42 CFR Part 2 and AI scribes — what addiction counselors need to know in 2026
How the federal statute protecting substance use disorder records is stricter than HIPAA — and what that means for counselors who use cloud-based AI note tools. A BAA is not enough. Here is what actually is.
Most addiction counselors know they operate under stricter confidentiality obligations than general mental health clinicians. The phrase "42 CFR Part 2" comes up in licensing trainings and compliance seminars. What does not come up often enough is how 42 CFR Part 2 intersects with cloud-based AI session note tools — a category of software that has expanded quickly since 2024 and that most SUD counselors now use or are actively evaluating.
The short version: cloud AI scribes that receive your session audio create a disclosure event under 42 CFR Part 2, and a Business Associate Agreement does not satisfy the consent requirement that 42 CFR Part 2 separately imposes. Most clinicians using cloud AI scribes for SUD sessions have not obtained the additional consent that the regulation technically requires. This post walks through why, what the practical risk is, and what on-device note generation changes.
This is not legal advice. The specific scope of 42 CFR Part 2 depends on whether your program is "federally assisted" under the regulation's definitions — consult an attorney familiar with SUD regulatory law for guidance on your specific practice situation.
What is 42 CFR Part 2?
42 CFR Part 2 (formally, the Confidentiality of Substance Use Disorder Patient Records regulations) is a federal rule administered by the Substance Abuse and Mental Health Services Administration (SAMHSA). It applies to programs that are "federally assisted" — which includes any program that receives federal funding, is authorized or licensed under federal law, is operated by a federal agency, or provides SUD services to Medicare or Medicaid patients. In practice, this covers the vast majority of SUD treatment programs in the United States.
The regulation exists because Congress recognized, starting in the 1970s, that fear of stigma and legal consequences uniquely deters people with substance use disorders from seeking treatment. If a patient believed their treatment records could easily reach employers, law enforcement, or family members, they might not seek help at all. 42 CFR Part 2 was designed to remove that deterrent by creating confidentiality protections stronger than HIPAA.
The key difference is the consent model. Under HIPAA, a covered entity can share protected health information with a Business Associate under a signed BAA without obtaining patient consent for each specific disclosure. The BAA authorizes the Business Associate to handle PHI for defined purposes — transcription, note generation, billing — and that authorization flows from the covered entity's HIPAA compliance framework, not from individual patient consent.
Under 42 CFR Part 2, that model does not work. Before a federally assisted SUD program can disclose a patient's records to any third party — for any purpose, including to a vendor processing notes — the program must have written patient consent that meets specific requirements: it must identify the specific name or general designation of the recipient, describe the type of information to be disclosed, state the purpose of the disclosure, state that the patient may revoke consent at any time, and carry an expiration date or condition. The consent must be in writing and signed by the patient.
The 2020 SAMHSA final rule updated 42 CFR Part 2 to align more closely with HIPAA in several ways, including allowing SUD programs to disclose records to other covered entities for treatment, payment, and certain healthcare operations purposes using a single general consent. But "treatment, payment, and healthcare operations" under the 2020 rule still does not mean what it means under HIPAA for AI vendor purposes. Sending session audio to a cloud vendor for AI transcription and note generation is not treatment, payment, or a permitted healthcare operation within the patient's own care team — it is a disclosure to a third-party technology vendor.
The cloud AI scribe disclosure problem
Here is the mechanism that creates the compliance gap. A cloud AI scribe works like this: the clinician records a session (or uses a live microphone), the audio is transmitted to the vendor's cloud servers, the vendor's models transcribe the audio and generate a note draft, and the draft is returned to the clinician through the vendor's interface. The audio and transcript may be retained on the vendor's servers for some period depending on the vendor's data retention policies.
The moment session audio leaves the clinician's device and is transmitted to the vendor's servers, a disclosure has occurred under 42 CFR Part 2. The vendor's servers are not the SUD program. The vendor is a third party receiving SUD patient information. Under 42 CFR Part 2, that disclosure requires patient consent — specifically, written consent that names the vendor (or describes its role) as the recipient of SUD records.
