42 CFR Part 2 for Research Administrators

42 CFR Part 2 is the federal regulation that governs confidentiality of substance use disorder (SUD) patient records held by a “Part 2 program” — any federally assisted entity that holds itself out as providing SUD diagnosis, treatment, or referral for treatment. Its statutory basis is 42 U.S.C. § 290dd–2. Most of what gets written about Part 2 online is aimed at treatment providers and health-information-management staff deciding what they can fax or release. This guide covers the angle that matters to a research administrator or IRB instead: when a study touches records from a Part 2 program — a secondary-use chart review, a data pull from an addiction-treatment EHR, a multi-site study with an SUD-treatment arm — Part 2 imposes a stricter, separate consent-and-redisclosure regime on top of, not instead of, the Common Rule and HIPAA.

What a “Part 2 program” is, and what the regulation protects

Part 2 covers any information that would identify a patient, directly or indirectly, as having applied for or received a substance use disorder diagnosis, treatment, or referral for treatment from a federally assisted program — not the patient’s entire medical record, and not substance use mentioned incidentally in an unrelated general-medical record. “Federally assisted” is defined broadly enough to sweep in most institutions relevant to research: it includes programs that are federally funded or licensed, and programs operated by an entity that receives federal funds even for unrelated purposes, or that is tax-exempt.

The regulation is organized into five subparts (confirmed against the current e-CFR text): Subpart A (Introduction, §§ 2.1–2.4), Subpart B (General Provisions, §§ 2.11–2.26), Subpart C (Consent-based disclosures, §§ 2.31–2.36), Subpart D (Uses and disclosures without patient consent, §§ 2.51–2.54), and Subpart E (Court-ordered disclosures, §§ 2.61–2.68). The research pathway that matters for this audience sits inside Subpart D.

The general rule: redisclosure is prohibited, not just restricted

Part 2’s core protection is a redisclosure prohibition, and it’s stricter than the HIPAA Privacy Rule’s downstream-use restrictions in a specific way: once Part 2 information is disclosed (with consent or under a Subpart D/E exception), the recipient is generally barred from redisclosing it further unless the original consent or exception permits that, and every disclosure historically had to carry a notice to that effect. This is why a Part 2-covered dataset can’t simply be treated like any other HIPAA-covered dataset once it leaves the originating program — the confidentiality obligation travels with the data to the next recipient, including a research team that receives it for secondary analysis.

Part 2 also restricts using patient-identifying information to initiate or substantiate any criminal charges against a patient, or to conduct any criminal investigation of a patient, without a specific court order under Subpart E — a protection with no direct HIPAA analog, and part of why Part 2 is described as materially stronger than HIPAA rather than a redundant overlay of it.

Research use without patient consent (Subpart D)

Subpart D is what makes secondary research use of Part 2 records possible without going back to every patient for individual consent. It lets a Part 2 program disclose patient-identifying information to qualified personnel for the purpose of conducting scientific research, provided the disclosure is made in accordance with the regulation’s research-disclosure requirements, and the researcher is bound by the redisclosure limits above — identifying information about a particular patient generally cannot appear in any resulting report or publication, and the data must be secured against unauthorized use.

For a research administrator, the practical implication is that a Part 2 research disclosure is not self-executing: it depends on the recipient qualifying as appropriate research personnel and being bound to the regulation’s confidentiality and security terms, typically documented through the same institutional review and data-governance channels — IRB protocol review, a data use agreement, or a comparable written commitment — that already govern the study’s human-subjects and data-security obligations. Part 2 doesn’t replace that review; it adds a stricter set of terms the review has to account for whenever the dataset includes SUD-treatment-program records. See CASRAI’s guide to retrospective chart review and IRB requirements for how that review process works generally, and the Data Use Agreement term for the instrument that typically carries the redisclosure restriction forward in writing.

The 2024 final rule: closer alignment with HIPAA, not a merger

A 2024 final rule (implementing changes required by the CARES Act) narrowed some of the historical gap between Part 2 and HIPAA without eliminating Part 2’s distinct protections. Confirmed changes include: patients can now give a single, general consent covering future uses and disclosures for treatment, payment, and health care operations, instead of needing a new consent for each recipient; Part 2 program breach-notification obligations were aligned with the HIPAA Breach Notification Rule; and patients gained a HIPAA-style right to request an accounting of certain disclosures and to request restrictions on disclosures for treatment, payment, and operations. The redisclosure prohibition, the criminal-proceedings protection, and the research-disclosure pathway in Subpart D were not converted into ordinary HIPAA treatment — a research team handling Part 2 data still has to satisfy Part 2’s terms specifically, in addition to whatever HIPAA authorization or waiver already covers the same dataset.

