AI Scribes and 42 CFR Part 2: SUD Records Compliance

42 CFR Part 2 is federal regulation that treats substance use disorder records more strictly than HIPAA. An AI scribe operating in a Part 2 environment is legal, but requires careful attention to three specific areas: consent, audio retention, and record ownership.

What is 42 CFR Part 2 and why it matters

Part 2 governs any program that:

Provides substance use disorder treatment (SUDT), or
Identifies itself as a drug and alcohol abuse treatment program, or
Is a general medical program with a specialized SUD unit.

Part 2 applies to substance-use-specific records — not other behavioral health or general medical records. If you are a psychiatrist who treats depression and also sees SUD patients, Part 2 applies only to the SUD records.

Part 2 is stricter than HIPAA in three ways:

Heightened consent for disclosure. HIPAA allows broad treatment, payment, and operations disclosures. Part 2 requires specific, written consent naming the recipient and purpose for almost any disclosure beyond direct treatment.
Re-disclosure prohibition. Once a Part 2 record is disclosed to another provider, that provider cannot re-share it with a third provider without new consent from the patient.
Court order standard. Disclosures pursuant to legal process require findings the court must make on the record — a higher bar than HIPAA's law enforcement exception.

If you run a SUD program or treat SUD patients, Part 2 is not optional. If you use an AI scribe in that environment, you must ensure the scribe does not create new compliance problems.

How AI scribes fit into Part 2 architecture

An AI scribe like Scriber is a tool that:

Receives audio of the patient visit.
Transcribes it.
Generates a note from the transcript.
Delivers the note to you.

The note goes into your Part 2-compliant record system. The audio is processed and discarded.

This is different from the AI scribe being the "custodian" of the record. Your EHR, your practice, or your program is the custodian. Scriber is a vendor you hired to generate documentation — similar to outsourcing medical transcription, except the AI does the transcription.

Under Part 2, this vendor relationship requires:

A Business Associate Agreement covering SUD records. Scriber signs a BAA with every customer, including SUD programs, at signup.
Explicit consent that covers the AI scribe. The patient must understand that their visit will be recorded and transcribed.
No audio archival. Scriber's infrastructure does not retain audio; there is no Part 2-protected recording sitting in vendor storage.

Consent for AI-scripted notes in Part 2 programs

Your Part 2 program's consent process needs to address AI scribing. Here is what needs to happen:

Before the visit: The patient should be informed: "Your visit will be recorded, and an AI transcription and note-generation tool will create a draft note from that recording. The clinician will review and sign the note. The recording will be discarded after the note is generated."

This can be part of your routine intake or consent form, or verbally documented at the start of the visit. The point is that the patient knows and agrees.

Why this matters: Part 2's heightened consent standard applies to creating and disclosing the record. If the patient does not know that an AI tool is generating the note, and later claims privacy violation, your program is vulnerable. Transparency prevents that.

If the patient declines: The patient can decline AI recording. In that case, the clinician documents the visit in the traditional way (typing, handwriting, or human transcription). Scriber is not mandatory; it is an option.

Scriber's role in consent: Scriber does not handle your consent process — that is your responsibility. But Scriber's workflow can support it: the app shows a "Recording active — AI transcription enabled" indicator during the session, which serves as a reminder that you have the patient's agreement.

Audio retention and Part 2 protection

The core Part 2 vulnerability is audio archival. If an AI scribe vendor keeps recordings indefinitely, there is a separate Part 2-protected archive — the recordings themselves — that is subject to Part 2's disclosure restrictions, breach notification requirements, and audit trails.

Scriber eliminates this exposure:

Audio is processed immediately after the visit. Transcription happens in real-time or within seconds of the visit ending.
Audio is deleted after the note is generated. Typically within 24 hours, and sooner if possible. There is no archive.
No backup of audio. Backups are made of the generated note (your clinical record), but not of the raw audio.

From a Part 2 perspective, this is the correct architecture. The note is your clinical record, and it stays in your Part 2-compliant record system. The audio is the intermediate artifact, and it does not need to persist.

If a Part 2 program asked "Do you retain audio recordings?", Scriber's answer is "No" — which is the answer Part 2 compliance teams want to hear.

The note itself under Part 2

The AI-generated note is a Part 2 record. It is subject to the same consent and re-disclosure rules as any other note in your program.

Who can see the note?

You (the treating clinician) can see it.
Other clinicians in your program treating the same patient (if there is a treatment relationship).
People the patient has consented to disclose it to.
Court or law enforcement pursuant to a court order or search warrant that meets Part 2 standards.

Can you disclose it to another provider?