A Business Associate Agreement covers the HIPAA side of this arrangement. Under HIPAA, signing a BAA with the AI vendor means the vendor is authorized to handle PHI under HIPAA's framework, and you as the covered entity have met your HIPAA obligation regarding this disclosure. That is true and it is meaningful for HIPAA compliance. But 42 CFR Part 2 is a separate regulatory requirement that sits on top of HIPAA for SUD records. The BAA does not satisfy the 42 CFR Part 2 consent requirement, because 42 CFR Part 2 requires patient consent, not just a vendor agreement.
In plain terms: signing a BAA with your cloud AI scribe vendor makes you HIPAA-compliant for the disclosure of general mental health PHI. For SUD records specifically, you also need patient consent — and most standard SUD intake consent forms were not written with AI-vendor disclosures in mind. The question to audit is whether your current consent form, signed by each SUD patient at intake, explicitly contemplates disclosure of session audio or transcripts to an AI note-generation vendor.
Many clinicians assume that their general informed-consent-for-treatment form or their generic "we use technology vendors" disclosure covers this. For 42 CFR Part 2 purposes, it may not. The regulation requires that the consent identify the specific recipient or class of recipients of the disclosure with reasonable specificity. A general "we use third-party technology vendors" clause is arguably insufficient for the per-disclosure consent model that 42 CFR Part 2 maintains for SUD records.
This is not a theoretical edge case. SAMHSA has issued guidance noting that electronic health records and health information technology arrangements — including cloud-based systems — must comply with 42 CFR Part 2 consent requirements when they involve SUD programs. AI scribes are a specific instance of a cloud-based health IT arrangement that receives SUD records.
The 2024 updates and what they did not fix
A 2024 SAMHSA final rule further updated 42 CFR Part 2 in connection with changes required by the Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020. The 2024 rule introduced additional alignment with HIPAA, including allowing SUD records to flow more freely within integrated care settings and allowing disclosures for research, audit, and evaluation purposes with fewer barriers than the prior rule.
However, the 2024 rule did not eliminate the consent requirement for disclosures to third-party technology vendors. The CARES Act alignment provisions were aimed primarily at care coordination — allowing a psychiatrist, a primary care physician, and an addiction counselor treating the same patient to share records without a separate Part 2 consent for each internal handoff. That is a meaningful improvement for integrated care. It does not affect the analysis for cloud AI scribes, which are not care providers in the patient's care team.
The 2024 rule did require that all uses and disclosures of 42 CFR Part 2 records be prohibited from being used in criminal, civil, or administrative proceedings against a patient without patient consent, a court order, or specific qualifying exceptions. This strengthens the patient's position if their records are subpoenaed — but it does not prevent the subpoena from being served, and it does not prevent records from entering litigation before the patient has had a chance to respond.
For addiction counselors evaluating AI note tools in 2026, the operative question is unchanged from before the 2024 updates: is the tool cloud-based? If yes, does your intake consent form cover the specific disclosure to this vendor for this purpose? If the answer to the second question is unclear, that is the gap to close — either by updating your consent forms or by removing the disclosure event from the equation.
What happens when a cloud AI scribe is subpoenaed for SUD session records
42 CFR Part 2 is more protective than HIPAA when it comes to legal process. Under HIPAA, a properly issued subpoena that satisfies 45 CFR §164.512(e) can compel production of PHI. Under 42 CFR Part 2, a court order alone does not compel production — the court must find that good cause exists and that the need for disclosure outweighs the potential harm from disclosure. The patient must receive advance notice unless the court finds extraordinary circumstances to waive that notice.
This means that even a subpoena issued to a cloud AI vendor is not automatically enforceable against SUD records held by that vendor. The vendor can assert 42 CFR Part 2 protections. In practice, many cloud vendors — particularly smaller AI startups — may not have legal teams experienced enough with 42 CFR Part 2 to mount an aggressive response to a subpoena. A vendor that receives a subpoena and is uncertain about its obligations may disclose more than 42 CFR Part 2 technically permits.
The more structural problem is the same one that applies to standard HIPAA subpoenas, addressed in depth in our post on AI therapy note subpoenas: the vendor has been made a custodian of records that you assumed were under your control. Even if the vendor ultimately resists the subpoena successfully, your SUD patient's name is now in federal court filings as someone whose SUD records are in litigation. That itself can be a 42 CFR Part 2 violation, depending on how the court proceedings are conducted, if the litigation becomes public.
