42 CFR Part 2 and HIPAA: What NYS CASACs Get Wrong About Confidentiality

42 CFR Part 2 vs. HIPAA: What the 2024 Update Means for CASACs

Most CASAC training covers 42 CFR Part 2 and HIPAA back-to-back. Counselors walk out, treating them like one rule with two names. They are not the same rule. Part 2 is stricter than HIPAA in ways that change how you write a release and who you can talk to about a patient’s care. A 2024 federal update changed several of those rules again, and the deadline to comply already passed. If your release forms still look like they did in 2023, you have a problem, and so does the patient whose file you are holding.

Two Laws, One Common Mix-Up

HIPAA covers nearly all health information held by a covered provider or health plan. 42 CFR Part 2 only covers records from a program that gets federal assistance. That sounds narrow until you see what counts: Medicaid billing, a federal tax-exempt status, or a DEA registration to dispense methadone or buprenorphine. Almost every OASAS-certified program in New York meets that test through one of those three. If you work in licensed SUD treatment in this state, Part 2 almost certainly covers your program.

Both laws protect patient information. Only one of them was built around a specific fear. SUD records have a history of being used against patients in court, in custody fights, and in employment decisions.

That fear is the reason Part 2 goes further than HIPAA.

The difference in plain terms:

• HIPAA: broad coverage, fewer consent hurdles
• Part 2: narrow coverage, far more consent hurdles

What Part 2 Requires That HIPAA Does Not

HIPAA lets a provider use or share health information for treatment, payment, and health care operations without separate authorization for each disclosure. Part 2 has long required the patient’s written consent for most of that same activity.

Part 2 also requires:

• Strict limits on use in court
• A separate consent for SUD counseling notes
• No bundling a legal-proceeding consent with anything else
• Specific language on every release form

The court limit is the one most counselors underestimate. A prosecutor cannot subpoena a patient’s SUD record to build a case against them. A family court attorney cannot pull it for a custody fight. Both need a special court order under Part 2’s own rules or the patient’s written consent. HIPAA offers nothing close to that protection.

SUD counseling notes work the same way. These are the private notes a clinician keeps about a counseling session, separate from the official patient record. The 2024 update gave them their own lockbox, similar to how HIPAA treats a therapist’s psychotherapy notes. A patient has to sign a consent naming those notes specifically. The general treatment consent does not reach them.

HIPAA assumes disclosure unless told no. Part 2 assumes silence unless told yes.

What the 2024 Update Changed

The update traces back to the CARES Act, which told the federal government to align Part 2 with HIPAA. HHS finalized the rule in February 2024. Programs had until February 16, 2026, to comply. That date has already passed.

What changed:

• One consent now covers treatment, payment, and operations
• Recipients can redisclose records under HIPAA rules
• Breach notification now follows the HIPAA standard
• Penalties now match HIPAA’s civil and criminal structure
• Patients can request restrictions on disclosures
• SUD counseling notes got their own protected category

One piece survived untouched. A record disclosed under that single consent still cannot be used against the patient in a legal proceeding without separate consent or a court order. Law enforcement also still needs a special court order to use program records against a patient. The one narrow exception: a crime committed on program premises or against program staff. None of that changed.

The single consent change is the one that most programs felt right away. Before 2024, separate signatures for treatment, billing, and care coordination were common practice. Now one signed form can cover all three, as long as it names them. That is a real simplification. It is also exactly where the next mistake starts.

The update brought Part 2 closer to HIPAA. It did not make them follow the same rule.

Three Mistakes CASACs Keep Making

OASAS does not write a separate confidentiality rule for SUD programs. 14 NYCRR Section 822.8(o) just imports HIPAA and Part 2 directly into your program’s license. Break one of these federal rules, and you have broken your OASAS standard too.

Mistake one: treating the new single consent as a blanket release. A patient signs the treatment, payment, and operations consent at intake. A family member calls asking about an overdose. Staff treats the family’s request as covered because “the patient already signed something.” It is not covered. A request from family, an employer, or anyone outside that named TPO purpose needs its own purpose-specific consent. SUD counseling notes and legal-proceeding disclosures need their own consent too. Sign one form and treat it as universal, and you have broken Part 2 and broken 822.8(o) right along with it.

Mistake two: assuming Part 2 protection ends once a record is disclosed. It does not. Say a managed care company receives a patient’s record under the new redisclosure permission. It then forwards that record to a defense attorney building a case against the patient. That redisclosure is not allowed, even though the managed care company is a HIPAA-covered entity. The record can move through HIPAA channels, but a court still cannot use it against the patient without consent or an order. Get this wrong, and you have violated the same OASAS standard a second time.

Mistake three: disclosing on a release form with pre-2024 language. Plenty of programs are still using a template with the old “Notice Prohibiting Redisclosure” wording and nothing else. The updated rule added new required statements to every consent form, including language about potential redisclosure under HIPAA. A form missing them fails on its face, per 42 CFR 2.31. That means the disclosure it authorized was never protected under Part 2 or under your OASAS license.

How to Write a Compliant Release of Information

A valid Part 2 consent has to include a set of elements. Miss one and the form fails on its face.

Every release needs:

• Patient’s name
• Who is allowed to disclose
• What information, in exact terms
• Who receives it
• The purpose of the disclosure
• The right to revoke, and how
• An expiration date or event
• Signature and date

For a consent covering treatment, payment, and operations, add two more statements.

One: the record can be redisclosed under HIPAA once it’s received.

Two: What happens to the patient if they refuse to sign?

Pay attention to the information line. “Treatment records” is too vague to hold up. Name the actual record: intake assessment, toxicology results from a specific date, or progress notes from a specific date range. A patient has to know exactly what is leaving the building before they sign for it.

A release missing any of this is not a release. It is a liability sitting in the patient’s file.

Know Which Rule You’re Following

HIPAA and Part 2 will keep appearing together in your training and paperwork. Knowing exactly where they split is what keeps a release valid and a disclosure defensible months later, when someone asks you to produce it.

Educational Enhancement’s CASAC Section 4: Confidentiality and Legal Issues course breaks down Part 2, HIPAA, and the line between them for 9 NAADAC- and CASAC-approved hours. Start there.

To crush it on your counseling knowledge, this professional development course walks through Part 2, HIPAA, and the line between them.  When a disclosure call isn’t black-and-white, this 10-step ethical decision-making model can help. For what belongs in the record itself, this breakdown of documentation language
covers it. Start with the course.