Part 2 consent, updated for the 2024 rule.
The required elements of a written consent under the 2024 final rule, how the single consent for treatment, payment, and health care operations works, and the checks to run before each disclosure.
The 2024 final rule brought 42 CFR Part 2 closer to HIPAA. A single consent can now cover future disclosures for treatment, payment, and health care operations, HIPAA covered entities can redisclose under HIPAA rules, and breach notification now applies to Part 2 records. Programs had until February 16, 2026 to update their forms and procedures.
This checklist puts the consent requirements in plain language, separates what changed for the new single consent, lists the checks to run every time records leave the program, and offers illustrative wording for the key clauses. It is a starting point for a conversation with counsel, not a substitute for one.
What is inside
- Key dates for the final rule
- The required elements of every written consent
- What changed for the single consent covering treatment, payment, and health care operations
- Checks before each disclosure, including the notice and the copy of consent
- Illustrative wording for the TPO, redisclosure, revocation, and expiration clauses
What a consent needs, and what changed.
Required elements
- WhoPatient, disclosing program, and recipients
- WhatHow much and what kind of information
- WhyThe purpose, or at the request of the patient
- UntilRevocation rights and an expiration
The single TPO consent
- ScopeOne consent for future treatment, payment, and operations disclosures
- RedisclosureHIPAA entities may redisclose as HIPAA permits
- NotesSUD counseling notes need a separate consent
Before each disclosure
- CheckConsent current, not revoked, covers this recipient
- SendA copy or explanation of the consent, and the Part 2 notice
- LogEvery disclosure, for patient requests and breach response
Built for the people who work the denials.
- Privacy and compliance officers at SUD programs
- Intake and admissions teams who collect consents
- Health information staff who release records
Related on this site: 42 CFR Part 2 Compliance Monitoring, Documentation Compliance.
Download the PDFCatch these before the claim goes out.
Adentris reviews charts and claims against payer rules before submission, so missing documentation, modifiers, and authorizations surface while they can still be fixed.