is specific rather than general, and redisclosure by the recipient is itself restricted.

For referral coordination this matters enormously, because a referral is by definition a disclosure from one organization to another. A coordination system that treats a substance use referral like any other referral is not a convenience problem, it is a compliance failure with real consequences for a patient.

How HopeConnect enforces it

These are specific behaviors in the software, not policy statements:

• Consent is a blocking gate. Where Part 2 applies, a referral cannot be sent until consent is verified. The system stops the send rather than warning and allowing it.
• Consent is one of the readiness dimensions. It appears alongside benefit, assessment, documents, and authorization in the Referral Workspace, so it is visible before anyone tries to send, not discovered at the point of failure.
• Records do not move without it. Documents attached to a Part 2 referral are governed by the same gate as the referral itself.
• Access is scoped. Being a participant on a case does not grant visibility into everything. Access follows role and organization.
• Everything is audited. Who accessed what and when is recorded, which is what allows you to answer a question about a disclosure after the fact.
• Data minimization by design. HopeConnect holds no chart, no progress notes, no medication list, and no diagnosis history. The less Part 2 data a coordination layer holds, the smaller the exposure.

What we do not claim