42 CFR Part 2
42 CFR Part 2 is the federal confidentiality rule that controls how substance use disorder treatment records are used and disclosed, separate from and stricter than HIPAA. The rule sets conditions for sharing SUD information with payers, courts, family, and other providers, and violations carry legal and financial risk.
What it means
What 42 CFR Part 2 is
42 CFR Part 2 is a federal confidentiality regulation that protects records created by substance use disorder programs that receive federal assistance. It governs when and how information that identifies a patient as having or seeking SUD treatment can be used or disclosed.
The rule sits alongside HIPAA but is separate and generally more restrictive. It requires specific patient consent for most disclosures, sets limits on redisclosure, and has its own penalty structure. For behavioral health organizations, SUD charts, notes, and even some billing details can fall under Part 2 if they would identify a patient as having a substance use disorder.
Recent updates have moved Part 2 closer to HIPAA for treatment, payment, and health care operations, but many legacy requirements and sensitivities remain. You still need clean consent processes and clear rules about what can be sent to payers, auditors, and other providers.
Why 42 CFR Part 2 matters operationally
Part 2 directly affects how you share documentation with payers for prior authorization, concurrent review, audits, and appeals. If you send too much, you risk a confidentiality violation and fines. If you send too little, you risk denials for lack of documentation, recoupments after audits, or stalled authorizations.
Operationally, you need clear segmentation of SUD records in your EHR and document management, consent workflows that are easy to follow, and payer documentation packets that respect Part 2 while still proving medical necessity. Improvising here leads to either over-disclosure risk or under-disclosure that costs you days in AR and write offs.
Part 2 also affects how you structure releases of information to family members, employers, schools, and the justice system. Front desk and UR staff need simple rules so they do not give a payer or court broader access than the law allows.
How 42 CFR Part 2 is used and read in RCM
In revenue cycle, you use Part 2 as the guardrail for what SUD-related information can go to:
- Payers and utilization review vendors for prior auth, concurrent review, and retrospective audits
- Clearinghouses and billing vendors that see detailed claims or remits
- Outside providers involved in care coordination or step downs
RCM leaders should understand the key building blocks in the regulation: what counts as a Part 2 program, what counts as an identifying record, what a valid consent form must include, and when disclosures without consent are allowed. You do not need to memorize legal text, but you do need a documented standard that tells staff what may go to a payer and what must stay behind.
Most organizations translate Part 2 into policies that cover: consent language, EHR flags for SUD charts, rules for redacting progress notes sent with auth requests, and escalation steps when a payer or auditor asks for full records. Those policies should be reviewed whenever SAMHSA updates the rule or a state substance abuse agency tightens requirements.
Common mistakes
- Treating all behavioral health records as Part 2 and refusing to send any detailed notes to payers for SUD concurrent review, which leads to CO-16 style denials for missing information and avoidable write offs on high per diem residential stays.
- Blending SUD and non SUD documentation into a single note in the EHR, so staff cannot pull a clean packet for a Medicaid MCO auth request without either over disclosing or under documenting medical necessity.
- Using a generic HIPAA release in intake packets and assuming it covers Part 2, only to find out during an audit or appeal that the payer never had valid consent to see specific SUD information.
- Letting utilization review or billing staff email SUD records to payer reps without checking whether the consent includes the payer's UM vendor or pharmacy benefit manager, which can create an unauthorized redisclosure problem.
- Ignoring carve out behavioral health vendors' specific documentation language about SUD services, then having to scramble with redactions and addenda when their audit contractor demands full charts on a short deadline.
Why it matters in behavioral health
Behavioral health organizations feel 42 CFR Part 2 more than anyone else, because SUD treatment is often carved out to separate vendors and subject to tighter state rules. Each SUD program that meets the definition of a Part 2 program must treat its records as specially protected, even if the rest of the facility runs under standard HIPAA rules.