The custody principle is the same: records in your possession are subpoenable but come to you first. Records in a vendor's possession are subpoenable and may come to the vendor without your knowledge, depending on the terms of the BAA and applicable notice provisions.
How on-device note generation removes the compliance gap
The compliance gap created by cloud AI scribes under 42 CFR Part 2 is a gap that exists because of the disclosure. Session audio leaves the clinician's device, travels to a vendor's server, and that transit is a disclosure to a third party requiring consent. Remove the transit and you remove the disclosure.
On-device note generation works by running the entire inference pipeline on the clinician's own computer. The session audio is captured by the device's microphone, transcribed by a model running on the local machine (in TherapyDraft's case, whisper.cpp optimized for Apple Silicon), and the note draft is generated by a quantized large language model running locally (Qwen 14B or Llama 8B in 4-bit, via the MLX runtime). No audio file, no transcript, and no note draft is transmitted to any external server for processing.
Under this architecture, the 42 CFR Part 2 consent-per-disclosure requirement is not triggered for the AI note-generation step because there is no disclosure to a third party. The session information never left the federally assisted program's own device. The clinician remains the sole custodian of the audio, the transcript, and the draft at all times.
This does not mean on-device note generation eliminates all 42 CFR Part 2 considerations — the notes themselves are still SUD records once they are created, and all the standard 42 CFR Part 2 requirements for storing, transmitting, and disclosing records apply when you paste the note draft into your EHR, fax it to a referring provider, or include it in a summary for a court. What changes is the specific compliance gap that cloud AI scribes create at the moment of AI processing.
TherapyDraft enforces this architectural guarantee through macOS network sandbox entitlements. The app is sandboxed and explicitly forbidden from opening network connections for audio, transcript, or note text. The only outbound network calls the app makes are to Stripe's servers for license activation and to a version-check endpoint. The session data has no path to leave the device. This is not a policy claim — it is an enforcement mechanism. The privacy policy describes the full network model in technical detail.
For SUD counselors, this means the 42 CFR Part 2 intake consent form does not need a vendor-disclosure clause for the AI note-generation step, because that step does not constitute a disclosure. The compliance burden is reduced, not shifted — and the audit log that TherapyDraft maintains (a tamper-evident hash-chained JSONL recording model, prompt hash, output hash, timestamp, device ID, and duration for each inference) provides a verifiable record that processing occurred on the local device rather than on an external server, useful in the event a regulatory inquiry or licensing board audit asks about your technology practices.
A practical checklist for SUD counselors reviewing AI note tools
Whether you are evaluating a cloud AI scribe for the first time or auditing your current setup, here is the set of questions that the 42 CFR Part 2 analysis requires:
1. Is your program federally assisted under 42 CFR Part 2? This covers most SUD practices — any program receiving federal funding, licensed under federal law, treating Medicare or Medicaid patients, or operated by a federal agency. If you treat any SUD patients through insurance or Medicaid, the answer is almost certainly yes for those patients' records.
2. Does your AI note tool transmit session audio or transcripts to any external server? If yes, that transmission is a disclosure requiring 42 CFR Part 2 consent. Check the vendor's technical documentation and BAA, not just their marketing materials. "Processed locally" language in marketing can mean different things — look for explicit statements about data transmission during inference.
3. Does your current SUD intake consent form cover AI vendor disclosures? Review your consent form with a compliance attorney who knows 42 CFR Part 2. A generic "we use technology vendors" clause is a starting point but may not meet the specificity requirements for per-recipient consent. You may need to update consent forms to name or describe the AI vendor category explicitly.
4. What is the vendor's data retention policy for SUD session audio? Even if audio is used only for note generation, if it is retained on vendor servers after note delivery, it remains in a third-party custodian's hands. The consent for disclosure should cover retention, not just processing, if retention occurs. Most cloud AI vendor BAAs address this in general PHI terms; ask specifically about audio retention.
5. Can you produce a processing record if asked? SAMHSA and state licensing boards increasingly ask about AI tool use in audit contexts. Whether you use a cloud scribe or an on-device scribe, maintain a record of what tool processed which sessions, when, and under what data-handling arrangement. On-device tools that generate a tamper-evident inference log make this straightforward. Cloud tools require extracting records from vendor dashboards, which may or may not be possible after the fact.
