Commonly Asked Questions About the 2024 Part 2 Final Rule
This resource addresses three common themes of questions from the CoE-PHI’s July 2025 Webinar: Part 2 Final Rule: Implementing Changes to SUD Privacy Rules
A PDF version of these questions is available for download. You can request individualized technical assistance for more support.
Commonly Asked Questions
Operationalizing Consent Forms
1. What does “TPO” stand for?
“TPO” is an abbreviation for “treatment, payment, and healthcare operations” – a term from the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) that applies to a new type of Part 2 consent form (see Question 2 below), mandated by the 2020 Coronavirus Aid, Relief, and Economic Security Act (the CARES Act).
Header text
2. What makes a TPO consent different from any other consent under Part 2?
With a TPO consent form, an individual can use one consent form to authorize all future uses and disclosures of their Part 2 records for purposes of treatment, payment, and healthcare operations until the individual revokes it in writing. The TPO consent form may not authorize use or disclosure of Part 2 records for any other purpose; the Part 2 program must obtain separate written consent for such uses and disclosures.
3. Does a TPO consent need to include different information than a general consent for use or disclosure?
Yes, the TPO consent must include the following additional information, beyond what is required on consent forms generally:
- The consequences to the patient for refusing to sign the TPO consent
- The potential for the Part 2 records used or disclosed pursuant to the consent to be redisclosed by the recipient and no longer protected by Part 2
4. If an individual provides a single, written TPO consent, can that individual change their mind later and revoke the TPO consent?
Yes, individuals have the right to revoke their consent, but must do so in writing. As with all Part 2 consent, revocation is not applicable to the extent the Part 2 program or other lawful holder has already acted in reliance on it.
5. If an individual revokes their TPO consent, does a Part 2 program need to notify entities to which records were already disclosed about the revocation?
While Part 2 does not mandate that a Part 2 program notify prior record recipients of an individual’s revocation of consent, the Preamble to the 2024 Final Rule states that Part 2 programs should, “where feasible,” convey to recipients when a consent is revoked. The Preamble also states that after a consent is revoked, the Part 2 program is required to stop making any future uses or disclosures of that individual’s Part 2 records. However, Part 2 programs are not required to “pull back” records disclosed under a valid TPO consent.
6. What if an individual revokes their TPO consent but their information has already been put in a system where the Part 2 records cannot be segregated from other medical records?
The 2024 Final Rule neither requires nor prohibits the segregation or segmentation of Part 2 records from other medical information. However, segregation or segmentation may be necessary to operationalize Part 2’s stringent requirements.
7. May entities subject to Part 2 require an individual to sign a TPO consent as a condition of receiving services?
The CARES Act does not state whether Part 2 programs may condition signing a TPO consent as a condition of receiving services, but SAMHSA, in the Preamble to the 2024 Final Rule, states that a Part 2 program “should not condition treatment on a TPO consent unless [the program] has some capacity to fulfill patients’ requests for restrictions on uses and disclosures for TPO.”
8. If an individual’s receipt of services is conditioned on their provision of a TPO consent, does the consent need to include any specific language?
While the Part 2 regulations do not require specific language, the Preamble to the Final Rule states that when the receipt of services is conditioned on signing a TPO consent, that consent form should include a statement that consent is needed or required for TPO (or “to help the program operate its health care business” or a similar statement). The consent must also include an explanation of the consequences of failing to sign, as established by the Part 2 program’s policies.
9. Is a Part 2 program required to use a TPO consent, or can the program continue to obtain separate written consents any time it needs to carry out TPO uses and disclosures?
The 2024 Final Rule does not require a Part 2 program to use TPO consents. Use of a TPO consent form is up to the discretion of the Part 2 program.
10. When signing a consent form, does an individual need to identify the people or entities to whom a Part 2 program may disclose records?
A written consent for a use or disclosure of Part 2 records must include “[t]he name(s) of the person(s), or class of persons, to which a disclosure is to be made.” (The requirements are listed in 42 C.F.R. § 2.31(a)(4)(i)). For TPO consents, the named recipient may be described as “my treating providers, health plans, third-party payers, and people helping to operate this program” or a similar statement.
Notably, if the intended recipient of the Part 2 records is an intermediary,1 the written consent must include: (i) the name(s) of the intermediary(ies), and (ii) the name(s) of the member participants of the intermediary, or a general designation of a participant or class of participants, which must be limited to a participant who has a treating provider relationship with the individual whose information is being used or disclosed.
1 An intermediary is defined as “a person, other than a [P]art 2 program, covered entity, or business associate, who has received records under a general designation in a written patient consent to be disclosed to one or more of its member participant(s) who has a treating provider relationship with the patient.” 42 C.F.R. § 2.11. The Preamble to the 2024 Final Rule lists examples of intermediaries to include a “[Health Information Exchange (HIE)], a research institution that is providing treatment, an ACO, or a care management organization.”
Substance Use Disorder (SUD) Counseling Notes
1. Are the requirements for SUD counseling notes under Part 2 the same as the requirements for psychotherapy notes under HIPAA?
The Preamble to the 2024 Final Rule states that the SUD counseling notes protections were intended to “align with HIPAA provisions regarding psychotherapy notes.” The Preamble also states that the definition of SUD counseling notes is nearly identical to the HIPAA definition of “psychotherapy notes.” As a reminder, SUD counseling notes are defined as “notes recorded (in any medium) by a [Part 2] program provider who is a SUD or mental health professional documenting or analyzing the contents of conversation during a private SUD counseling session or a group, joint, or family SUD counseling session and that are separated from the rest of the patient’s [Part 2] and medical record.”
2. What types of information would NOT qualify as SUD counseling notes?
- Medication prescription and monitoring
- Counseling session start and stop times
- Modalities and frequencies of treatment furnished
- Results of clinical tests
- Any summary of the following items:
- Diagnosis
- Functional status
- Treatment plan
- Symptoms
- Prognosis
- Progress to date
3. Can SUD counseling notes be disclosed without consent for a TPO purpose?
Only in limited circumstances. A Part 2 program may use or disclose SUD counseling notes without consent to carry out the following, limited TPO purposes:
- Use by the writer (“originator”) of the SUD counseling notes for treatment;
- Use or disclosure by the Part 2 program for its own training programs in which the students, trainees, or practitioners learn under supervision to practice or improve their skills in group, joint, family, or individual SUD counseling; OR
- Use or disclosure by the Part 2 program to defend itself in legal action or other proceeding brought by the patient.
4. Can a Part 2 program condition treatment, payment, enrollment in a health plan, or eligibility for benefits on the individual’s provision of written consent for the use or disclosure of their SUD counseling notes?
No. Unlike a TPO consent, a Part 2 program cannot condition the provision of services to the individual on the individual’s execution of a consent form to use or disclose SUD counseling notes.
For more information, please see the CoE-PHI’s related resource: SUD Counseling Notes
Notice & Copy of Consent to Accompany Disclosure
1. Does a copy of an individual‘s TPO consent form or an explanation of the scope of that consent need to accompany disclosures sent by a Health Information Exchange (“HIE”)?
Yes, HIEs are not exempted from Part 2’s general requirement that all disclosures made pursuant to consent be accompanied by a copy of the consent or explanation of its scope.
CoE-PHI Team Authors
Related Resources
