Owner review: this page is published from verified source material and is waiting for Sharjeel Khan to approve it. It is not final marketing copy.
42 CFR Part 2 for clinics: consent, redisclosure, and what changed in 2024
Updated 2026-10-17
What the 2024 final rule changed
HHS published the Part 2 final rule on February 16, 2024, implementing section 3221 of the CARES Act and aligning parts of the rule with HIPAA. The rule was effective April 16, 2024. Persons subject to it were required to comply by February 16, 2026.
The operational change clinics feel first is the single TPO consent and the limited redisclosure that follows it. Breach notification and penalties were also aligned more closely with HIPAA. Records still cannot be used against the patient in legal proceedings without consent or a qualifying court order. This is a summary for operators, not a legal opinion.
How MASE talks about Part 2
Health OS workflows are designed around Part 2 and HIPAA obligations that apply to substance use disorder and health records: a human e-signature on overrides, two-staff inventory corrections with a separate approver, and decision-support alerts that do not replace a clinician.
That is a design description, not a certification. MASE does not claim that using Health OS makes a program compliant. A plain-language companion page is at https://www.mase.health/compliance.
Steps
Treat identity as protected
A Part 2 program generally cannot share information that would identify someone as having, or having had, a substance use disorder unless Part 2 permits it. Written consent, a listed exception such as a medical emergency, or a court order and subpoena are the usual paths. HIPAA consent rules are not a substitute.
Decide whether to use one TPO consent
The 2024 rule lets a patient sign a single consent for all future uses and disclosures for treatment, payment, and health care operations until the patient revokes it in writing. A program may still collect separate consents. A TPO consent is not mandatory.
Tell the patient what redisclosure means
A TPO consent has to warn that a recipient may redisclose the records and that they may no longer be protected by Part 2, and it has to state the consequences of refusing to sign. When a HIPAA covered entity or business associate receives the records under that consent, it may redisclose them as HIPAA allows, except for proceedings against the patient.
Keep proceedings against the patient on a separate track
Part 2 still prohibits using SUD patient records to investigate or prosecute the patient without written consent or a court order. A TPO consent does not open that door.
Do not send records through a marketing site
www.mase.health does not accept, store, or display patient records. Public forms and /api/ask are not a way to transmit a Part 2 record or to ask Eva about a patient.