Part 2 SUD records are substance use disorder treatment records protected by the federal confidentiality rule at 42 CFR Part 2, and new guidance from the HHS Office for Civil Rights now explains when state Medicaid agencies may use those records to verify that a person is excluded from Medicaid’s community engagement requirement. Federal law requires many adults aged 19 to 64 to log 80 hours a month of work, service or education to keep coverage, but people who are medically frail, including some individuals with a substance use disorder, are excluded. Agencies must verify exclusions using reliable information they already hold where possible. The guidance is addressed to the states. The pressure, however, falls on treatment programs, behavioral health practices and the health IT teams that serve them, because every verification depends on data the provider created. Five consent and data gaps tend to surface the moment those requests start.
Overview: Five Points Providers Should Act On
We have spent the past year helping behavioral health and primary care clients prepare for the revised Part 2 rule, and the Medicaid verification question sharpens the same five issues.
- Part 2 data must be identifiable inside your systems. If treatment notes, diagnoses and claims carrying SUD codes are mixed with ordinary records, you cannot apply the right rules to them.
- Consent has to be traceable to each disclosure. The revised rule allows a single consent for treatment, payment and health care operations, but you still need to show which consent covered which release.
- Redisclosure notices travel with the data. Records disclosed under Part 2 must carry the required notice, and manual processes miss it.
- Patients will ask what was shared. Accounting for disclosures is a patient right, and Medicaid verification adds a new category of recipient.
- OCR now enforces Part 2. Penalties and breach notification now look much more like HIPAA, so a Part 2 failure carries a familiar price.
Why Part 2 SUD Records Need Their Own Handling Rules
Part 2 SUD records need separate handling because federal law gives them stronger protection than ordinary protected health information, out of concern that disclosure could expose patients to arrest, job loss or discrimination. The 2024 final rule aligned many Part 2 provisions with HIPAA, with a compliance date in February 2026, but it did not make the two rule sets identical.
Which Records Fall Under Part 2
Part 2 applies to records from federally assisted programs that hold themselves out as providing SUD diagnosis, treatment or referral. A dedicated treatment program is clearly covered. A primary care clinic with an embedded addiction medicine team may be covered for that team’s records and not for the rest of the practice.
One view holds that a practice should treat every behavioral health record as Part 2 to stay safe. That approach is simple to explain and hard to break. The opposing view is that over-labeling slows care coordination and payment for records the rule never meant to restrict.
Both concerns are reasonable. Our recommendation is to make the scope decision deliberately, document it, and configure your electronic health record so the label follows the decision instead of the other way around. Our healthcare industry team sees this scoping question in nearly every behavioral health engagement.
How the 2024 Rule Changed Consent
Before the revision, consent had to name each recipient, which made routine coordination slow. The revised rule allows patients to sign a single consent covering future uses and disclosures for treatment, payment and health care operations.
Supporters say this finally lets SUD care sit inside normal workflows. Critics, including some patient advocates, worry that a broad consent signed at intake is easy to forget and hard to revoke in practice.
Neither side is wrong. For Medicaid verification, the open question raised by industry groups earlier this year was whether an existing single consent is enough for a state agency to rely on. Providers should read the OCR guidance alongside their own consent forms and confirm the language actually covers the disclosure being requested.
What the OCR Guidance Changes for Providers
The guidance tells state agencies when Part 2 permits them to use SUD information to verify an exclusion, with the stated goal of avoiding extra paperwork for eligible people. In practice, agencies will lean on data they already hold, such as claims, and on requests to providers.
For providers, that means two things. Data you sent to Medicaid as a payer may now be reused for eligibility, and new requests may arrive asking you to confirm treatment status. Both put your consent records and your disclosure logs under scrutiny.
Consent Gap 1: You Cannot Find Which Records Are Part 2
The first gap Medicaid verification exposes is the inability to identify Part 2 SUD records quickly, because a provider who cannot isolate the data cannot apply the right rules to a request. In our assessments, this is the most common problem by a wide margin.
Mixed Records in the EHR
Many electronic health record systems store SUD documentation alongside general notes, with only a diagnosis code or a clinician’s specialty hinting at Part 2 status. When a request arrives, staff must read the chart to decide what can be released.
The argument for leaving it this way is cost: data segmentation features are uneven across EHR vendors and expensive to configure. The argument for fixing it is that every manual decision is a chance to release too much or too little, and both carry consequences. Our guide to avoiding HIPAA audit failures in healthcare IT covers how auditors test this.
Tagging and Segmentation Options
Practical options include sensitivity tags on encounters, separate document types for SUD notes, role-based restrictions on who can open them, and standards-based data segmentation for privacy when exchanging records. Large systems with deep EHR integration have more choices, as our piece on Epic integration and HIPAA compliance explains.
