42 CFR Part 2 in co-occurring disorder treatment: dual-record structures, the CARES Act amendments, and what cloud AI scribes capture

The compliance gap most COD therapists don't know exists

The 42 CFR Part 2 framework is well understood in dedicated addiction counseling practices. Providers who specialize in substance use treatment, operate federally funded programs, or prescribe buprenorphine under the Drug Addiction Treatment Act generally know they are operating under a regulatory regime stricter than HIPAA. The consent-per-disclosure requirement — now relaxed for treatment, payment, and operations purposes under the CARES Act — is a familiar part of the compliance landscape.

What is less well understood is the scope of Part 2 coverage in co-occurring disorder treatment. A therapist who primarily treats depression, anxiety, trauma, and PTSD — and who also treats a meaningful proportion of clients with co-occurring substance use disorders — may be operating a Part 2 program without having made that determination explicitly. When that therapist adopts a cloud AI scribe for session note generation, the resulting compliance question is not simply a HIPAA BAA question. It is a Part 2 question that the BAA framework was not designed to answer.

Who is a "Part 2 program": the definitional scope

42 CFR Part 2 applies to "part 2 programs" — entities that meet two criteria simultaneously: they are federally assisted, and they hold themselves out as providing (and actually provide) substance use disorder diagnosis, treatment, or referral.

"Federally assisted" is broader than it sounds. It includes any program that receives federal funds — through direct grants, Medicaid reimbursement, Medicare billing, or indirect funding via federal block grants administered by states. It also includes programs authorized under federal law to conduct SUD treatment, programs operated by federal agencies, and programs that dispense federally controlled substances for the purpose of treating SUD (the DEA-registered opioid treatment program standard).

Many private mental health practices qualify as federally assisted without having made an explicit determination: practices that bill Medicaid or Medicare for any services are receiving federal funds. If that same practice provides SUD diagnosis, treatment, or referral — even as part of a broader mental health scope — it is a Part 2 program for those records.

The "holds itself out" standard is equally important. A practice that advertises co-occurring disorder treatment, lists SUD diagnoses among its specialties, accepts referrals specifically for SUD-related concerns, or routinely assigns SUD ICD-10 codes (F10–F19) in billing meets this threshold. The determination is not based on how the practice thinks of itself — it is based on how it presents to the public and what it actually delivers in clinical practice.

The co-occurring disorder records boundary: content, not location

In co-occurring disorder treatment, 42 CFR Part 2's protection is drawn around records that would "identify a patient as having or having had a substance use disorder." This is a content-based standard, not a location-based one. A progress note generated by a therapist at a Part 2 program that discusses both a depressive episode and the client's alcohol use is a Part 2-protected record — not because of where it was created, but because of what it contains.

The practical problem: in integrated COD treatment, separating the mental health content from the SUD content is often clinically impossible. Depression and alcohol use disorder present in an intertwined pattern. A progress note describing mood symptoms, coping behaviors, triggers for dysregulation, and substance use patterns is a single document that identifies the patient as having SUD in any context where the record is seen. The clinical information that makes COD treatment effective is precisely the information that places the note under Part 2 protection.

Under the 2024 final rule implementing the CARES Act amendments, SAMHSA clarified that when records contain both Part 2-protected content and general medical information, the Part 2 protections apply to the entire record. This means a therapist at a federally assisted COD practice cannot simply silo the SUD notes under Part 2 and treat the mental health notes as HIPAA-only. When the session content is integrated — as COD treatment requires — the entire session documentation is subject to Part 2's framework.

Hospital-based SUD programs: the dual-record structure

Hospital-based SUD programs create the most structurally complex version of this problem. A hospital — or a large integrated health system — maintains most clinical records under HIPAA: surgical notes, cardiology, emergency medicine, general medicine, general psychiatry. But the hospital's federally assisted SUD program — an opioid treatment program (OTP), an outpatient addiction medicine clinic, or an inpatient detoxification unit receiving federal certification — maintains Part 2-protected records for SUD services.

