42 CFR Part 2 Compliance: What Your Phone System Must Change

Your practice signed a business associate agreement, switched on appointment reminders, and moved on. If any part of what you do is substance use disorder treatment, that agreement may not be the rule you are actually measured against. 42 CFR Part 2 is a separate federal confidentiality rule, it is stricter than HIPAA where the two disagree, and its compliance date was 16 February 2026.

Part 2 is not a tighter setting on the same workflow. It changes what your phone line is allowed to say out loud. At a facility publicly identified as providing only substance use disorder care, confirming that a named person is your patient is itself a disclosure, and confirming it is exactly what a greeting, a caller-ID name, and a reminder text do by default.

This post covers who Part 2 actually covers, which is narrower than most practices assume, what it requires that HIPAA does not, what the February 2024 final rule changed and by when, and what to change in a phone system before it handles a Part 2 line. None of this is legal advice. The scoping question in particular belongs with your own counsel.

Who 42 CFR Part 2 actually covers

Part 2 does not cover every behavioral health practice. It covers a federally assisted program that holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment. Both halves of that test must be true, and a general therapy practice often fails the second one.

The scoping test most practices skip. Both halves must be true before Part 2 applies.

The first half is federal assistance. Under 42 CFR 2.12(b), a program is federally assisted if it is conducted by a federal department or agency, operates under a federal authorization including Medicare participation, receives federal financial support in any form, or is assisted through an IRS tax exemption or deduction. That last clause quietly pulls in a lot of nonprofits.

The second half is the definition of "program" in 42 CFR 2.11, and it comes in 3 shapes. A person other than a general medical facility that holds itself out as providing, and provides, substance use disorder care. An identified unit inside a general medical facility that does the same. Or medical personnel whose primary function is that care and who are identified as such providers.

The rule is equally clear about what sits outside it. Section 2.12(e)(1) says emergency room staff who refer an overdose patient elsewhere are not covered unless substance use disorder care is their primary function. Section 2.12(e)(2) says a record is not covered at all if the care was not provided by a Part 2 program.

So a psychiatry or counseling practice that never markets itself as an addiction provider is usually outside Part 2, while an opioid treatment program billing Medicare is usually inside it. One track inside a larger clinic can be inside while the rest of the building is not. If you are still mapping the vertical generally, the behavioral health call-handling picture covers the ground around this rule.

What Part 2 requires that HIPAA does not

Part 2 sits on top of HIPAA rather than replacing it, and it tightens 4 things a practice actually operates: what a consent must say, whether you may confirm someone is a patient, what happens when a record is passed on, and which agreement your outside phone vendor has to sign.

Four operational differences that change a phone setup, not a general privacy summary.

The consent is the most visible difference. Under 42 CFR 2.31(a), a written Part 2 consent has to name the patient, name the people or class of people authorized to disclose, describe the information specifically, name the recipients, state each purpose, state the right to revoke in writing, and carry an expiration date or event, a signature, and a date. A HIPAA authorization is close but not identical, and a generic intake form is usually neither.

Redisclosure is the second. Under 42 CFR 2.32, a notice has to travel with the record, along with a copy of the consent or a clear explanation of its scope. The 2024 rule added an important carve-out: a HIPAA covered entity or business associate that received the record for treatment, payment, or health care operations may redisclose it under the Privacy Rule.

The third catches most vendor conversations off guard. A business associate agreement is a HIPAA instrument. Part 2 uses a different one: 42 CFR 2.11 defines a qualified service organization as a person providing services such as data processing or professional services to a Part 2 program who has signed a written agreement acknowledging that it is bound by Part 2. Section 2.12(c)(4) is the exception that lets you share with one. Ask a phone or automation vendor for both documents, and ask whether they have ever signed the second.

What the 2024 final rule changed, and the dates that matter

The February 2024 final rule aligned parts of Part 2 with HIPAA. It was published at 89 FR 12472, took effect on 16 April 2024, and gave everyone until 16 February 2026 to comply. That deadline has passed, so a gap in your consent forms or outbound messaging is live now.

The penalty row is the one that changed the stakes. Section 2.3 now applies sections 1176 and 1177 of the Social Security Act, the HIPAA civil and criminal penalty provisions, and routes enforcement through 45 CFR part 160. Civil penalties there are tiered by culpability, running from a violation you did not know about up to willful neglect you never corrected, and each tier carries its own per-violation range and annual cap. HHS adjusts every tier for inflation and publishes the current table, so look up the live figures rather than trusting any amount quoted in a blog post, this one included.

The single consent for treatment, payment, and health care operations is a genuine simplification, and it is worth rebuilding your intake paperwork around it. What it does not do is loosen anything about identifying a patient to someone who has not been named in a consent.

On a Part 2 line, confirming a patient can be the disclosure

On a Part 2 line the risk is not the clinical conversation, it is the confirmation. Section 2.13(c) says a facility publicly identified as providing only substance use disorder care cannot acknowledge that an identified patient is there without written consent or a court order. That reaches your greeting.

Section 2.13(c)(2) goes further and governs how you say no. A response denying disclosure has to be worded so that it does not affirmatively reveal that a named individual is or has been diagnosed or treated for a substance use disorder. "We cannot discuss that patient" fails the test. "We cannot confirm or deny whether anyone is a patient here" passes it, and only if the line says that to every caller, every time.

The definition of "records" in 42 CFR 2.11 explicitly includes voicemails and texts, so an automated reminder is a record and not a courtesy message. Walk the surfaces one at a time: the outgoing greeting, the voicemail name, the caller-ID string on outbound calls, the sender name on outbound texts, the body of a reminder, the confirmation callback, and the handoff summary an automated system hands to a human. Each one is a place where a service line can be named.

A reminder reading "confirming your appointment at [clinic name]" going to a shared household phone discloses to whoever picks it up. Section 2.13(a) limits disclosure to the information necessary for the purpose, and the purpose of a reminder is a date and a time. This is a second boundary stacked on the one that already applies to any patient line, where the system routes clinical and urgent calls to a human and never diagnoses. If that first boundary is new to you, start with what an AI receptionist does and where it stops.

What to change in your phone system and AI receptionist

Most of the work is configuration, not policy. A Part 2 line needs a greeting and caller-ID that do not name the service, reminders stripped down to a date and a time, refusal wording that reveals nothing, and a vendor agreement that binds the vendor to Part 2, not only to HIPAA.

Configuration items, not policy language. Each one is a setting somebody has to change.

Storage matters as much as speech. Section 2.16 requires formal policies covering how records are created, received, maintained, and transmitted, who can reach the media they sit on, and how they are sanitized when destroyed. It also applies HIPAA breach notification to Part 2 programs. Call recordings and transcripts land squarely inside that, which makes retention settings a compliance decision rather than a storage-cost decision.

Vendor diligence for a Part 2 program runs one layer deeper than the usual questions. The security posture questions that apply to any patient line still apply here, and what a signed BAA does not tell you covers them. On top of that, ask who else touches the audio, because a subprocessor that receives a Part 2 record is inside the rule too. Remember that "HIPAA compliant" is a configuration plus a signed agreement, "HIPAA certified" is not a real thing, and neither phrase says anything at all about Part 2.

Field note

Before a Part 2 line takes live calls

• Counsel has confirmed in writing whether the practice meets the Part 2 program test.
• The greeting, caller-ID, reminder text, and refusal script have been read aloud and checked against 2.13(c).
• A qualified service organization agreement is signed, alongside the business associate agreement.
• Recording and transcript retention is set deliberately, and someone reviews the first 2 weeks of transcripts.

Work out whether Part 2 applies to your line

2 questions settle it, and both are answerable from your own records in an afternoon. Are you federally assisted, and do you hold yourself out as providing substance use disorder care? If both are true, your phone line is in scope and the configuration work above is not optional.

Two tests decide scope. Then rewrite what the line can reveal about a named person.

Walk the flow once. A practice that does not hold itself out as an addiction provider works to HIPAA and a signed agreement. A federally assisted program that does hold itself out has to look at every place the line can reveal that a named person is a patient, and rewrite those first. Everything else is consent records and a redisclosure notice that travels with the record.

Two cautions before you act on any of this. The rule is federal, but state confidentiality law can be stricter still, and nothing here is legal advice: your own counsel decides whether you are a Part 2 program and signs off on your consent forms. Second, treat any vendor that has not heard of 42 CFR Part 2 as unproven for this line, whatever their homepage says about behavioral health.

If you want the phone side sized first, the free Growth Leak Audit works from your own call numbers before anyone talks tools or contracts.