Long episodes like residential, PHP, and IOP with per diem rates are particularly exposed. Payers and state Medicaid MCOs often demand detailed clinical records for initial and continued stay reviews. If your SUD content is intertwined with non SUD mental health notes, your UR team will either send more SUD information than permitted or send so little that concurrent authorizations get cut short.
Carve out vendors and state substance abuse agencies may also have program standards and audit protocols on top of Part 2. For example, an OTP or withdrawal management unit may need to show very specific ASAM criteria documentation, but only portions of that can leave the facility without heightened consent. Your documentation model and redaction workflows need to anticipate these pulls so you do not blow up cash flow every time a state contractor asks for 25 SUD charts.
Medicaid managed care adds another layer, since UM is often handled by a subcontractor. If your Part 2 consents do not clearly include that entity, staff are stuck choosing between sending records to a non covered party or holding back and risking authorization and payment for the entire episode.
How AI can help with 42 CFR Part 2
AI can help with 42 CFR Part 2 by acting as a rule aware assistant that reads your notes and classifies content as SUD identifying or not, then building payer ready document packets that respect your policies. An agent can also track which payers and UM vendors are named on a patient's current consent, flag missing or expired consents at the time of auth submission, and suggest safe redactions before anything leaves your system.
Supabill's claims scrubbing and denials agents can hold payer specific documentation rules, see every 835 denial and CARC/RARC pattern, and point to where "missing info" denials are really Part 2 friction that needs a policy or template fix. A Supabill benefits verification or auth agent can also prompt front desk or UR staff when a SUD service is scheduled and the existing consent does not clearly cover the payer or carve out vendor. Humans still have to set your risk tolerance, sign off on consent language, and talk directly with payers or counsel when a tricky disclosure request comes in.
FAQ
Does 42 CFR Part 2 apply to all behavioral health records or only SUD treatment?
42 CFR Part 2 applies to programs that provide substance use disorder diagnosis, treatment, or referral to treatment and receive federal assistance. General mental health records that do not identify a patient as having or seeking SUD treatment are usually not covered by Part 2, although they are still protected by HIPAA and any state privacy laws.
Can a provider share SUD records with a payer for billing and prior authorization under Part 2?
Yes, but only under the conditions allowed by Part 2. You generally need a valid patient consent that names the payer or class of payers and describes what can be disclosed, and you must limit what you send to what is needed for payment or health care operations.
Is a standard HIPAA release form enough to disclose SUD records governed by 42 CFR Part 2?
Often it is not. Part 2 has its own consent requirements, including more specific description of the SUD information and who can receive it, so a generic HIPAA form may not cover what you need for SUD billing or utilization review.
How should RCM staff respond if a payer demands a full SUD chart without a clear consent?
RCM staff should pause and escalate to compliance or privacy leadership before sending any records. You may need to obtain or update a Part 2 compliant consent or negotiate with the payer for a narrower packet that supports medical necessity without disclosing unnecessary SUD details.
Do state substance abuse agency rules override 42 CFR Part 2?
States can create additional protections on top of 42 CFR Part 2, but they cannot reduce federal protections. Your program must follow the stricter rule between federal Part 2 and any applicable state SUD confidentiality laws.
Related terms
Prior authorization is a payer requirement to obtain approval before delivering specific services, confirming that planned care is medically necessary and covered under the member's benefit. Prior authorization is typically required for higher-cost, high-utilization, or ongoing treatment and is a common denial trigger when missing or expired.
Concurrent review is the payer's medical-necessity and authorization check that happens during an active episode of care, usually to decide whether to extend or stop approved days or units. In behavioral health it often controls continued coverage for inpatient, residential, PHP, IOP, and sometimes outpatient sessions.
A medical records request is a payer or auditor request for clinical documentation that supports a specific claim or set of services. The request is usually time bound and nonresponse can trigger denial, recoupment, or audit escalation.
A behavioral health carve-out is a health plan design where mental health and substance use benefits are administered and paid by a separate company or division instead of the main medical payer. Behavioral claims must be verified, authorized, and billed to the carve-out entity, not the medical plan, or they will deny.