42 CFR Part 2 and AI: What SUD Programs Must Know
AI scribes are arriving in addiction treatment at the same time as the biggest update to federal substance use disorder (SUD) privacy rules in years. If your program records sessions, transcribes them or asks AI to draft notes, those recordings and drafts are protected SUD records. This guide explains what the updated 42 CFR Part 2 rule means for AI documentation tools, in plain language, so you can ask the right questions before you switch one on.
This article is general information, not legal advice. Part 2 decisions depend on your program's facts; confirm them with your compliance lead or counsel.
What 42 CFR Part 2 is, and who it covers
42 CFR Part 2 is the federal regulation that protects the confidentiality of SUD patient records. According to HHS, it applies to any federally assisted program that provides SUD diagnosis, treatment or referral for treatment. Some requirements also apply to those who receive Part 2 records, including qualified service organizations, HIPAA covered entities and business associates.
In general, a Part 2 program cannot share information that identifies someone as having, or having had, an SUD unless Part 2 specifically permits it, usually with the patient's written consent.
What changed, and why it matters now
HHS published a final rule in February 2024 to align Part 2 more closely with HIPAA, as the CARES Act required. The rule took effect on April 16, 2024, and programs had to comply by February 16, 2026. The HHS fact sheet lists the main changes. Those most relevant to AI tools are:
- Single consent for treatment, payment and health care operations (TPO). Patients can give one consent for all future TPO uses and disclosures. HIPAA covered entities and business associates that receive records under that consent may redisclose them as HIPAA allows, except for use in legal proceedings against the patient.
- SUD counseling notes. A new category, similar to psychotherapy notes under HIPAA, that needs its own specific consent and cannot be shared under a broad TPO consent.
- HIPAA-style penalties and breach notification. Part 2 violations now carry the civil and criminal penalties that apply to HIPAA, and the HIPAA Breach Notification Rule applies to Part 2 records.
- Enforcement and complaints. The HHS Office for Civil Rights (OCR) enforces Part 2, and since February 16, 2026 anyone can file a Part 2 complaint with OCR.
- No required data segmentation. The rule states that programs are not required to segregate or segment Part 2 records.
One date is still open: the compliance date for patients' new right to an accounting of disclosures will be set when the same right is revised in the HIPAA Privacy Rule.
Where an AI scribe touches Part 2 records
Walk through a typical AI scribe workflow and count the copies of protected information it creates: the session audio, the transcript, the AI-drafted note, any summaries or extracted fields, logs, and backups. Each of those may pass through several services, such as a speech-to-text engine, a language model provider and cloud storage. Every one of them is receiving, storing or processing Part 2 records.
1. Your AI vendor needs the right written agreement
Part 2 defines a qualified service organization (QSO) as a person that provides services to a Part 2 program, such as data processing or other professional services, under a written agreement in which it acknowledges it is fully bound by Part 2 and will, if necessary, resist judicial efforts to obtain patient records except as Part 2 permits. An AI documentation vendor typically fits that description. If your program is also a HIPAA covered entity, the vendor may also need a business associate agreement.
Ask every vendor for its agreements and its list of subprocessors. An AI scribe that sends audio to one company and text to another needs those downstream services covered too.
2. Consent covers your program's care, not a vendor's product
A TPO consent lets records flow for treatment, payment and health care operations. It is not a general permission for a vendor to reuse your patients' sessions, for example to train its own models. Your contracts should say plainly that the vendor and its subprocessors may only use records to provide the service to you, and should cover retention and deletion.
3. Decide what counts as SUD counseling notes
The regulation defines SUD counseling notes as notes recorded in any medium by an SUD or mental health professional that document or analyze the conversation in a private SUD counseling session or a group, joint or family session, and that are kept separate from the rest of the patient's record. They exclude medication, session times, treatment modalities and frequency, test results, and summaries of diagnosis, functional status, the treatment plan, symptoms, prognosis and progress.
