42 CFR Part 2 Consent Requirements: What to Include and When It’s Needed

Elements of a Valid Consent Form

Under the Federal Privacy Regulations 42 CFR Part 2, a valid written consent (paper or electronic) is mandatory before most disclosures of Confidential SUD Records. To achieve Written Consent Form Compliance, your form must contain all required elements and clear, specific descriptions so patients understand the scope of Disclosure Authorization. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.31))

Required elements you must include

• Patient’s full name.
• The person(s) or class of persons authorized to make the use or disclosure.
• A specific, meaningful description of the information to be used or disclosed.
• Recipient(s): name(s) or class(es). For a single consent covering future treatment, payment, and health care operations (TPO), you may use a general designation such as “my treating providers, health plans, third-party payers, and people helping to operate this program.”
• Purpose of the disclosure. “At the request of the patient” is sufficient if the patient initiates the consent; “for treatment, payment, and health care operations” is sufficient when using a single TPO consent.
• Patient’s right to revoke consent in writing and how to do so, noting the reliance exception.
• Consent expiration date or event related to the patient or purpose. For TPO, “end of treatment” or “none” is sufficient; for research, “end of the research study” is sufficient.
• Signature of the patient; if applicable, the signature of an authorized person for minors, individuals adjudicated as lacking capacity, or decedents. Electronic signatures are permitted unless prohibited by law.
• Date the consent is signed.
• If using a TPO consent, include both: (a) a statement that records used or disclosed under the consent may be subject to HIPAA-permitted redisclosure and no longer protected by Part 2, except for legal proceedings against the patient; and (b) the consequences of refusing to sign.

These elements and TPO-specific statements are set out in 42 CFR § 2.31(a). Incorporating them verbatim where appropriate helps ensure Substance Use Disorder Confidentiality and reduces the risk of invalid consent. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.31))

Authorized Disclosure and Use

With a valid consent, a Part 2 program or other lawful holder may use or disclose the specified information consistent with the form’s scope. When a HIPAA covered entity or business associate receives Part 2 records pursuant to a TPO consent, those records may be redisclosed in accordance with HIPAA permissions for TPO—except they still cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against the patient without separate authorization or a qualifying court order. The consent must include a statement informing the patient about this potential HIPAA-permitted redisclosure. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.31))

Every disclosure made with the patient’s written consent must also include the required Part 2 notice. Programs may use either a detailed notice or a brief one-sentence statement: “42 CFR part 2 prohibits unauthorized use or disclosure of these records.” A general medical release is not sufficient to meet Part 2’s consent standards. ([federal.elaws.us](https://federal.elaws.us/cfr/title42.part2.section2.32))

For TPO consents, you may describe recipients by class (for example, “my treating providers” and “health plans”), and for disclosures through an intermediary you must identify the intermediary and either list its participants or use a general designation limited to participants with a treating provider relationship to the patient. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.31))

Purpose and Expiration of Consent

Part 2 requires you to document why information is being shared and when the consent ends. For Patient Consent Revocation planning and Consent Expiration Criteria, remember: (1) “At the request of the patient” is adequate when the patient initiates the consent; (2) “for treatment, payment, and health care operations” suffices for a single TPO consent; and (3) expiration may be a date or an event related to the individual or purpose. For TPO, “end of treatment” or “none” is acceptable; for research, “end of the research study” works. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.31))

Rights to Revoke Consent

Patients may revoke consent at any time in writing, and your form must explain how to do so. Revocation does not undo disclosures already made in reliance on the consent (for example, services billed to a payer), but it stops future uses or disclosures under that consent once the program or lawful holder knows of the revocation. Disclosures may not be made on the basis of expired, deficient, or revoked consents. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.31))

Specific Rules for Counseling Notes

SUD counseling notes—clinician notes analyzing the conversation during an SUD counseling session and kept separate from the rest of the record—receive heightened protection comparable to psychotherapy notes. They require specific, separate patient consent and cannot be used or disclosed based on a broad TPO consent. A program may not condition treatment, payment, enrollment, or benefit eligibility on consenting to use or disclose SUD counseling notes. Limited exceptions permit use by the originator for treatment, program training, or to defend the program in a legal action brought by the patient, and other disclosures expressly allowed elsewhere in Part 2. These notes must be maintained separately from the general treatment and medical record. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.31))

Combining and Separating Consent Forms

To preserve Substance Use Disorder Confidentiality while streamlining paperwork, organizations often consolidate consent content. However, Part 2 places non-negotiable limits on combination:

• SUD counseling notes consent may be combined only with another SUD counseling notes consent—never with general Part 2 or HIPAA permissions.
• Consent for use or disclosure in civil, criminal, administrative, or legislative proceedings must be stand-alone and cannot be combined with any other consent.

Beyond these prohibitions, you may structure consents to cover future TPO uses/disclosures and, where applicable, identify intermediaries and recipient classes consistent with § 2.31. Keeping SUD counseling notes segregated and using separate forms where required helps ensure Disclosure Authorization remains compliant under federal and state law. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.31))

Legal Requirements under 42 CFR § 2.31

Section 2.31 details the mandatory elements, structure, and limitations of patient consent under 42 CFR Part 2, including electronic signatures, recipient designations, TPO statements, revocation and reliance, and special rules for SUD counseling notes and legal proceedings. The most recent comprehensive updates took effect on April 16, 2024, with a compliance date of February 16, 2026, aligning many aspects of Part 2 with HIPAA while preserving stronger protections against use in legal proceedings. ([govinfo.gov](https://www.govinfo.gov/app/details/FR-2024-02-16/2024-02544?utm_source=openai))

Conclusion

To comply with 42 CFR Part 2 consent requirements, build clear, specific forms that include all § 2.31 elements, state the purpose and expiration, explain revocation, and follow special rules for SUD counseling notes and legal proceedings. Doing so safeguards Confidential SUD Records, supports patient trust, and keeps your program aligned with federal standards. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.31))

FAQs.

What information must be included in a 42 CFR Part 2 consent form?

Include: patient name; who may disclose; a specific description of the information; the recipient(s) (name or class); the purpose; how to revoke and the reliance exception; an expiration date or event; required signatures; the signature date; and, for TPO consents, statements about potential HIPAA-permitted redisclosure (with limits for legal proceedings) and the consequences of refusing to sign. Electronic signatures are allowed unless prohibited by law. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.31))

When is separate consent required for SUD counseling notes?

SUD counseling notes always need their own specific consent and cannot be disclosed under a broad TPO consent. You also cannot combine this consent with other consents or condition treatment, payment, enrollment, or benefits on agreeing to disclose these notes. Limited exceptions apply (e.g., use by the originator for treatment, program training, and program self-defense in a patient-initiated proceeding). ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.31))

Can a consent form cover future disclosures for treatment and payment?

Yes. A single consent may authorize future uses and disclosures for treatment, payment, and health care operations. The purpose can be described as “for treatment, payment, and health care operations,” and recipients may be described by class (for example, “my treating providers and health plans”). Covered entities that receive Part 2 records under such a consent may further share them as HIPAA permits for TPO, but not for use against the patient in legal proceedings. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.31))

How can a patient revoke their consent under 42 CFR Part 2?

Patients may revoke consent at any time in writing, using the method described in the consent. Revocation stops future uses/disclosures under that consent once known to the program or lawful holder, but it does not undo disclosures already made in reliance on the consent. Disclosures may not proceed on expired, deficient, or revoked consents. ([law.cornell.edu](https://www.law.cornell.edu/cfr/text/42/2.31))