For the same patient, the hospital may simultaneously hold:

• A HIPAA-only general medical record: an emergency department visit documented under a non-SUD ICD-10 code (altered mental status, chest pain, an injury), where the clinical note does not explicitly identify the patient as having SUD.
• A Part 2-protected SUD treatment record: OTP enrollment documentation, MAT prescriptions (methadone, buprenorphine), addiction counseling progress notes, and urine toxicology records from the hospital's SUD clinic.
• Mixed records: consult notes from the hospital's addiction medicine service, generated in response to a general medicine admission, that cross-reference the patient's SUD treatment while remaining formally within the general medical record system.

When a cloud AI scribe operates during a session at the hospital's SUD clinic or OTP, the vendor receives audio from a session in which Part 2-protected content is the primary subject. The vendor's archive contains records that are legally Part 2-protected — but the vendor's compliance infrastructure is built for HIPAA. This is the structural gap: the records in the vendor's archive are subject to Part 2's stricter disclosure rules, including the amended CARES Act audit trail requirement, but the vendor is operating under a Business Associate Agreement that covers only HIPAA obligations.

What the CARES Act changed — and what it didn't — for cloud AI scribes

Section 3221 of the CARES Act (2020) directed SAMHSA to align Part 2 more closely with HIPAA. SAMHSA published the final rule implementing these changes in February 2024, with an effective date of February 16, 2024 and a compliance date of February 16, 2026. For cloud AI scribes operating at Part 2 programs, several things changed — and several things remained distinctively stricter than HIPAA.

What changed: Patients can now provide a single general consent for treatment, payment, and operations (TPO) disclosures, rather than a separate consent specifically naming each recipient. A patient who signs a general authorization for their COD treatment program's operations can authorize the program to share records with categories of providers participating in their care — including, in principle, the AI note tool as part of the treatment workflow. This eliminates the consent bottleneck that made cloud AI scribes legally untenable at Part 2 programs under the prior per-disclosure framework.

What remained stricter than HIPAA:

• Law enforcement access: Part 2 still prohibits disclosing patient records to law enforcement based on a standard HIPAA-compliant law enforcement request. A cloud AI vendor that receives a law enforcement demand for session content from a Part 2 program cannot comply on the same basis it would for HIPAA-only records. The prohibition applies to the vendor as a lawful holder of Part 2 records.
• Criminal proceedings: Part 2 still prohibits use of patient records in any criminal proceeding — whether initiated by the government or a private party — without a qualifying court order that applies a good-cause standard. This is broader than HIPAA and applies to the vendor's independently held archive.
• Court-ordered disclosure standard: The standard for compelling disclosure by court order remains higher than under HIPAA: a showing of good cause, advance patient notice (unless the court waives it for specified reasons), and a weighing of the need against the potential harm to the patient and to the Part 2 program's ability to serve other patients.
• Audit trail requirement: The 2024 final rule retained and strengthened the requirement that Part 2 programs maintain an accounting of TPO disclosures — a record of what was shared, with whom, when, and for what purpose, available to the patient on request.

The audit trail problem cloud AI scribes cannot solve

The audit trail requirement is the most operationally challenging for cloud AI scribe adoption at Part 2 programs. A Part 2 program using a cloud AI scribe for note generation is making a TPO disclosure each time session audio or transcript is transmitted to the vendor's servers. Under the 2024 final rule, the program must maintain a per-disclosure accounting that documents what was transmitted, when, to which vendor system, and for what treatment purpose.

Cloud AI scribe vendors typically do not provide per-session transmission logs at the level of detail that satisfies a Part 2 disclosure accounting. A Business Associate Agreement confirms that the vendor agrees to protect PHI under HIPAA — it does not create the audit trail that Part 2's accounting requirement independently demands. The result is a compliance gap that is invisible in day-to-day practice but becomes acute if a patient requests a disclosure accounting, if the practice undergoes a SAMHSA audit, or if the question arises in litigation about whether a Part 2 program's AI-assisted note workflow was conducted in compliance with the regulation's post-CARES Act requirements.