Yes, but only with written consent from the patient that names the recipient and purpose. "I give permission for Scriber to share my note with Dr. Jones for continued treatment" is the required level of specificity. Blanket authorizations do not work under Part 2.

Can you use it in a court report or treatment court status update?

Only if the patient has consented to that disclosure, or if a court order has been entered. Part 2 court orders require specific findings — the court must find that good cause exists and that the disclosure is in the interest of justice. A standard subpoena is not sufficient.

Can the patient request their own record?

Yes, but the program has the right to assert Part 2 restrictions on the patient's own disclosure to third parties. Some programs allow patients to receive their records; others manage it carefully to prevent indirect re-disclosure.

All of this applies to AI-generated notes the same way it applies to clinician-typed notes. The AI tool does not change the Part 2 legal framework.

Common Part 2 questions about AI scribes

Q: Does the AI scribe need its own 42 CFR Part 2 compliance certification? A: No. The AI scribe is a tool that your program uses. Your program is Part 2-covered; the AI tool is part of your infrastructure. The vendor (Scriber) has a BAA covering Part 2 records and maintains the privacy posture this guide describes. That is sufficient.

Q: What if the AI scribe is a "covered entity" under HIPAA? A: Scriber is not a covered entity. It is a business associate. This is actually cleaner from a Part 2 perspective because there is no question about dual compliance. The vendor (Scriber) is subject to your BAA and your Part 2 program's requirements.

Q: Can we use the same AI scribe for SUD records and non-SUD behavioral health? A: Yes. Scriber processes both. Part 2 compliance applies specifically to the SUD records; non-SUD behavioral health notes are governed by HIPAA. The vendor's BAA covers both because HIPAA and Part 2 are compatible (Part 2 is stricter, so Part 2-compliant infrastructure is HIPAA-compliant).

Q: If a patient is also in our OTP (opioid treatment program), does Part 2 apply? A: Yes. OTP records are quintessentially Part 2-protected because they are substance use disorder treatment. The same AI scribe can be used, and the same Part 2 compliance rules apply.

Q: What happens if the AI scribe gets breached? A: If Scriber experiences a data breach affecting SUD records, the BAA requires Scriber to notify you and cooperate with your breach investigation. Your program then follows your Part 2 breach notification policy, which typically includes notifying affected patients. The fact that the data was breached does not change Part 2 obligations — you still have to disclose the breach per your program's policy.

Q: Can we train the AI model on our SUD records? A: No. The BAA prohibits the vendor from using your data to train models or for any purpose other than providing the service. This is standard and critical for any Part 2 program using a vendor tool.

Q: What about multi-clinician supervision and co-signature? A: If a supervisor or attending clinician needs to review and co-sign a clinician's note, that is standard clinical practice and does not create a Part 2 issue. The supervisor has a treatment relationship with the patient (because supervision is part of treatment), so they can see the record.

Setting up your Part 2 program for AI scribes

If you are a SUD program considering an AI scribe, this is the operational setup:

1. Review your BAA with the vendor. Ask whether the vendor's BAA covers Part 2 records specifically. Scriber's BAA covers all types of clinical records, including SUD. Request a signed BAA before you start.

2. Update your patient consent form. Add a line about AI transcription: "Your visit may be recorded, and an AI tool may be used to generate a draft note. The clinician will review and sign the note. You can decline AI recording if you prefer."

3. Train clinicians on reviewing notes. The AI is a tool; the clinician is responsible. Your training should emphasize: verify accuracy, correct hallucinations, and sign the note only when you are confident it reflects what actually happened.

4. Audit the vendor's Part 2 compliance. Request documentation that the vendor:

Encrypts data in transit and at rest (AES-256 minimum).
Does not retain audio after note generation.
Maintains audit logs of all access.
Has SOC 2 Type II certification or similar evidence of security controls.

Scriber provides all of this.

5. Document your own Part 2 controls. Keep records showing:

Consent was obtained from patients for AI scribing.
Notes are reviewed by clinicians before signing.
Access to notes is role-based (only clinicians and authorized staff).
Disclosures of notes follow your Part 2 disclosure policy.

Bottom line

42 CFR Part 2 does not prohibit AI scribes. It requires consent, non-retention of raw audio, encryption of processed data, and a signed BAA with the vendor. Scriber is designed to meet these requirements: BAA at signup, audio deletion after note generation, AES-256 encryption, and no model training on your data. If you are a SUD program and you want to use an AI scribe, Scriber provides the compliance architecture Part 2 programs need.

AI Scribes and 42 CFR Part 2: SUD Records Compliance | Scriber Wiki