As jails and prisons expand treatment for substance use disorder (SUD) — including medications for opioid use disorder — more correctional health programs find themselves holding records protected by 42 CFR Part 2. Part 2 is a federal regulation that places confidentiality protections on SUD treatment records that are stricter in some respects than HIPAA. Understanding when it applies, and building it into everyday workflows, is now part of running a correctional health program.
What 42 CFR Part 2 is
Part 2 implements a federal statute protecting the confidentiality of records that identify a person as having or having had a substance use disorder, when those records are created by a covered program. Its purpose is to make sure people are not deterred from seeking treatment by fear that their records will be used against them.
In 2024, the U.S. Department of Health and Human Services issued a final rule that aligned Part 2 more closely with HIPAA — for example, allowing a single patient consent for future uses and disclosures for treatment, payment and health care operations, and applying HIPAA-style breach notification to Part 2 records. The rule also strengthened protections against using these records in legal proceedings against the patient. Programs should confirm the current compliance requirements with counsel.
When it applies in a correctional setting
Part 2 generally applies to "programs" that hold themselves out as providing SUD diagnosis, treatment or referral for treatment and that are federally assisted. Federal assistance is interpreted broadly; for example, DEA registration to dispense controlled substances used in SUD treatment can qualify. A correctional health program that runs an identified SUD treatment unit or a medications-for-opioid-use-disorder program may therefore be covered, while general medical care in the same facility may not be.
Because the answer depends on how a specific program is organized and funded, many correctional health teams work with counsel to identify exactly which services and records fall under Part 2.
Consent and disclosures
The core rule is that Part 2 records may not be disclosed without the patient's written consent, unless a specific exception applies. Exceptions include medical emergencies, certain research and audit activities, and disclosures authorized by a qualifying court order. Part 2 also contains provisions addressing disclosures to elements of the criminal justice system when a patient's participation in treatment is a condition of their case — those disclosures still depend on a properly executed consent.
Two points matter especially in corrections:
- Custody staff are not automatically entitled to SUD records. Sharing with security or classification staff requires a basis under the regulation.
- Records may not be used to investigate or prosecute the patient without meeting the regulation's strict court-order requirements.
How Part 2 relates to HIPAA
Most correctional health programs are already familiar with HIPAA. Part 2 does not replace it; where both apply, programs generally need to satisfy both, and Part 2 is more restrictive in important ways. The 2024 rule narrowed some differences — for example in consent for treatment, payment and health care operations and in breach notification — but key protections remain specific to Part 2, including limits on redisclosure by certain recipients and on use of records in proceedings against the patient. Training staff to recognize Part 2 information, rather than treating all records the same way, is essential.
Transfers and reentry
Hand-offs are where Part 2 compliance is most often tested. When a patient in an SUD treatment program transfers to another facility or is released, continuity of treatment — particularly for medications for opioid use disorder — is clinically important, but the record can only be shared on a permitted basis. Programs should plan ahead:
- Discuss consent for sharing with the receiving facility or community treatment provider early in the stay, not on the day of release.
- Make sure consent forms name the right recipients and purposes for reentry.
- Confirm how disclosures through an HIE are handled for Part 2 information.
How an EHR can help
Policy sets the rules; software makes them practical to follow every day. Capabilities that support Part 2 compliance include:
- Record segmentation and flags that identify Part 2 information so it is handled differently from general medical records.
- Role-based access that limits who can see SUD records, with clear separation between clinical and custody roles.
- Consent management that records what a patient has authorized, for whom and for how long — and checks it before data is shared.
- Disclosure notices and audit trails that attach required language to disclosures and log who accessed or released what.
- Controlled exchange with HIEs and community providers that respects consent at reentry.
Questions to ask your team
- Which of our services and records are covered by Part 2?
- Do our consent forms and notices reflect the current rule?
- Can custody or classification staff see any SUD information today, and on what basis?
- How do we handle Part 2 records at transfer and release?
- Can we produce an audit trail of access and disclosures if asked?