Substance Abuse Recovery Documentation (42 CFR Part 2)

Documentation Considerations for Substance Use Disorder Treatment

Substance use disorder treatment records receive the highest level of confidentiality protection in the U.S. healthcare system. The federal regulation 42 CFR Part 2, originally enacted in 1975 and significantly amended in 2024, exists because the stigma associated with substance use disorders creates a concrete barrier to treatment — people will not seek help if they fear their employer, insurer, or law enforcement will learn about their treatment.

For clinicians, this means that documenting SUD treatment requires understanding a separate set of rules that operate above and beyond HIPAA. Violations carry criminal penalties. Even well-intentioned disclosures — sharing information with a client's primary care physician, responding to an insurance company's request, or reporting to a probation officer — can violate Part 2 if proper consent was not obtained.

When You Need Population-Specific Documentation

Part 2-compliant documentation practices are required when:

• You provide SUD diagnosis, treatment, or referral in any federally assisted program (which includes most clinical settings)
• Your practice is federally assisted — you accept Medicare or Medicaid, operate in a tax-exempt facility, hold DEA registration for MAT, or receive any federal funding
• You are coordinating care with medical providers, psychiatrists, or other mental health professionals for a client with SUD
• A court, probation officer, or attorney requests SUD treatment records
• You are treating a co-occurring disorder and SUD information is documented alongside mental health treatment information
• Your client is receiving medication-assisted treatment (MAT) such as buprenorphine, methadone, or naltrexone

Key Components — What to Document Differently

Consent for Disclosure

Part 2 consent is more specific than HIPAA authorization. A valid Part 2 consent must include:

• The name of the patient
• The specific person or entity permitted to make the disclosure
• The specific person or entity to whom disclosure is authorized
• The purpose of the disclosure
• How much and what kind of information will be disclosed
• A statement that the patient may revoke consent at any time (except to the extent that action has already been taken)
• The date, event, or condition upon which the consent expires
• The signature of the patient and the date signed

Document that consent was obtained using a Part 2-compliant form, and keep the signed consent in the chart.

Segregation of SUD Records

In practices that treat both mental health and substance use disorders:

• Consider how SUD information is stored — many EHR systems allow segmentation of SUD records behind additional access controls
• Be careful about what flows into shared treatment notes — if you have a client with depression and alcohol use disorder, the depression information is governed by HIPAA, but the SUD information is governed by Part 2
• When sending records to other providers, you may need to send only the mental health portion without the SUD portion, unless the client has signed a Part 2-specific consent

Clinical Documentation Content

SUD treatment notes should include:

• Substance use assessment — substances used, route of administration, frequency, quantity, duration of use, date of last use, withdrawal history
• Level of care determination — reference ASAM criteria dimensions and the rationale for the recommended level of care
• Screening and assessment tools — AUDIT, DAST, CAGE, ASAM criteria, urine drug screen results
• MAT documentation — medication prescribed, dose, prescriber, adherence, side effects, diversion risk assessment
• Recovery support — mutual aid involvement (AA, NA, SMART Recovery), recovery housing, peer support, sober social activities
• Relapse prevention — triggers identified, coping strategies, relapse prevention plan

Best Practices

Mark every SUD treatment document with a Part 2 notice. Include language such as: "This record is protected by 42 CFR Part 2. Federal law prohibits unauthorized disclosure of these records." This puts anyone who receives the record on notice of the heightened protections.

Use Part 2-compliant consent forms. Standard HIPAA authorization forms do not satisfy Part 2 requirements. Develop or obtain consent forms that include all required Part 2 elements. Review them with legal counsel.

Understand the 2024 amendments. The CARES Act and the 2024 final rule made significant changes to Part 2, including allowing redisclosure for treatment, payment, and healthcare operations after initial consent. Stay current on these changes — they affect daily practice.

Document level of care decisions using ASAM criteria. The ASAM criteria are the standard framework for SUD level-of-care determination. Document which dimensions were assessed, the findings, and how they support your recommended level of care.

Track sobriety milestones and screen regularly. Document the date of last use, current sobriety length, and screening tool results at regular intervals. This creates a longitudinal clinical record that supports treatment planning and medical necessity.

Common Mistakes

Treating Part 2 records like regular HIPAA records. The most dangerous mistake is assuming that standard HIPAA rules apply to SUD records. They do not. Disclosing SUD treatment information without Part 2-compliant consent — even to the client's own primary care physician — is a federal violation.

Failing to segregate SUD information in co-occurring disorder treatment. If a client has depression and alcohol use disorder, sending the full chart to a provider who only needs the depression information may inadvertently disclose Part 2-protected SUD information. Plan your documentation structure to allow separation when needed.

Not knowing whether Part 2 applies to your practice. The definition of "federally assisted" is broad. If you treat SUD in any capacity, consult a healthcare attorney to determine whether Part 2 applies. Assuming it does not is not a defense.

Using non-compliant consent forms. A generic release of information form that says "I authorize disclosure of my medical records" does not satisfy Part 2. The consent must be specific about who, what, why, and when.

Disclosing to probation without proper authorization. Even when a client is court-ordered to attend SUD treatment, you cannot disclose treatment information to a probation officer without either a Part 2-compliant consent or a court order that meets Part 2's specific requirements for court orders (which are stricter than a general subpoena).

Overlooking the redisclosure prohibition notice. When you disclose Part 2-protected information with proper consent, you must include a notice that prohibits the recipient from further disclosing the information except as permitted by the regulation. Failure to include this notice is a violation.