Part 2 has always been the reason behavioral health records are hard to integrate.

The RealityConsent is now a configuration decision

⚠️

The Problem

Systems built for the old separation.

Consent captured per disclosure, records held in a segregated store, and a workflow that treats every exchange as an exception. All of it still running.

🔧

The Solution

Rebuild consent, then reconsider segregation.

Configure a consent form carrying the elements the regulation names, then decide deliberately whether to keep segregating rather than keeping it by inertia.

✅

The Resolution

A record that can participate.

Behavioral health information available for treatment without a separate request each time, with the notice and the audit trail to match.

Single consent, and what it actually covers

This is the change everything else follows from. The final rule permits a covered entity or business associate receiving Part 2 records to rely on “a single consent given once for all such future uses and disclosures for treatment, payment, and health care operations, until such time as the patient revokes the consent in writing.”

Read the boundaries carefully. It is treatment, payment and health care operations — not any purpose. It runs until written revocation, not until a fixed date. And it is a consent the patient gives, which means the form has to be right.

That last point is where the work is. A single consent is only as good as the document capturing it, and the regulation is specific about what that document contains.

The consent form is a ten-element build

The consent requirements at 42 CFR 2.31 enumerate what written consent must contain, and it is a longer list than most practices have built.

In outline: the patient’s name; identification of who is authorised to make the disclosure; a specific and meaningful description of the information; the recipients, with special instructions where an intermediary is involved and a redisclosure statement where the recipient is a covered entity or business associate; a description of each purpose; the right to revoke in writing and how; an expiration date or event; the patient’s signature, electronic where permitted; the date signed; and for treatment, payment and operations consents, a statement about the potential for redisclosure and loss of Part 2 protection together with the consequences of refusing to sign.

That is a form, not a checkbox. Practices that bolt single consent onto an existing form without auditing it against the regulation are relying on a consent that may not carry the elements it needs.

Segregation is no longer required, which is not the same as forbidden

The second substantive change is the one with the biggest systems implication. The rule states that a Part 2 programme, covered entity or business associate receiving records under a single TPO consent “is not required to segregate or segment such records.”

For organisations that built a separate behavioral health record specifically to satisfy Part 2, that removes the obligation. It does not remove the option, and it does not make integration automatically correct. A practice may have clinical, cultural or state-law reasons to keep information separated, and those reasons survive the federal change.

What we would not do is let inertia decide. Sit down, ask why the separation exists, and record the answer. If the answer is “because the regulation required it,” that answer expired in February.

Redisclosure and what recipients may do

The redisclosure statement is now a named element of the consent form rather than a general prohibition, and the distinction matters when you are explaining this to clinicians.

Where the recipient is a covered entity or business associate, the consent carries a statement about redisclosure, with an exception for civil, criminal, administrative and legislative proceedings against the patient. That carve-out is worth understanding precisely rather than approximately, and it is a conversation for your own counsel rather than for a blog post.

Operationally, the thing to build is a record of what consent a given disclosure relied on. If a question arises later about whether a redisclosure was permitted, the answer depends on a consent document that has to be findable.

Patient notice and breach notification

Two further alignments change documents you already maintain. Part 2 patient notice requirements were aligned with the HIPAA notice of privacy practices, and breach notification requirements were brought into the same framework.

The HHS fact sheet on the final rule sets these out alongside the consent and segregation changes, grouping the modifications under patient consent, other uses and disclosures, penalties, breach notification, patient rights, patient notice, and a safe harbor.

One caution on dates. That fact sheet surfaces February 2024 in connection with the rule, which is the announcement. The effective date is 16 April 2024 and the compliance date 16 February 2026, both stated in the Federal Register document. Cite the Federal Register when the date matters.

The exchange problem underneath all this

There is a reason this rule was written, and it shows up clearly in the data on what behavioral health organisations can actually do.

An ONC data brief on EHR adoption and exchange among substance use and mental health treatment facilities, published April 2026 from the 2024 national survey, found 68% of facilities using an EHR only with no paper charts and 25% using an EHR plus paper. But only 19% participated in a health information exchange organisation, while 67% reported no knowledge or familiarity with an exchange in their service area.

That gap is the point. Adoption is not the constraint any more; participation is. A rule that removes a legal barrier does nothing on its own for the two-thirds of facilities that do not know an exchange exists nearby.

What to do now

• Audit the consent form against 42 CFR 2.31. Element by element, not by impression.
• Decide segregation deliberately. Write down why you are keeping it, or stop.
• Record which consent each disclosure relied on. Findable later, not reconstructed.
• Refresh the patient notice. It now tracks the HIPAA notice of privacy practices.

Qventive provides 42 CFR Part 2 changes support in New Jersey as part of our addiction treatment EHR and IT work and a broader addiction treatment practice management engagement.

Because consent configuration determines what leaves your systems and to whom, it belongs in your HIPAA risk analysis as much as in your privacy policy.

One thing we are not going to do is tell you where the line falls in a specific disclosure. This is a legal question with clinical consequences, state law sits on top of it, and the right adviser is your own counsel. What we can do is make sure the systems can express whatever decision they reach — which is frequently the part that turns out to be missing, and it usually surfaces during a workflow review rather than in a policy meeting.

Part 2 alignment: common questions