Smaller programs may get further with clear document categories and access groups than with advanced segmentation. The right answer depends on volume, staff and vendor capability.
Consent Gap 2: Consent Records Live on Paper
The second gap is consent that cannot be matched to a disclosure, because a scanned intake form does not tell a release clerk what it covers. When a verification request arrives, the clerk needs a yes or no in seconds.
Structured Consent Data
Store consent as structured data: type, scope, date signed, expiry and revocation status. A single field showing “TPO consent on file, signed March 2026, not revoked” turns a chart review into a lookup.
Some practices resist this because consent forms change and data models lag behind. That is fair. The answer is to version the form and record which version each patient signed, so old consents are read under the terms that applied when they were signed.
Handling Revocation
Patients may revoke consent, and a revocation must stop future disclosures that rely on it. With paper processes, revocations often reach the chart weeks late.
We recommend a single intake point for revocations, an alert in the EHR, and a weekly check that no release went out under a revoked consent. That check is easy to automate, as our article on AI-driven risk monitoring for HIPAA compliance shows.
Consent Gaps 3, 4 and 5: Notices, Accounting and Breach Exposure
The remaining gaps sit downstream of the disclosure itself: missing redisclosure notices, incomplete disclosure accounting, and weak breach readiness. Each one is manageable alone, and each becomes visible once a state agency starts asking for records.
Gap 3: The Redisclosure Notice Is Missing
Part 2 requires a notice to accompany disclosed records, warning recipients about the limits on further disclosure. Manual release processes forget it, especially when records leave by fax, portal upload or a payer interface.
The fix is mechanical. Configure release templates, portal exports and interface messages to attach the notice automatically whenever Part 2 data is included, and test it quarterly.
Gap 4: Disclosure Accounting Is Incomplete
Patients have a right to know who received their information. If verification disclosures to a state agency are not logged with date, recipient, purpose and the consent relied on, the provider cannot answer that request accurately.
One view says agency verification is routine and low risk to log loosely. The other is that SUD patients are exactly the group most likely to ask, and most harmed by an inaccurate answer. We side with logging every disclosure in the same place, in the same format.
Gap 5: Breach Readiness Has Not Caught Up
With OCR enforcing Part 2 and breach notification aligned to HIPAA, a misdirected SUD record is now a reportable event with familiar penalties. Our analysis of the true cost of HIPAA non-compliance applies directly.
Make sure your incident plan names Part 2 data explicitly and that your data breach incident response partner knows which systems hold it.
Frequently Asked Questions
Does the OCR guidance require providers to do anything new?
The guidance is directed at state Medicaid agencies rather than providers. Providers should still expect verification requests and reuse of claims data, so consent tracking, notices and disclosure logs need to be ready.
Can a single TPO consent cover Medicaid verification?
That depends on the consent language and on how the guidance applies to the specific disclosure. Review your consent form against the OCR guidance with counsel before relying on it for eligibility requests.
Are all behavioral health records covered by Part 2?
No. Part 2 applies to records from federally assisted programs that hold themselves out as providing SUD diagnosis, treatment or referral. General mental health records outside such a program follow HIPAA rules instead.
What happens if a Part 2 record is disclosed by mistake?
Breach notification for Part 2 records now follows the HIPAA framework, and OCR enforces civil penalties. Document the incident, assess the risk, and notify affected patients and HHS as the rules require.
How can a small treatment program track consent without new software?
Start with structured fields in your existing EHR for consent type, date, scope and revocation, and a shared disclosure log. Many programs reach a defensible position without buying a dedicated consent platform.
Who Is Behind This Guidance
Mindcore Technologies supports healthcare organizations, including behavioral health and SUD treatment programs, with compliance assessments, EHR security and the infrastructure that keeps sensitive records separated and auditable. This article draws on our recent work helping clients prepare for the revised Part 2 rule and the eligibility changes that followed it. You and your clinical leaders decide how your program shares records; our job is to make sure your systems can carry out that decision reliably and prove it afterward. Mindcore is led by CEO Matt Rosenthal, who has built the company around giving regulated organizations practical, audit-ready security rather than generic advice.
Prepare Your Part 2 Workflows With a Free Strategy Call
Part 2 SUD records are about to be requested, reused and questioned more often, and the providers who handle that calmly will be the ones whose systems already know which records are Part 2, which consent covers each disclosure, and where the notice and the log entry went. Scope your Part 2 records deliberately, turn consent into structured data, automate the redisclosure notice, log every disclosure in one place, and name Part 2 data in your breach plan. Our HIPAA compliance audit checklist for healthcare is a good starting point for the wider program. If you want help mapping these gaps in your own environment, schedule a free strategy call with our cybersecurity compliance team. We will review your consent and disclosure workflows and give you a prioritized plan your staff can follow.