What cloud AI scribes capture in a co-occurring disorder session

Understanding the specific content a cloud AI scribe captures during an integrated COD session clarifies why the Part 2 compliance question is not academic. A cloud-based scribe running during a typical COD session transmits the full session audio to the vendor's servers, where it is processed for transcription and note generation. From that audio, the vendor's archive contains:

• Substance use history verbatim: substances used (drugs of choice, quantities, frequency, routes of administration, using partners, contexts of use) — material that clearly identifies the patient as having SUD and that is Part 2-protected in the records of a federally assisted program.
• Medication-assisted treatment discussions: naltrexone (oral Vivitrol injection), buprenorphine (Suboxone, Sublocade), methadone — medications that themselves identify the patient as receiving SUD treatment and that carry implications for employment, security clearances, and professional licensing in regulated industries.
• Relapse disclosures and circumstances: the specific triggers, social contexts, and behavioral patterns of relapse episodes in the patient's own voice — clinical content central to the treatment relationship and subject to Part 2's stricter disclosure rules.
• The connection between mental health and SUD presentations: integrated COD treatment explicitly works with the interdependence of diagnoses — "I drink more when the dissociation is bad," "my depression lifts for three days when I use, then crashes" — precisely the clinical content that makes the mental health note inseparable from the SUD record.
• Legal history connected to SUD: DUI charges, possession arrests, diversion program participation, probation or parole conditions tied to substance use — information that may still have active legal implications and that is subject to Part 2's prohibition against use in criminal proceedings without a qualifying court order.
• Safety disclosures: overdose history, means access, sharing of substances with family members, the presence of SUD in the household — safety content that is clinically necessary to document and that is Part 2-protected when generated at a federally assisted program.

All of this is Part 2-protected when it appears in the records of a Part 2 program. The vendor holds it as independent business records. The vendor's archive is subject to subpoena and to Part 2's disclosure restrictions — but those restrictions are handled by the vendor under a HIPAA BAA, not under a Part 2-specific compliance framework designed for the regulation's stricter requirements. The Business Associate Agreement does not substitute for Part 2 compliance; it only addresses HIPAA obligations.

On-device processing: no disclosure, no compliance gap

On-device note generation eliminates the disclosure event that the CARES Act-amended consent, audit trail, and lawful-holder framework is designed to govern. When audio, transcript, and note content are processed entirely on the therapist's Mac — and never transmitted to a cloud vendor's servers — no "disclosure" to a third party has occurred under 42 CFR Part 2.

The CARES Act general consent framework for TPO disclosures is not triggered, because there is no TPO disclosure to a vendor. The audit trail requirement for per-disclosure accounting is not triggered, because there is no transfer of custody to a lawful holder. The vendor's separately held archive, with its ambiguous regulatory status and HIPAA-aligned compliance infrastructure, does not exist. Part 2's stricter rules for law enforcement access and criminal proceedings apply to the vendor's records — records that on-device processing means the vendor never holds.

For a federally assisted COD practice, this is not a marginal feature consideration. The difference between a cloud AI scribe and an on-device one is the difference between navigating a complex, amended regulatory framework for every AI-assisted note — general consent, audit trail accounting, per-disclosure logging, strict law enforcement and criminal-proceeding restrictions applied to a vendor that is not Part 2-trained — and having no Part 2 disclosure compliance issue related to the note tool at all.

The psychotherapy note vs. progress note distinction matters here too: in COD settings, both note types generated during integrated sessions may be Part 2-protected if the practice is a federally assisted program, regardless of whether the note is maintained separately in a locked psychotherapy record or in the general treatment record. On-device processing removes the question from the vendor relationship entirely, leaving it where it belongs: in the practice's own records custody and clinical judgment.