HIPAA Part 2 & Psychotherapy Notes Compliance in Telehealth (2026)

When HIPAA Part 2 and HIPAA Collide: Dual Regulation in Behavioral Health

Behavioral health providers treating substance use disorder (SUD) must satisfy two separate federal confidentiality regimes:

The practical collision: A telehealth provider treating a SUD patient must satisfy the stricter Part 2 standard. When Part 2 applies, the HIPAA TPO logic does not; explicit, written SUD-specific consent is required before disclosing SUD treatment records to anyone — including the patient's PCP, specialist, or another care setting within the same organization.

42 CFR Part 2: The SUD Confidentiality Standard

What Triggers Part 2 Applicability?

42 CFR Part 2 applies to any program or provider that:

• • Holds a federal SUD license (DEA, state medical board, or SAMHSA certification)
• • Treats SUD patients with federal funding (Medicare, Medicaid, grants, Veterans Affairs)
• • Receives federal SUD treatment funding of any kind (even if treating private-pay patients)
• • Operates a federally-qualified health center (FQHC) or community health center (FQHC) that treats SUD

The key rule: If a single patient is treated for SUD using any federal funding, Part 2 covers ALL records related to that patient's SUD diagnosis and treatment — regardless of whether individual services are federally-funded or privately-paid. The funding applies to the program, not the transaction.

Part 2 Consent Requirements

Part 2 requires written, specific consent before any disclosure of SUD records. The consent form must:

• • Name the specific recipient (e.g., "Dr. Jane Smith, Cardiology, Houston Medical Center")
• • Specify the purpose (e.g., "treatment coordination for hypertension management")
• • Specify the records (e.g., "diagnosis and medication history only; NOT clinical notes")
• • Date of expiration (consent is time-limited; Part 2 does not allow blanket, indefinite consent)
• • Patient signature and date — verbal consent is insufficient; written form is mandatory

Part 2 Prohibition on Redisclosure

Once a provider receives SUD records under Part 2 consent, they may not re-disclose them without a new, separate Part 2 consent from the patient. This is called the "redisclosure prohibition" (42 CFR 2.34). If a patient's PCP receives a SUD diagnosis from the telehealth provider, the PCP cannot forward that to a specialist without the patient's consent again — even if the specialist is treating the same patient.

Psychotherapy Notes: The 45 CFR §164.508(a)(2) Standard

Psychotherapy Notes Are Distinct from Medical Records

Under HIPAA, psychotherapy notes (recorded impressions of the provider during a mental health session) carry a distinct authorization requirement separate from the general HIPAA authorization. Per 45 CFR §164.508(a)(2), a covered entity may not use or disclose psychotherapy notes without a separate, specific authorization for psychotherapy notes alone.

Psychotherapy notes include: the provider's subjective impressions, treatment plans, observed behaviors, session-by-session assessments, and clinical reasoning. They do not include: medication records, medical history, lab results, diagnoses, and appointment times (these are part of the standard medical record).

Psychotherapy Notes Authorization Requirement

For psychotherapy notes disclosure, the authorization form must:

• • Clearly state that it authorizes disclosure of psychotherapy notes specifically
• • Cannot be combined with a general medical records authorization
• • Must identify the recipient, purpose, and expiration date (same as Part 2)

Break the Glass: Emergency Override Under Part 2

Part 2 Break the Glass Conditions

Part 2 permits disclosure without patient consent only in specific, limited emergency situations (42 CFR 2.51):

• • Medical emergency: A patient is in imminent danger due to overdose, severe withdrawal, or acute psychiatric crisis, and the disclosure is necessary to prevent death or serious bodily injury
• • Limited scope: Only the minimum necessary information (e.g., substance, dose, time of administration if known) may be disclosed
• • Documentation required: The provider must document the emergency in the patient record, including the reasoning and the information disclosed

Cross-Line Clinical Sharing: Part 2 vs. HIPAA in Multi-Service Organizations

The Scenario

A behavioral health provider (SUD/therapy) and a primary care provider operate in the same organization (e.g., an integrated clinic, a hospital, or a large telehealth platform offering both). The patient is treated by both lines and has authorized release of medical records for treatment coordination.

Under HIPAA alone, the PCP can access the behavioral health record for treatment, payment, and operations (TPO) — no additional authorization needed.

Under Part 2, the SUD treatment record cannot be accessed by the PCP without a separate, specific Part 2 consent from the patient. HIPAA TPO does not override Part 2. The psychotherapy notes cannot be accessed without a separate psychotherapy notes authorization.

Workflow Solution: Separate Authorizations for SUD vs. General Medical

Best practice requires three authorization forms at the time of intake:

FAQ: HIPAA Part 2 & Psychotherapy Notes in Telehealth

Does my telehealth behavioral health program fall under Part 2?

If you treat any SUD patients and receive any federal funding (Medicare, Medicaid, VA, grants, or are an FQHC), the answer is yes. If you treat only non-SUD behavioral health (depression, anxiety, ADHD without substance use history) and never receive federal funding for SUD treatment, Part 2 may not apply — but HIPAA's general privacy rule (45 CFR Part 160) and the psychotherapy notes authorization still do.

Can I use a blanket authorization for SUD and psychotherapy notes?

No. Part 2 requires specific, written consent for each disclosure, with named recipients, specified purpose, and expiration date. Psychotherapy notes require a separate authorization distinct from general medical records. Blanket or indefinite authorizations violate both Part 2 and the psychotherapy notes standard. SAMHSA and the OCR both cite this as a violation.

Can my SUD intake assessment share diagnosis with the patient's PCP without consent?

Not under Part 2, even if both providers are in the same organization and the patient has authorized general medical record release. Part 2 overrides HIPAA TPO. A separate, specific Part 2 consent naming the PCP is required before SUD diagnosis is shared.

Can I disclose SUD records in an emergency without consent?

Part 2 Break the Glass applies only when the patient is in imminent danger of death or serious bodily harm due to overdose, withdrawal, or acute crisis. The minimum necessary information may be disclosed (substance, amount, time). A patient requesting an appointment, expressing suicidality without acute overdose/withdrawal risk, or a routine safety plan do not meet the Part 2 emergency standard. Documentation of the emergency in the patient record is required.

Do I need separate documentation for psychotherapy notes vs. medical records?

Yes. HIPAA requires that psychotherapy notes be maintained separately from the medical record and not disclosed without a distinct authorization. Best practice is to store session notes in a separate, access-controlled section of the EHR and to require a separate signature for psychotherapy notes disclosure.

Resources & Regulatory References

• 42 CFR Part 2 (Confidentiality of SUD Records): www.ecfr.gov — Part 2 Full Text
• 45 CFR Part 160 (HIPAA Privacy Rule): www.ecfr.gov — 45 CFR Part 160
• 45 CFR §164.508(a)(2) (Psychotherapy Notes Authorization): www.ecfr.gov — 45 CFR §164.508
• SAMHSA Part 2 Guidance & FAQs: SAMHSA Part 2 Center
• OCR HIPAA Enforcement & Part 2 Compliance: HHS Office for Civil Rights (OCR)