The data-flow audit of major cloud AI scribes in our earlier post documents what each major vendor transmits and retains, drawn from their public privacy policies and BAAs. It is a useful reference for step 2 and step 4 above.
Frequently asked questions
What is 42 CFR Part 2?
42 CFR Part 2 is a federal regulation protecting the confidentiality of records created by federally assisted substance use disorder (SUD) treatment programs. It is stricter than HIPAA in key ways — most importantly, it requires written patient consent naming each specific recipient before SUD records can be disclosed to any third party, where HIPAA permits disclosures to Business Associates under a signed BAA without individual patient consent per disclosure.
Does 42 CFR Part 2 apply to AI session note tools?
If the AI note tool is cloud-based and your practice is a federally assisted SUD program, yes. Transmitting session audio to a cloud vendor's servers for AI processing is a disclosure to a third party under 42 CFR Part 2. That disclosure requires patient consent that meets the regulation's specific requirements — not just a BAA.
Is a Business Associate Agreement enough for 42 CFR Part 2 compliance when using a cloud AI scribe?
No, not for SUD records. A BAA satisfies the HIPAA side of the vendor relationship. 42 CFR Part 2 adds a consent requirement on top of HIPAA: the patient must consent in writing to the specific disclosure to the vendor. The BAA does not substitute for that consent. Both are required for SUD records in federally assisted programs.
What happens if a cloud AI scribe vendor is subpoenaed for SUD session records?
42 CFR Part 2 provides stronger protection against legal process than HIPAA — a court order must meet a good-cause standard, and the patient is entitled to advance notice unless the court finds extraordinary circumstances. Even so, the vendor now holds SUD records, the patient's name may appear in court proceedings related to the subpoena, and the vendor's legal response depends on that vendor's 42 CFR Part 2 expertise. Custody is the structural risk.
How does on-device note generation handle 42 CFR Part 2?
On-device note generation eliminates the disclosure event. When session audio, transcript, and note draft are generated entirely on the clinician's device and never transmitted to any external server, no disclosure to a third party has occurred. The 42 CFR Part 2 consent-per-disclosure requirement is not triggered for the AI processing step. The clinician remains sole custodian of the SUD records throughout the note-generation workflow.
Further reading
- What is a BAA — and what it does NOT cover: the baseline on Business Associate Agreements and where their HIPAA coverage ends.
- Can an AI therapy note be subpoenaed?: the custody and legal-process analysis that applies to both mental health and SUD records.
- What cloud AI scribes actually send to servers: a data-flow audit of major vendor privacy policies and BAAs, useful for step 2 and step 4 of the SUD counselor checklist above.
- HIPAA for private-practice therapists — the 2026 rewrite: the broader HIPAA compliance context, including how the AI-scribe question fits into the full subprocessor-inventory framework.
The five-question gap check
Our BAA Coverage Gap Quiz maps your current scribe's data-handling posture to the risks in this post — and in the wider HIPAA and 42 CFR Part 2 framework. Five questions, sixty seconds, no account required. The quiz runs entirely in your browser; nothing is sent to any server. SUD counselors and therapy bloggers can embed it on their own site.
Try TherapyDraft
The private beta is free for 10 sessions — no credit card, no upload. Install the signed .dmg, grant microphone access, draft your first note on the Mac you already own. The session audio, the transcript, and the draft never leave the device. Your 42 CFR Part 2 intake consent form does not gain a vendor-disclosure clause for the note-generation step, because there is no vendor in the loop.
This post is general information about 42 CFR Part 2 and its intersection with AI session note tools as of 2026. It is not legal advice, regulatory advice, or compliance guidance and does not establish a professional relationship. Whether a specific program is "federally assisted" under 42 CFR Part 2, whether specific consent language is adequate, and what steps a specific practice must take are legal and compliance questions that depend on the practice's particular facts and applicable state law. Consult an attorney experienced in SUD regulatory law and HIPAA before making compliance decisions based on this post. SAMHSA guidance and judicial interpretations of 42 CFR Part 2 evolve; verify that the regulatory text and SAMHSA guidance cited here remain current before relying on them.