Most healthcare cybersecurity guidance focuses on HIPAA. For Federally Qualified Health Centers that provide substance use disorder treatment, medication-assisted treatment (MAT), or behavioral health services with a substance use component, HIPAA is not the only privacy framework that applies.
42 CFR Part 2 — the federal confidentiality regulations for substance use disorder patient records — imposes requirements that are stricter than HIPAA in specific ways. The intersection of 42 CFR Part 2 and HIPAA creates a dual compliance obligation that has direct cybersecurity implications: which data must be most protected, how access is controlled, what breach notification looks like, and how records may be shared.
Understanding both frameworks — and how to build a cybersecurity program that satisfies both — is essential for any FQHC providing substance use services.
What 42 CFR Part 2 Covers
42 CFR Part 2 protects the records of patients receiving substance use disorder treatment at federally assisted programs. For FQHCs, "federally assisted" includes any program that receives Section 330 grant funding — which applies to virtually all FQHCs.
The records protected under Part 2 include any information that:
- Identifies a patient as having or having had a substance use disorder
- Is maintained in connection with a federally assisted substance use disorder treatment program
- Could be used to identify the patient as a current or past recipient of substance use disorder treatment
The breadth of this definition means that any documentation of substance use disorder treatment — EHR notes, prescriptions for MAT medications (buprenorphine, methadone), counseling session records, referral notes, billing codes — is potentially protected under 42 CFR Part 2.
How 42 CFR Part 2 Is Stricter Than HIPAA
Disclosure Limitations
HIPAA permits disclosure of PHI for treatment, payment, and health care operations without patient authorization (within defined limits). 42 CFR Part 2 requires patient authorization for most disclosures — including disclosures for treatment purposes that HIPAA would allow without authorization.
A hospital requesting records from your FQHC for a patient who was treated for opioid use disorder may need specific 42 CFR Part 2 authorization before those records can be disclosed — even for routine care coordination.
Breach Notification Specificity
Under HIPAA, a breach of PHI triggers notification to affected individuals and HHS. Under 42 CFR Part 2 as updated in 2024, a breach of Part 2 records triggers HIPAA-aligned breach notification procedures — but the records must be identified as Part 2-protected in the notification process.
Access Segregation
Many FQHCs with integrated behavioral health must consider whether their EHR can segregate Part 2-protected records from general medical records — allowing access for authorized users (behavioral health staff) while restricting access for unauthorized users (general medical staff) even within the same EHR system.
Not all EHR systems support Part 2 record segregation. Understanding your EHR's capabilities and configuring access controls accordingly is a compliance obligation.
The Cybersecurity Implications of Dual Coverage
Access Control Must Be Finer-Grained
A general medical record at an FQHC may be accessible to any clinical staff member with a legitimate treatment relationship. A 42 CFR Part 2 substance use disorder record must be restricted to authorized staff even within the clinical team.
This requires:
- EHR role-based access configuration that specifically restricts Part 2 record access to authorized behavioral health staff
- Audit logging that separately tracks access to Part 2-protected records
- User awareness training that explicitly addresses Part 2 restrictions
Breach Response Has Additional Steps
If a cybersecurity incident results in unauthorized access to records that include Part 2-protected information: