42 CFR Part 2 and Salesforce: What Substance Use Treatment Providers Need to Know

Substance use disorder treatment providers handle some of the most sensitive health information there is. Federal regulation 42 CFR Part 2 sets confidentiality rules for these records that go beyond HIPAA in important ways. A significant update finalized in 2024 changes how those rules work, and providers must comply by February 2026. If your admissions, CRM or communication systems touch SUD records, now is the time to review them.

This article is general guidance, not legal advice. Work with qualified counsel to determine how Part 2 applies to your organization.

What Part 2 covers

Part 2 applies to federally assisted programs that hold themselves out as providing SUD diagnosis, treatment or referral for treatment, and to certain recipients of records from those programs. It restricts the use and disclosure of patient records, generally requiring patient consent, and limits how records can be used against patients in legal proceedings.

Key changes in the 2024 final rule

• Single consent for TPO. Patients can give one consent covering all future uses and disclosures for treatment, payment and health care operations, instead of separate consents for each disclosure.
• Redisclosure. HIPAA-covered entities and business associates that receive records under that consent may generally redisclose them as HIPAA permits, with important exceptions such as use in proceedings against the patient.
• SUD counseling notes. A new category of notes requiring separate, specific consent.
• Patient notices and rights. Updated notice requirements and rights aligned more closely with HIPAA.
• Breach notification and penalties. Breach notification requirements and civil and criminal penalties now apply in a way that mirrors HIPAA.

Dates to know

What this means for your CRM and systems

• Consent tracking. Record each patient’s Part 2 consents, their scope, date, expiry and revocation, in a structured way that automation can check.
• Labeling. Identify which records and fields contain Part 2-protected information.
• Access control. Restrict Part 2 data to staff who need it, using sharing rules, field-level security and permission sets.
• Disclosure controls. Make sure integrations, reports and exports only share Part 2 information where consent and the rule allow.
• Notices on disclosure. Include required notices when records are disclosed.
• Audit. Log access and disclosures of Part 2 records.

Practical steps before February 2026

1. Map where SUD information lives: admissions CRM, EHR, billing, messaging and analytics.
2. Update consent forms and processes with counsel, including the single TPO consent option.
3. Add structured consent records and enforce them in automation and integrations.
4. Review access and sharing for Part 2 data.
5. Update notices of privacy practices and breach procedures.
6. Train staff on the changes.

We build admissions and patient engagement systems for behavioral health providers with consent and access controls designed in; see our industry solutions.

Frequently asked questions