42 CFR Part 2 vs. HIPAA: what’s actually different

Scope. HIPAA covers protected health information broadly, for any covered entity. Part 2 covers only SUD-program records that would identify someone as a patient of that program — narrower in subject matter, but it applies even to programs and components that aren’t HIPAA covered entities at all.
Redisclosure. HIPAA generally permits further use consistent with the original authorization or a permitted purpose. Part 2 restricts redisclosure by the recipient more tightly, and ties an accompanying confidentiality notice to most disclosures.
Law enforcement and legal proceedings. HIPAA has several law-enforcement disclosure permissions. Part 2 specifically bars using patient-identifying information to investigate or prosecute a patient without a Subpart E court order — a much higher bar.
Research pathway. Both regimes have a research-specific disclosure route (HIPAA’s Privacy Board/IRB waiver under 45 CFR 164.512(i); Part 2’s Subpart D research provision) — they run in parallel and both have to be satisfied for a Part 2-covered research dataset, not one in place of the other.

CASRAI covers the HIPAA-specific mechanics separately — see HIPAA Privacy Rule and HIPAA in Clinical Research — and a Part 2-covered study commonly needs both a HIPAA authorization or waiver analysis and a separate Part 2 redisclosure/consent analysis, not just the first one.

42 CFR Part 2 vs. a Certificate of Confidentiality

These are frequently confused because both protect substance-use-related research data, but they operate at different points and come from different authorities. A Certificate of Confidentiality (CoC) is a protection NIH (or another federal funding agency) issues to a specific research project, shielding identifiable research data from compelled disclosure in legal proceedings, regardless of whether the underlying data ever touched a Part 2 program. 42 CFR Part 2 instead attaches to the SOURCE records themselves, by virtue of coming from a federally assisted SUD treatment program, independent of whether that specific research project has a CoC. A study can need one, the other, or both: a CoC protecting the study’s own dataset from subpoena, and Part 2 governing how the underlying SUD-program records could be obtained and used in the first place. See CASRAI’s Certificate of Confidentiality vs. Data Use Agreement comparison for how a CoC differs from the data-use-agreement mechanism that typically carries Part 2’s terms.

Practical steps for research administrators and IRBs

Identify Part 2 exposure early. Ask whether any data source is, or draws from, a program that holds itself out as providing SUD diagnosis, treatment, or referral — not just whether the study is “about” substance use.
Don’t assume a HIPAA waiver covers it. A 45 CFR 164.512(i) HIPAA waiver of authorization addresses HIPAA; it does not itself satisfy Part 2’s separate consent or research-disclosure requirements for the same dataset.
Put the redisclosure restriction in writing. A data use agreement or equivalent instrument should state that the recipient is bound by Part 2, may not redisclose the data except as the agreement permits, and may not use it to identify a specific patient in any resulting report.
Check the funding-source overlay separately. A dataset can be Part 2-covered, HIPAA-covered, and subject to a Certificate of Confidentiality all at once — each protection has its own trigger and its own paperwork; satisfying one does not satisfy the others.

Frequently asked questions

What is a “Part 2 program”?

Any individual or entity, federally assisted in the sense the regulation defines, that holds itself out as providing substance use disorder diagnosis, treatment, or referral for treatment, or that is an identified unit within a larger facility that does so, or medical staff whose primary function is providing that care within a general facility.

Is 42 CFR Part 2 stricter than HIPAA?

Yes, in the specific ways described above — principally its redisclosure prohibition and its bar on using records to investigate or prosecute a patient without a court order. It is not stricter across every dimension; HIPAA’s authorization and de-identification rules still apply independently to the same data.

Who has to comply with 42 CFR Part 2?

Part 2 programs themselves, and anyone who receives Part 2-covered patient-identifying information from one, including a research team, data repository, or health information exchange that receives it under a permitted disclosure — the redisclosure obligation follows the data to the next recipient.

Does a Part 2 research disclosure require patient consent?

Not necessarily. Subpart D permits disclosure to qualified researchers without individual patient consent, provided the disclosure and the researcher’s use of the data meet the regulation’s research-disclosure and confidentiality-security terms — but if consent is used instead, it must meet Part 2’s own consent-element requirements, which are more specific than a general HIPAA authorization.

How is this different from a Certificate of Confidentiality?

A Certificate of Confidentiality protects a specific research project’s identifiable data from compelled legal disclosure. 42 CFR Part 2 protects records because of where they originated — a federally assisted SUD treatment program — regardless of which project later uses them. See the comparison linked above for the full breakdown.

42 CFR Part 2: The Research Exception, Consent Rules, and How It Differs From HIPAA

Ask about 42 CFR Part 2: The Research Exception, Consent Rules, and How It Differs From HIPAA