An AI scribe that analyzes the conversation could produce material that fits this definition, depending on how your clinicians keep it. Agree with your clinical and compliance leads which AI output becomes part of the record, and whether anything is kept separately as counseling notes. If it is, it needs separate storage, tighter access and its own consent before it is shared.
4. Group sessions need extra care
A single group recording contains information about several patients. Notes filed to one patient's record should not carry another participant's details. Design the workflow so the facilitator reviews each participant's draft before it is saved, and limit who can access the full group recording or transcript.
5. Less data kept means less at risk
Part 2 records cannot be used in legal proceedings against a patient without consent or a court order, and breaches of unsecured Part 2 records now trigger HIPAA-style notification. Keep audio and transcripts only as long as you need them, encrypt them, and log who accessed what.
A checklist before you turn on an AI scribe
- Confirm with counsel whether your program is a Part 2 program and which records are covered.
- Map every place session audio, transcripts and drafts go, including each subprocessor.
- Sign a QSO agreement, and a business associate agreement where HIPAA applies, with every vendor.
- Prohibit vendor reuse of your records, including for model training, in writing.
- Update your patient notice and consent forms to reflect recording and AI-assisted documentation.
- Decide how SUD counseling notes, if any, are separated and protected.
- Design group-session review so each note contains only that patient's information.
- Require clinician review and approval before any AI draft enters the record.
- Set retention and automatic deletion for audio and transcripts.
- Encrypt data, restrict access by role and keep audit logs for breach response.
How we approach this at Torch Solutions
We build AI documentation that is added to a program's existing EHR or application, with clinicians approving every draft before it is saved. Our SureScribe AI scribe combined encryption, vendor agreements, access controls and automated PHI deletion with clinician approval and EHR write-back, and reduced documentation from more than an hour to about 20 minutes per patient. For treatment programs, we map Part 2 data flows and consent with your compliance lead before the first recording.
Learn more about AI for behavioral health and addiction treatment, adding an AI scribe to your existing app or EHR, AI-assisted clinical assessment and HIPAA-compliant AI development.
Frequently asked questions
Does 42 CFR Part 2 apply to AI scribes?
Part 2 applies to records, not to a particular technology. If an AI scribe records, transcribes or drafts notes from sessions at a federally assisted SUD program, the audio, transcripts and notes are Part 2 records, and the vendor that receives, stores or processes them must be bound by Part 2.
Is an AI scribe vendor a qualified service organization?
Often, yes. Part 2 defines a qualified service organization as a person that provides services such as data processing to a Part 2 program under a written agreement in which it acknowledges it is fully bound by Part 2. If your program is also a HIPAA covered entity, the vendor may also need a business associate agreement. Your counsel should confirm which agreements apply.
Are AI-generated session notes SUD counseling notes?
Only if they meet the definition: notes by an SUD or mental health professional analyzing the conversation in a counseling session, kept separate from the rest of the record. Summaries of diagnosis, treatment plan, symptoms, prognosis and progress are excluded. Decide with your clinical and compliance leads which AI output belongs in the record and which, if any, is kept separately as counseling notes.
When did the updated Part 2 rule take effect?
The final rule took effect on April 16, 2024, and programs had to comply by February 16, 2026. Since that date anyone can file a Part 2 complaint with the HHS Office for Civil Rights. The compliance date for the accounting-of-disclosures right will be set later.
Can an AI vendor use our session data to train its models?
Do not assume so. Training a vendor's general models is not the same as providing a service to your program, and Part 2 limits uses and disclosures to those it permits. Your agreements should state that the vendor and its subprocessors may not use your records for their own purposes. Confirm the details with counsel.
Sources
- HHS: Fact Sheet, 42 CFR Part 2 Final Rule (updated January 30, 2026)
- HHS: Understanding Confidentiality of SUD Patient Records (Part 2)
- Federal Register: Confidentiality of SUD Patient Records, final rule (2024)
- eCFR: 42 CFR 2.11, Definitions
- eCFR: 42 CFR Part 2, full regulation
- HHS: HIPAA business associates guidance