42 CFR Part 2 Marketing Compliance for Treatment Centers

Beginning February 16, 2026, anyone can file a Part 2 complaint, and the enforcement provisions that apply to Part 2 sit in the HIPAA Enforcement Rule at 45 CFR part 160, subparts C, D and E, according to the HHS Part 2 page. For 42 CFR Part 2 marketing compliance, that means a leaked lead list or a careless tracking setup can now draw a federal complaint. Sweet Media builds and audits the stack where this data travels, and this article walks through each system. It is general education and not legal advice, so confirm specifics with your counsel.

What 42 CFR Part 2 Is and Why It Matters for Marketing

Part 2 protects the confidentiality of SUD records created by federally assisted programs that provide substance use disorder diagnosis, treatment, or referral for treatment. HHS describes the core rule plainly. Part 2 programs cannot share information that would identify someone as having, or having had, a substance use disorder unless Part 2 specifically permits it.

Marketing teams often hold information that could fit that description. A name and phone number sitting in a CRM tagged with your program may link a person to treatment, so have counsel decide which records count as identifying.

Who Must Comply: Applicability to Programs and Marketers

Part 2 applies to federally assisted programs that hold themselves out as providing SUD treatment. Federal assistance is defined broadly, so ask counsel early whether your program is covered rather than assuming it is not. Some requirements also extend to organizations that receive Part 2 records, such as HIPAA covered entities and business associates, qualified service organizations (QSOs) and intermediaries (Accountable HQ).

Vendors and agencies that touch SUD records generally need a qualified service organization agreement (QSOA) or another valid basis for receiving them (Accountable HQ). Ask whether that covers your ad agency, call tracking provider, CRM vendor and email platform.

Core Part 2 Requirements That Affect Marketing

Patient Consent for Using or Disclosing Records

Part 2 builds on written consent, and a valid authorization must state the purpose of the disclosure, include an expiration date, and be signed and dated by the patient (source). Under the 2024 rule, a patient may give a single, durable TPO consent for all future uses and disclosures for treatment, payment and health care operations until revoked in writing (Accountable HQ). Advertising, outreach and testimonials are not treatment, payment or operations, so plan on separate explicit signed permission for them and confirm that with counsel.

That also answers the testimonial question. Before using a patient's story, get a separate written consent that names the specific information to be shared, with whom, and the time limits of the release, which is what NAADAC's position statement describes for consent. We also recommend stating that the testimonial will be public and explaining how the person can revoke it going forward.

Disclosures Allowed Without Consent and Court Orders

Part 2 permits limited disclosures without consent, such as medical emergencies, audits and evaluations, and qualified service organization arrangements. None of these are marketing exceptions. Legal proceedings are also restricted, and Part 2 requires a special court order before client records are turned over in response to a subpoena, search warrant or law enforcement request (PIMSY EHR).

Security Safeguards and Breach Notification

The final rule applies HIPAA-style breach notification to unsecured Part 2 records, triggering individual and HHS notifications (Accountable HQ). Programs must notify affected individuals, the HHS Secretary and in some cases the media. A misconfigured CRM, an exposed export or an email sent to the wrong list could qualify, so ask counsel where the line falls. Set an internal escalation path now so marketing staff alert compliance quickly instead of waiting to see if anyone notices.

How Part 2 Differs from HIPAA and How to Comply with Both

HIPAA generally permits treatment, payment and operations disclosures without patient authorization, while Part 2 requires written consent for most disclosures of SUD records (Accountable HQ). Programs covered by both must comply with both, and where state law is more protective than federal rules, the stricter standard is the safer one to apply (Accountable HQ).

One change matters to marketers. Part 2 programs that are also HIPAA covered entities may create a combined notice that meets both the HIPAA Notice of Privacy Practices and the Part 2 Patient Notice. Your web privacy language and intake forms should match that notice where they overlap, and counsel should confirm what else the updated notice must say.

Marketing Risk Map: Where Part 2 Exposure Starts

CRM data is usable for marketing only if consent or a listed exception supports that use, since Part 2 requires written consent for most disclosures of SUD records (Accountable HQ). Prospects who never became patients are a question for counsel, so treat any record tied to your program's treatment services conservatively. As a working practice, we suggest limiting CRM access by role and keeping treatment-linked fields out of marketing automation.

