42 CFR Part 2 and AI Scribes: What SUD Treatment Providers Must Know

If you provide substance use disorder treatment and are considering an AI scribe, you face a compliance layer that most AI scribe vendors have not been designed around. Title 42 of the Code of Federal Regulations, Part 2 — commonly called "Part 2" — is a federal confidentiality regulation that applies specifically to SUD records created by federally assisted programs. Its requirements are stricter than HIPAA in several important ways, and it imposes obligations that a standard business associate agreement does not address.

This post explains what Part 2 covers, how it interacts with HIPAA, what it means for AI scribe workflows, and the specific questions you need to answer before routing SUD treatment records through any AI documentation tool.

What Part 2 Covers and Why It Exists

42 CFR Part 2 was enacted in the 1970s to encourage people with substance use disorders to seek treatment without fear that their records would be disclosed to law enforcement, employers, or other third parties. The regulatory premise — that the stigma and legal consequences of SUDs created a specific barrier to care that general medical privacy law did not adequately address — remains relevant today. The confidentiality protection is stronger than HIPAA's because Congress determined that SUD treatment records required a higher bar.

Part 2 applies to:

Programs that are "federally assisted" — meaning they receive federal funding, are conducted by a federal agency, are authorized or licensed by a federal agency, or carry a federal tax-exempt status
Records of patients who are receiving treatment, diagnosis, or referral for SUD from that program
Information that identifies, or could identify, an individual as having a SUD

The "could identify" standard is broader than HIPAA's PHI definition. A record that does not include a patient's name but includes sufficient demographic and clinical detail to identify someone with a SUD may still be covered.

Part 2 does not apply to:

Providers who treat patients for whom SUD is incidental to other care and who are not themselves a "Part 2 program" — a general psychiatrist who sometimes addresses alcohol use in the context of depression treatment is typically not running a Part 2 program
Records of patients who voluntarily disclose SUD to a non-Part 2 provider as part of their general medical history
State-licensed programs that receive no federal assistance and have no federal nexus

The line between Part 2 programs and non-Part 2 providers treating co-occurring SUD is genuinely ambiguous in some practice contexts. If you are uncertain whether Part 2 applies to your program, consult an attorney with health law expertise — this is not a determination to make by inference.

How Part 2 Differs from HIPAA

Both HIPAA and Part 2 protect health information, but they differ in several ways that are directly relevant to AI scribe use.

Consent requirements. HIPAA's TPO exception allows disclosure of PHI for treatment, payment, and operations without specific patient consent. Part 2 requires patient consent for most disclosures — including disclosures to other treating providers — unless a specific exception applies. An AI scribe vendor processing Part 2-covered records must have patient consent that specifically authorizes the disclosure to that vendor.

Permitted disclosures are narrower. Under HIPAA, a covered entity can disclose PHI to a business associate for virtually any treatment, payment, or operations function. Under Part 2, disclosures are permitted only for specific purposes enumerated in the regulation. "Note generation" is a treatment-related function that would likely qualify, but it is not explicitly enumerated, and regulators have not issued formal guidance on AI documentation tools in this context.

Re-disclosure is prohibited. Part 2 records cannot be re-disclosed by a recipient without the patient's consent. A BAA under HIPAA imposes re-disclosure limits on business associates, but those limits are governed by the BAA terms. Under Part 2, the prohibition is statutory and applies to all recipients regardless of contractual terms. An AI scribe vendor who receives Part 2-covered records is themselves bound by Part 2's re-disclosure prohibition.

Law enforcement disclosure restrictions. HIPAA has several law enforcement disclosure exceptions. Part 2 has almost none. A subpoena, court order, or law enforcement request does not override Part 2's confidentiality protections in most circumstances. This has significant implications if an AI vendor receives a law enforcement request for records — the vendor cannot simply comply without a qualifying court order that meets Part 2's specific procedural requirements.

Breach notification. HIPAA's breach notification rule applies to Part 2 records in addition to Part 2's own response requirements. A breach of Part 2 records triggers HIPAA notification obligations as well as Part 2-specific obligations.

The 2024 Part 2 Amendments

A significant set of amendments to Part 2 took effect in 2024, aligning several Part 2 provisions more closely with HIPAA while maintaining the core stronger protections. Key changes relevant to AI scribe use:

Consent once, use repeatedly. The 2024 amendments allow Part 2 programs to obtain a single consent that covers all future disclosures for treatment, payment, and health care operations — similar to HIPAA's TPO structure. This eliminates the prior requirement for separate consent for each disclosure in the TPO category. For AI scribe use, this means that a properly written consent form obtained at intake can cover AI transcription and note generation as a treatment operations function, without requiring session-by-session consent.

Patient notice requirement. The amended rule requires Part 2 programs to provide patients a notice of privacy practices, similar to the HIPAA notice requirement. The notice must describe how SUD records may be disclosed and to whom.

