42 CFR Part 2: The Confidentiality Rule Behind a Behavioral Health Phone Line

Most practices know HIPAA governs the phone. Fewer know that a second federal rule, older and in some ways stricter, sits on top of it for one category of care — and that it was substantially rewritten in 2024.

What Part 2 is

42 CFR Part 2 — "Confidentiality of Substance Use Disorder Patient Records," authorized by 42 U.S.C. 290dd-2 — protects records that would identify a person as someone who has, or has had, a substance use disorder, when that information was created by a federally assisted "part 2 program" for the purpose of diagnosis, treatment, or referral (see the applicability rules at 42 CFR 2.12).

A "part 2 program" is, roughly, a program or identified unit that holds itself out as providing, and does provide, substance use disorder diagnosis, treatment, or referral for treatment — and receives federal assistance, which is defined broadly enough to cover most programs. A general therapy or psychiatry practice that occasionally refers a patient to treatment is usually not a part 2 program. A methadone clinic, an addiction medicine practice, or a substance use IOP generally is.

The key point for anyone answering the phone: under Part 2, the mere fact that someone is a patient of a part 2 program is protected. A call in which an answering service hears "I'm a patient at your clinic" has received Part 2-protected information.

The consent rule, and how 2024 changed it

Historically, Part 2 required a specific written patient consent for most disclosures — narrower and more demanding than HIPAA's treatment-payment-operations framework, and a frequent source of friction in coordinated care.

The 2024 final rule (published February 16, 2024; compliance required by February 16, 2026), issued by HHS through SAMHSA and the Office for Civil Rights under the CARES Act, aligned Part 2 more closely with HIPAA. The main changes:

• A single patient consent can now authorize all future uses and disclosures for treatment, payment, and health care operations, rather than a separate consent per disclosure.
• Breach notification and HHS enforcement for Part 2 now track the HIPAA model, including civil money penalties.
• New patient rights were added, including the right to an accounting of disclosures and the right to request restrictions.
• Longstanding protections remain: limits on redisclosure, the notice that must accompany disclosed records, and the rule that Part 2 records generally cannot be used against the patient in a legal proceeding without a court order.

The consent requirements themselves are at 42 CFR 2.31.

What this means when a third party answers the phone

If your practice is a part 2 program and an answering service takes patient calls, that service is handling Part 2 records on your behalf. Before the first call routes, you should have:

A BAA that acknowledges Part 2, not just HIPAA. After the 2024 rule, Part 2 obligations flow to business associates. A generic HIPAA BAA that never mentions Part 2 is a gap. The agreement should make clear the service is bound by Part 2's restrictions on use and redisclosure.

The consent flow reflected in the intake script. If your admissions process relies on a single TPO consent, the questions the agent asks — and what the agent is permitted to write in a message or say on a callback — should be built around what that consent actually authorizes. This is a reason to design the script with the service.

The same protection on the call record itself. The recording, the message, and the log are Part 2 records. Ask how they're stored, who can access them, how long they're retained, and what redisclosure notice attaches when any of it is shared.

A clear answer on subcontractors. Every subcontractor that could encounter the call — an overflow partner, a recording vendor — needs to be under terms at least as protective. Ask for the list.

If you're not a part 2 program

Most outpatient mental health practices aren't. Part 2 may not apply directly to your records — but two things still hold. First, HIPAA applies regardless, so the BAA, the minimum-necessary script, and the subcontractor questions are still the baseline. Second, if you document substance use counseling or make treatment referrals, treat that information with Part 2-level care even where the rule doesn't strictly compel it; it is the category of information most likely to cause harm if mishandled.

The checklist

• Determine whether your practice meets the definition of a part 2 program.
• If it does: a BAA that names Part 2 and its redisclosure limits, in place before any call routes.
• An intake script built around what your patient consent actually authorizes.
• Written confirmation that recordings, messages, and logs get Part 2-level storage, access control, and retention limits.
• The subcontractor list, with confirmation each is bound to equivalent terms.
• Confirmation the service is operating to the February 16, 2026 compliance baseline.

The takeaway

HIPAA is the floor. For substance use disorder treatment, Part 2 is the rule that decides what a service can write down, say on a callback, and pass to whom — and the 2024 changes made the consent side easier while making enforcement real. Get the BAA and the script right against Part 2 before go-live, not during an investigation.

This is general information, not legal advice — confirm specifics with your compliance counsel. VoxBrook signs BAAs for regulated healthcare clients and puts one in place before any call routes. See Behavioral Health answering or talk to our team.