Call recordings from admissions can reveal that a named caller sought treatment from your program. Store them in access-controlled systems and disclose recording at the start of the call. Don't pipe them into third-party transcription or analytics tools without an agreement your counsel has confirmed covers Part 2, because Part 2 obligations extend to those who receive its records (Accountable HQ).

Retargeting deserves the closest look. A tracking pixel on an intake form or admissions page can pass page URLs, form fields and identifiers to an ad platform, which could amount to disclosing treatment information to a party with no QSOA. Our practice is to avoid building audiences from patient lists or from visitors to treatment-specific form pages, and to strip form data from tracking events.

An intake form submission likely becomes a Part 2 record once it reaches the program, so treat the web form as part of your records system. Alumni emails need the same care. A list of former patients identifies who was treated, so event and fundraising emails should rest on consent, and every fundraising message should offer a clear opt-out. Confirm the exact requirements with counsel.

How Sweet Media Audits the Marketing Stack

Sweet Media is a behavioral health digital marketing agency in Costa Mesa, California, and we treat marketing as admissions infrastructure. That includes the forms, call tracking, CRMs and ad platforms where Part 2 data moves. Our web development work covers form builds and tracking configuration, and our analytics guidance covers measuring performance without sending sensitive data to ad platforms.

Where we handle patient-linked data for a client, we expect a QSOA or equivalent agreement to be in place first, since QSOs that receive Part 2 records carry some of its requirements (Accountable HQ). Your counsel decides what the agreement must say.

Pre-Launch Marketing Compliance Checklist

1. 1Map every system that stores or receives lead or patient data, including forms, call tracking, CRM, email and ad platforms.
2. 2Confirm each vendor has a QSOA or other valid basis for receiving SUD records.
3. 3Remove pixels and event parameters from intake and treatment-specific pages.
4. 4Check that testimonials and alumni outreach rest on specific written consent.
5. 5Match web privacy language to your updated Notice of Privacy Practices.
6. 6Write and test an escalation path for exposed exports and misdirected emails.

Enforcement and Penalties for Violations

On August 25, 2025, the HHS Secretary delegated authority to administer and enforce Part 2 to the OCR Director. If OCR finds a violation, its remedies include civil money penalties under the HIPAA Enforcement Rule. Check current penalty figures with counsel instead of relying on a number in a blog post.

Beginning February 16, 2026, anyone can file a Part 2 complaint. Patients, alumni or anyone who sees a marketing practice that looks wrong can raise it, so a problem does not need an audit to surface.

FAQ

Does a marketing agency need a qualified service organization agreement under Part 2?

Generally yes, if the agency receives or can access SUD records to provide services to your program. Some Part 2 requirements extend to QSOs that receive Part 2 records (Accountable HQ). Confirm the wording with your counsel.

Can SUD programs use CRM data for marketing?

Only when written consent or a listed exception supports that use (Accountable HQ). A TPO consent covers treatment, payment and health care operations, so keep treatment-linked records out of marketing automation unless counsel approves.

Are admissions call recordings protected?

They can be, when the caller can be identified as seeking treatment from your program. Restrict access and don't share recordings with vendors lacking a suitable agreement.

Can we build retargeting audiences from visitors or patient lists?

Patient lists should be off limits, because uploading them shares treatment status with an ad platform. Visitor-based audiences from intake or treatment pages carry similar risk, so keep tracking off those pages and ask counsel before using any audience.

Is emailing alumni about events or fundraising allowed without consent?

Generally not. The list itself identifies former patients, so you need consent, and fundraising messages should give a clear opt-out. Counsel can confirm the details.

Who enforces Part 2 and what are the penalties?

HHS OCR enforces it, using the HIPAA Enforcement Rule, which includes civil money penalties. Your counsel can confirm current figures.

If you want a second set of eyes on your forms, tracking and CRM setup, request a free media audit or book a free strategy call, and bring your counsel into the conversation.