Lawsuits using Part 2 records. The 2024 amendments added provisions allowing patients to use their own Part 2 records in lawsuits against providers, removing a limitation in the prior rule.

Audit and evaluation exception. A clarified audit and evaluation exception allows disclosure to contractors performing audit functions — which is relevant when an AI scribe vendor might be engaged in quality improvement activities involving records. The exception is narrow; confirm that your vendor's data handling qualifies.

What Your AI Scribe Vendor Must Be Able to Demonstrate

Running Part 2-covered records through an AI scribe vendor who has only a standard HIPAA BAA in place is not sufficient. The vendor must be able to demonstrate specific capabilities and commitments:

No re-disclosure without patient consent. The vendor must confirm in writing that they will not disclose Part 2 records to any third party — including their own sub-processors — without patient consent or a qualifying exception. Standard BAAs do not include this language. Request a Part 2 addendum or amendment.

Prohibition on use for training or analytics. Part 2's re-disclosure prohibition effectively bars use of Part 2 records for AI model training or product analytics without specific patient consent. A vendor who uses patient data for model improvement must ensure that consent is obtained. Most vendors whose BAAs prohibit training use are compliant on this point, but verify the specific language.

Segregation of Part 2 records. If you operate a Part 2 program and also provide non-SUD behavioral health services, Part 2 records must be distinguishable from general mental health records. The prohibition on re-disclosure applies to the Part 2 records; different rules apply to non-Part 2 records. Your AI scribe workflow must either segregate Part 2 records from other records or treat all records as Part 2-covered.

Sub-processor Part 2 compliance. If the AI scribe vendor uses a third-party transcription engine, that engine is a recipient of Part 2 records and is itself subject to Part 2's re-disclosure prohibition. The vendor must have a sub-processor agreement that addresses Part 2, not just HIPAA.

Response to law enforcement requests. Confirm that the vendor has a documented policy for handling law enforcement requests for Part 2 records — specifically, that they will not produce records without a qualifying court order and will notify you of any such requests.

Consent Language for Part 2 Programs Using AI Scribes

Under the 2024 amendments, the required consent elements for a Part 2 disclosure are:

Name or general designation of the program making the disclosure
Name or general designation of the recipient (the AI vendor)
Name of the patient
Purpose of the disclosure
How much and what kind of information is to be disclosed
Patient signature and date
Statement that the patient may revoke consent at any time
Date, event, or condition upon which consent expires, if not revoked earlier

A sample disclosure purpose statement for AI scribe use: "Disclosure to [Vendor Name], a HIPAA-covered AI documentation service, for the purpose of audio transcription and clinical note generation. Audio is processed and deleted after note generation. No records are re-disclosed outside of direct treatment operations."

The consent should be specific to the AI vendor by name. If you change AI scribe vendors, new consent is required for ongoing patients. For patients newly admitted to the program, the intake consent can cover the current vendor.

Practical Workflow Considerations for SUD Treatment Providers

At intake: Obtain Part 2 consent that covers AI documentation alongside your standard authorization. Specify the vendor by name. Explain the recording and deletion process.

Session recording: For Part 2-covered sessions, confirm before recording that consent is on file. A session recorded without valid Part 2 consent is a confidentiality violation even if the patient verbally assents — the consent must be the signed written form.

Note generation: Generate and review notes immediately after session. The shorter the window between recording and deletion, the smaller the exposure surface.

Co-occurring disorders: Mental health records generated by a Part 2 program may be covered by Part 2 if they are part of the patient's SUD treatment record. When in doubt, treat co-occurring disorder records as Part 2-covered within a Part 2 program.

Employee assistance programs: EAPs that provide SUD counseling referrals are often Part 2 programs. If your AI scribe is used in an EAP context, the same analysis applies.

The questions to ask every vendor before piloting in a Part 2 program:

Are you willing to sign a Part 2 addendum to your BAA?
How do you handle law enforcement requests for records?
Do your sub-processors (transcription engines) have Part 2-specific agreements?
Can your system segregate Part 2 records from non-Part 2 records?

Most AI scribe vendors have not developed Part 2-specific compliance frameworks — the market has primarily addressed HIPAA. If a vendor is unfamiliar with Part 2 or cannot engage with these questions specifically, they are not ready for SUD treatment deployment. The risk of using a non-Part 2-aware vendor in a Part 2 program is one the program carries alone.

For resources on SUD documentation practices, see Scriber for substance use disorder treatment and the compliance documentation center. For state recording law requirements relevant to SUD treatment telehealth, see state-by-state telehealth recording laws.

Evaluate Scriber for your SUD treatment program. Contact us to discuss Part 2 compliance requirements or review the HIPAA and compliance documentation before your first session.