42 CFR Part 2 and AI Tools: What SUD Programs Need to Know

If you run a federally assisted substance use disorder program, your records likely fall under 42 CFR Part 2, a federal rule that protects SUD patient records more tightly than standard HIPAA. Before you put those records into any AI tool, you need to know what changed in 2024 and what didn't.

This guide summarizes HHS's own Part 2 final rule fact sheet. It's a starting point for a conversation with your attorney, not a substitute for one.

What changed in the 2024 final rule

On February 8, 2024, HHS announced a final rule that aligned parts of Part 2 with HIPAA. Compliance was required by February 16, 2026. According to HHS, the rule:

• Allows a single consent for all future uses and disclosures for treatment, payment, and health care operations.
• Allows redisclosure under HIPAA by covered entities and business associates that receive records under that consent.
• Applies HIPAA breach notification requirements to breaches of Part 2 records.
• Aligns penalties with HIPAA's civil and criminal enforcement.
• Creates SUD counseling notes, a category of clinician notes analyzing a counseling session that are kept separately and need their own specific consent.
• Says segmenting Part 2 records is not required.
• Requires each consented disclosure to include a copy of the consent or a clear explanation of its scope.

What didn't change

Patients' SUD treatment records still can't be used to investigate or prosecute the patient without written consent or a court order. That protection matters a lot when you think about where AI vendors store data, who can request it, and what happens if a vendor gets a subpoena.

What this means for AI tools

Find out which tools touch Part 2 records. Admissions call tools, scribes, chart search, billing tools, and chatbots can all end up holding SUD information. An AI tool inventory is the first step.

Get the vendor terms in writing. A vendor that handles the records needs a Business Associate Agreement. Ask counsel what else your contract should say about Part 2, legal demands for records, and breach notice. Track it with a vendor BAA tracker.

Check consent scope before disclosures. With single TPO consent now allowed, staff still need to know what each patient actually agreed to. A tool can help a person check a request against the consent on file. See consent scope check before a disclosure.

Watch for counseling notes. If an AI scribe produces analysis of a counseling conversation, ask counsel whether that output is an SUD counseling note and where it should be kept. See the SUD documentation guide.

Be careful with reports. Aggregate reports can still identify people when counts are small. See small-count check before publishing a report.

Enforcement

HHS's Office for Civil Rights began accepting Part 2 complaints and breach notifications on February 16, 2026, according to its enforcement announcement. Patients can also file a complaint directly with HHS for an alleged Part 2 violation.

Questions to bring to your attorney

• Are we a Part 2 program, and which of our records are Part 2 records?
• Does our consent form match the 2024 rule?
• Which of our AI vendors hold Part 2 records, and do their contracts cover it?
• What happens if a vendor receives a legal demand for our records?
• Where should AI-generated session analysis be stored?

For the basics of PHI, de-identification, and BAAs, start with the PHI and BAA primer.