If your practice treats substance use disorders in Texas, you’re not just working under HIPAA. You’re managing two more layers most guides never mention together — federal 42 CFR Part 2, and Texas’s own privacy law, House Bill 300. Miss how the three interact, and a routine records request can turn into a compliance problem fast.
Quick answer: HIPAA sets the national baseline and generally allows sharing for treatment, payment, and operations without separate authorization. Understanding 42 CFR Part 2 Texas requirements alongside HIPAA is essential. It is stricter and narrower — it applies to substance use disorder records from federally assisted programs and generally requires patient consent even for routine sharing. Texas HB 300 adds a third, state-level layer on top of both.
What HIPAA Covers
HIPAA is the framework most providers already know — national standards allowing covered entities to use and disclose records for treatment, payment, and healthcare operations without separate authorization for each instance. Broad and flexible by design.
What 42 CFR Part 2 Covers
Part 2 is different. It applies specifically to records from federally assisted programs providing SUD diagnosis, treatment, or referral — not every Behavioral Health Practice falls under it, but plenty do without realizing it. Historically, it required specific written consent before disclosing SUD records, even for routine treatment or payment purposes, with only narrow exceptions like medical emergencies.
It also carries a redisclosure prohibition: once someone receives Part 2-protected information, they generally can’t pass it along further without meeting Part 2’s own rules — a restriction HIPAA doesn’t impose the same way.
Key Differences at a Glance
| HIPAA | 42 CFR Part 2 | |
| Consent for treatment/payment | Generally not required separately | Traditionally required specific consent |
| Redisclosure | Allowed under HIPAA’s rules | Restricted — recipient bound by Part 2 |
| Consent revocation | Must be in writing | Can historically be verbal |
| Scope | All protected health information | SUD records from federally assisted programs only |
That consent revocation difference trips up more practices than you’d expect — a patient can verbally revoke Part 2 consent in a way that wouldn’t be sufficient under HIPAA for other records.
Related Resource
Strengthen HIPAA Compliance Across Your Revenue Cycle
Protect patient information, reduce compliance risks, and improve billing workflows with expert medical billing and revenue cycle support.
The Texas Layer: Where HB 300 Fits In
Here’s what most national guides skip entirely. Texas House Bill 300 (Texas Health & Safety Code Chapter 181) sits on top of both federal rules and goes further than either alone. It applies to a broader range of entities than HIPAA, treats mental health and substance use records as “Super-Confidential Information” requiring explicit authorization, and requires notifying the Texas Attorney General if a breach affects 250 or more Texas residents. A Texas behavioral health practice handling SUD treatment isn’t managing two overlapping behavioral health privacy laws — it’s managing three.
What Changed in 2024
In February 2024, HHS and SAMHSA finalized a rule aligning Part 2 more closely with HIPAA, as required by the CARES Act. It took effect April 16, 2024, with full compliance required by February 16, 2026. Among the changes: a single patient consent can now cover future treatment, payment, and operations disclosures instead of requiring consent each time, and recipients can generally redisclose Part 2 records the way HIPAA permits, in most cases. It narrows the gap with HIPAA — it doesn’t erase it, and HB 300 obligations remain unaffected either way.
Practical Compliance Checklist
Getting behavioral health HIPAA compliance right in Texas means –
- Confirm whether your practice actually meets Part 2’s “federally assisted program” definition
- Update consent forms to reflect the 2024 single-consent changes ahead of the February 2026 deadline
- Make sure EHR systems can segment SUD records appropriately
- Train front-line staff on all three layers — HIPAA, Part 2, and HB 300 — not just HIPAA alone
- Handle verbal consent revocations correctly under Part 2, even when HB 300 or HIPAA would expect something in writing
Why Choose Acuity Health Solutions
Behavioral health compliance in Texas isn’t a one-law problem. Acuity Health Solutions team understands how HIPAA, 42 CFR Part 2, and HB 300 interact in practice — not just in theory — and helps practices build documentation and consent processes that hold up across all three. Talk To Our Team about your compliance program.
Conclusion
For most healthcare providers, HIPAA is the only privacy framework they ever need to think about closely. Texas behavioral health practices treating substance use disorders don’t have that luxury — HIPAA, 42 CFR Part 2, and HB 300 all apply at once, each with its own consent rules, disclosure limits, and deadlines to track. The 2024 Part 2 update makes some of this easier, but it doesn’t collapse three frameworks into one. The practices that stay out of trouble are the ones that build consent forms, workflows, and staff training around all three layers from the start, rather than retrofitting compliance after a records request goes wrong.
Frequently Asked Questions
Does 42 CFR Part 2 apply to every behavioral health practice in Texas?
No — only federally assisted programs providing SUD diagnosis, treatment, or referral. Many practices fall outside it entirely.
Does the 2024 Part 2 update mean it's now the same as HIPAA?
No — it narrows some gaps, like allowing single consent for TPO, but Part 2 remains stricter and narrower in scope than HIPAA.
How does HIPAA behavioral health guidance differ from 42 CFR Part 2?
It adds a state-level layer on top of both federal frameworks.
Helpful Links -:
