42 CFR Part 2 and AI Documentation: What Substance Use Counselors Need to Know

If you provide substance use disorder treatment and you are considering an AI documentation tool, the regulatory landscape around your notes is different from what a general outpatient therapist faces. 42 CFR Part 2 (commonly called "Part 2") adds a layer of privacy protection on top of HIPAA that most AI documentation vendors do not address in their marketing materials.

The February 2026 Final Rule brought significant changes, and the implementation window is short. Understanding what changed, what stayed the same, and what it means for AI-generated notes will help you make smarter decisions about your documentation workflow.

This guide covers the substance of the regulation, what it means for SUD session notes specifically, and what to look for when evaluating AI documentation tools for a Part 2-covered program.

What 42 CFR Part 2 Is and Why It Exists Separately from HIPAA

HIPAA provides a broad framework for protecting health information across virtually all healthcare settings. Part 2 exists for a narrower purpose: to protect the confidentiality of records held by programs that provide substance use disorder treatment, specifically to encourage people to seek treatment without fear that their records will be used against them in criminal, civil, or administrative proceedings.

The concern is concrete. A patient disclosing active drug use to a primary care physician operates under HIPAA, where records can flow to other treating providers with a general treatment, payment, and operations (TPO) authorization. Under HIPAA, your family physician can receive notes from your psychiatrist without you re-consenting every time. Part 2 blocks that pathway for SUD records: historically, disclosures required a separate, specific written consent identifying the recipient, the purpose of the disclosure, and an expiration date.

The rationale is that people avoiding SUD treatment because they fear legal consequences creates a public health harm that outweighs the coordination benefits of broader sharing. Part 2 has existed in some form since 1975. The 2026 Final Rule is the most substantial revision in decades.

Who Is Covered

Part 2 applies to Part 2 programs: federally assisted programs (meaning they receive federal funding, hold a DEA registration, or are authorized by federal law to conduct a controlled substance activity) that hold themselves out as providing, or provide, SUD diagnosis, treatment, or referral for treatment.

This covers most residential SUD programs, intensive outpatient programs treating SUD, medication-assisted treatment (MAT) clinics, and counselors at federally funded community mental health centers where SUD treatment is offered. It does not automatically cover every mental health provider who sometimes discusses substance use with a client, but the line matters less than you might think: if your program qualifies as a Part 2 program, the regulations apply to the SUD-related records you generate.

The February 2026 Final Rule: What Changed

The 2026 Final Rule completed a multi-year alignment project between SAMHSA (the federal agency that administers Part 2) and HHS (which administers HIPAA). The goal was to reduce barriers to care coordination while preserving the core protection. The key changes:

Consent for TPO disclosures. The Final Rule now permits a single written consent to cover disclosures to other treating providers, health plans, and healthcare operations, aligned with HIPAA's TPO framework. Before the 2026 rule, re-consent was required for many of these disclosures individually. The new single-consent model reduces administrative burden without eliminating consent requirements.

Consent requirements remain more stringent than HIPAA. While the alignment with HIPAA narrows the gap, Part 2 still requires more explicit consent mechanisms than HIPAA in several areas. Most importantly, consent for disclosures to law enforcement and employers remains strictly limited and cannot be folded into a general authorization. The patient must still give consent that identifies the purpose of the disclosure, and that consent can be revoked.

Prohibition on use in legal proceedings. The 2026 rule retained and clarified the prohibition on using Part 2 records in criminal, civil, or administrative proceedings against a patient without a court order accompanied by good cause findings. This protection was not weakened by the HIPAA alignment.

Audit trail and accounting requirements. The Final Rule strengthened requirements for programs to maintain records of disclosures. If a breach or misuse is alleged, programs must be able to demonstrate who received what, when, and with what authorization.

Breach notification. The 2026 rule added explicit breach notification requirements aligned with HIPAA's structure, clarifying obligations that were previously ambiguous under Part 2.

How SUD Session Notes Differ from General Mental Health Notes Under Part 2

A progress note written by a therapist at a general outpatient mental health clinic is a HIPAA-covered medical record. The same type of note written by a counselor at a Part 2-covered SUD program is a Part 2 record, and the rules governing its sharing are different.

The distinction matters because AI documentation tools are increasingly marketed as interoperable with EHRs, care coordination platforms, and shared clinical communication systems. Under HIPAA, a note generated by an AI tool attached to your EHR may flow through TPO channels without explicit re-consent. Under Part 2, that same note requires a patient consent that specifically covers the recipient and purpose, unless the 2026 single-consent provision applies and was properly obtained at intake.

What Must Your SUD Note Contain vs. What Cannot Appear

Part 2 does not dictate the clinical content of your notes. ASAM criteria documentation, relapse prevention planning, and motivational stage tracking remain at your professional discretion. What Part 2 governs is how those notes are stored, transmitted, and disclosed.

However, the content choices you make do affect compliance risk. A note that identifies a patient by name, program, and SUD diagnosis in a shared care environment creates more disclosure risk than a note kept in a standalone record. This is not an argument for vague notes; it is an argument for understanding your disclosure environment before choosing a documentation system.

Fictional example (compliant vs. non-compliant AI output):

A counselor at a Part 2-covered IOP uses an AI documentation tool that automatically pushes completed notes to a shared health information exchange (HIE). The patient signed a HIPAA authorization at intake but not a Part 2-compliant consent form identifying the HIE as a recipient.

Non-compliant: The AI tool generates the note, syncs it to the HIE, and the primary care physician pulls it during the patient's next visit. The note includes the patient's SUD diagnosis, current MAT medications, and recent toxicology results.

Compliant: The AI tool generates the note and stores it in the program's record system. Before any disclosure to the HIE, the intake coordinator confirms that the patient's consent form specifically names the HIE as an authorized recipient and identifies the treatment coordination purpose. The note is transmitted only after confirming consent scope.

The difference is not in the note itself. It is in whether the system around the note respects the consent architecture.

Data Segmentation: The Technical Problem Most AI Tools Have Not Solved

Here is where most AI documentation vendors fall short in a Part 2 environment: data segmentation.

A Part 2 record cannot be mixed indiscriminately with other health records in a shared system unless the receiving system can handle the segmented disclosure correctly. If a patient's SUD treatment records are stored alongside their diabetes management notes in a system that does not segregate by sensitivity level, a standard TPO disclosure of "health records" may inadvertently include Part 2-protected SUD content.

Data segmentation means the ability of an information system to flag, separate, and apply different access and disclosure rules to records based on their sensitivity classification. Under the 2026 Final Rule, programs increasingly need documentation systems that treat SUD records as a distinct category with distinct consent requirements, not as a generic subset of the patient's chart.

Most ambient AI documentation tools (the kind that record sessions and generate notes from transcripts) do not address data segmentation at all in their public documentation. They generate a note, store it, and expose it through whatever integration the clinical system supports. Whether that note lands in a segmented SUD record or flows freely with the rest of the chart depends entirely on the EHR configuration, not the AI tool.

Questions to ask any AI documentation vendor before deploying in a Part 2 environment:

• Does the tool allow notes to be tagged or classified as Part 2 records?
• Can the tool's output be restricted from health information exchange integrations unless consent is confirmed?
• Does the vendor understand Part 2 at all, or are they operating on HIPAA-only assumptions?

The Non-Recording Workflow Advantage for Consent-Sensitive Populations

Patients in SUD treatment who are already navigating criminal justice involvement, employment concerns, or family custody situations are acutely aware of what gets written down and where. Session recording is an especially sensitive issue: many clients will alter what they say, or disengage from treatment, if they know a session is being recorded, even if they understand the clinical purpose.

AI documentation tools that require audio or video recording of sessions introduce a layer of consent and disclosure complexity that does not exist with text-based workflows. Under Part 2, a session recording arguably constitutes a Part 2 record in its own right, not just the note derived from it. The storage, access, and retention policies for that recording become a compliance question.

A documentation workflow where the counselor types a structured session summary after the session, and the AI tool generates a formatted note from that summary, produces no recording. The only Part 2 record is the note itself. For populations where recording is clinically disruptive or where clients have explicit concerns about their information being captured in audio form, this approach lowers the friction of consent and reduces the scope of what must be managed as a sensitive record.

This is not a theoretical distinction. It is a real workflow decision that affects client engagement, informed consent conversations, and your compliance posture under Part 2.

What to Look for in an AI Documentation Tool for Part 2-Covered Programs

1. No automatic EHR or HIE sync without configuration. Any tool that pushes completed notes to an external system by default creates Part 2 disclosure risk unless your consent documentation already covers that recipient. Look for tools where note transmission is manual or configurable.

2. Clear data retention and deletion policies. If the tool stores any session content (typed summaries, audio, or generated notes), you need to know for how long and under what access controls. Vague policies like "we retain data as long as necessary" are a compliance red flag in Part 2 environments.

3. No session recording for SUD populations. Recording creates a second Part 2 record that you now must manage. Text-based workflows avoid this problem entirely.

4. Transparency about what the AI generates vs. what you write. In a legal proceeding or audit, the provenance of note content matters. A template-first tool that fills structured placeholders from your typed summary produces content that is clearly traceable to your clinical input. A fully generative AI that extrapolates note content from brief prompts may produce text you cannot verify against what actually happened in the session.

5. Vendor awareness of Part 2 specifically. Many documentation tool vendors are familiar with HIPAA. Fewer have considered the Part 2 overlay. Ask directly whether they have consulted legal counsel on Part 2 compliance in their product design. A vendor who responds with "we're HIPAA compliant" to a Part 2 question is telling you they have not thought about it.

NotuDocs uses a text-based, template-first workflow: you write a session summary, and the AI structures it into your chosen note format with no audio recording. For counselors working through the consent conversation in a Part 2 context, this limits the scope of what must be disclosed and managed.

Practical Documentation Tips for Group Therapy, IOP, and MAT Notes Under Part 2

Group Therapy Notes

Group therapy notes under Part 2 require particular care because other group members are present. A Part 2 program cannot disclose the fact that a specific person attended an SUD group session without that person's consent, even in a progress note.

The practical solution is consistent across most Part 2-savvy programs: write individual progress notes for each group member that document their participation, clinical status, and group interventions without naming other members. A group note that reads "client and peer Rosa discussed triggers" has just disclosed that Rosa is a patient in an SUD program, which requires Rosa's consent.

Compliant: "Client participated in group process focused on high-risk situation identification. Client identified social isolation as a trigger and received reflective feedback from group members. Client engaged actively, reported feeling understood."

Non-compliant: "Client and two other group members (including Rosa M.) discussed their shared pattern of weekend relapse."

The compliant version documents clinical content and group engagement without exposing other members' information.

IOP Documentation

In an intensive outpatient program, the volume and frequency of documentation creates compounding compliance risk. Each session note is a Part 2 record. Each group note is a Part 2 record. Each treatment plan update, each toxicology result note, each attendance record is a Part 2 record.

For IOP counselors using AI documentation tools, the key risk is speed: when you are generating five or more notes per day, the temptation is to let the tool auto-populate and move on. The problem is that AI tools generating notes from session summaries may pull in details from prior sessions or generalize in ways that are clinically plausible but factually imprecise. In a Part 2 environment, a note that inaccurately describes the content of a session is a documentation integrity problem that has both clinical and legal consequences.

Fictional example (IOP note):

A counselor finishes a morning group session with seven clients, then types brief summaries for each. One summary reads: "Marcus, week 3. Group focused on urge surfing technique. He shared progress with sponsor contact. Affect improved from last week. No reported use."

The AI tool structures this into a formatted IOP progress note: date, attendance, group topic, individual participation summary, clinical observations, and plan. The counselor reviews and signs. This workflow is appropriate because the note content derives entirely from what the counselor documented, not from an AI interpolation of a session recording.

MAT Follow-Up Notes

Medication-assisted treatment (MAT) notes require documentation of medication compliance, side effect monitoring, prescription status, and coordination with the prescribing provider. Because MAT information is often highly sensitive for patients regarding employment and legal status, these notes carry particular Part 2 weight.

When an AI tool generates MAT follow-up notes, ensure that:

• Medication names (buprenorphine, naltrexone, methadone) are included only when the counselor's summary includes them
• Toxicology results are documented from the counselor's input, not interpolated by the AI
• Coordination with the prescribing provider is documented based on actual communication, not assumed from prior notes

A note that states "patient reported taking buprenorphine as prescribed; confirmed with prescribing physician" needs to be accurate. If the AI generated that confirmation language and no actual communication with the prescriber occurred, that is a falsified record, not just a template error.

Compliance Checklist for SUD Counselors Using AI Documentation Tools

Program-Level Requirements

• Confirm whether your program qualifies as a Part 2-covered program under the federal assistance and DEA registration criteria
• Update your intake consent forms to include a single-consent TPO authorization aligned with the 2026 Final Rule, specifically identifying each recipient category
• Ensure consent forms identify any AI documentation tool's data storage as a component of the patient record
• Establish a written policy distinguishing which records are Part 2 records and which are general HIPAA records (if your program handles both)
• Implement an audit trail for all disclosures of Part 2 records, including which notes were transmitted to which recipients and when

Evaluating AI Documentation Tools

• Confirm the tool does not record sessions unless your program has made an explicit clinical decision to record and has a consent and data management protocol for recordings
• Confirm notes are not automatically transmitted to EHR integrations or health information exchanges without your manual authorization
• Ask the vendor specifically about Part 2 compliance in their product design, not just HIPAA compliance
• Confirm the vendor's data retention and deletion timeline for note content typed or generated in the system
• Confirm the tool generates notes only from your typed input, not from audio transcription or AI inference beyond what you provided

Session-Level Documentation Practices

• Group therapy notes: document each member individually; do not name other members in any individual note
• IOP notes: review AI-generated content against your summary before signing; do not accept AI-interpolated clinical details
• MAT notes: include medication and toxicology information only from your direct input; do not rely on AI to carry forward prior session content
• Relapse event notes: document actual client-reported content; distinguish between client-reported and clinician-observed findings
• Disclosure requests: before releasing any Part 2 record, confirm a valid consent exists that specifically names the recipient and purpose

Ongoing Compliance

• Schedule an annual review of consent forms to confirm alignment with current Part 2 regulations and any state-level SUD confidentiality laws
• Document any updates to your AI documentation vendor's privacy policy or data handling practices
• If your program receives a legal hold or subpoena involving a patient's SUD records, consult legal counsel before producing any Part 2 records; the court order requirement under Part 2 is distinct from HIPAA subpoena compliance

---

For more on how SUD documentation practices work across different treatment modalities and levels of care, see the guides on documenting substance abuse and addiction counseling sessions, documenting IOP and partial hospitalization sessions, and writing Medicaid-compliant case notes in social work.