42 CFR Part 2 SUD Billing Confidentiality Workflow Guide

The pattern we’re seeing across roughly 50 behavioral health and SUD practices right now is remarkably consistent: providers assume that the 2020 and 2023 amendments to 42 CFR Part 2 simplified their billing obligations enough that legacy workflows are still compliant. They are not. Since the CARES Act amendments took effect and SAMHSA finalized its March 2024 rule aligning Part 2 more closely with HIPAA, payers have quietly updated their audit triggers, and practices are absorbing denials and clawbacks they cannot easily trace back to the root cause.

At Revenant Care Group, we work inside the revenue cycle of SUD-focused practices daily, and what we see is that the confidentiality requirements of 42 CFR Part 2 are not just a compliance checkbox. They create specific, concrete workflow requirements at the point of claim submission, authorization, and remittance posting that most billing teams have never been trained on. The financial exposure is real: a mid-size outpatient SUD practice billing 300 to 500 claims per month can lose $18,000 to $45,000 annually in preventable denials tied directly to Part 2 missteps.

What Changed in 2024 and Why It Affects Your Claims Today

SAMHSA’s 2024 final rule, effective February 16, 2024, brought 42 CFR Part 2 into closer alignment with HIPAA, but the alignment is not identical. The critical billing-side change is that Part 2 programs can now use and disclose patient records for payment purposes to health plans without a separate patient consent, provided the disclosure falls within the updated definition of “payment activities.” However, the operative word is “program.” If your practice is a Part 2 program, meaning SUD treatment is your primary function or you hold yourself out as providing SUD treatment, the full regulatory framework applies to every claim you touch.

In practice, this means your clearinghouse transmissions, your ERA data, and any coordination-of-benefits exchanges must be handled in a way that does not create impermissible secondary disclosures. We see billing teams using shared clearinghouse portals where mental health and SUD claims co-mingle in the same queue. That creates downstream audit exposure even when individual claims are coded correctly.

CPT Codes, POS Codes, and the Claim-Level Confidentiality Risk

The codes themselves are not confidential. A claim for H0015 (alcohol and/or drug services, intensive outpatient), H2036 (alcohol and/or drug treatment program, per diem), or T1006 (alcohol and/or drug counseling) submitted to a commercial payer does not violate Part 2 on its face. The violation risk lives in what accompanies the claim: diagnosis codes, clinical notes attached as attachments, and referral documentation that identifies a patient as a Part 2 program participant beyond what is minimally necessary for payment.

Specific coding considerations we enforce for Part 2 practices in 2026:

• POS 57 (Non-Hospital-Based Outpatient): Used for outpatient SUD visits when services are provided in a free-standing facility. Mixing POS 11 and POS 57 on the same patient without clear documentation of service location creates payer questions that pull records.
• POS 72 (Rural Health Clinic, Non-Provider-Based): RHC-based SUD programs have a layered compliance obligation. The rural health clinic cost report interacts with Part 2 disclosures in ways that can trigger both billing errors and compliance violations simultaneously.
• Modifier HF: Substance abuse program modifier. When HF appears on a claim, it is a disclosure that the service was SUD-related. Your staff must understand that attaching clinical documentation to an HF-modified claim that goes beyond what the payer needs for adjudication is a potential Part 2 violation, not just a documentation preference.
• Drug screen coding: If your SUD practice is billing G0480 through G0483, every result disclosure to a payer is a Part 2-governed event. We have written separately about how most SUD practices are under-coding these panels, but the confidentiality workflow around them matters equally. See our analysis of G0480 to G0483 drug screen coding and the revenue impact of under-coding.

The Authorization Intake Bottleneck That Creates Billing Failures

Most Part 2 denials we recover do not start in billing. They start in intake. When a patient signs a general HIPAA authorization at intake, and your billing team uses that authorization to respond to a payer’s medical records request post-claim, that is a problem. Part 2 requires that any disclosure of SUD records for a purpose beyond the original payment transaction meet specific written consent elements: the name of the person or organization to whom disclosure is made, the amount or nature of information to be disclosed, the purpose of the disclosure, the patient’s right to revoke, and an expiration date or event.

We recommend a dual-authorization intake model: one HIPAA-compliant authorization for general healthcare operations and a separate, Part 2-compliant consent that names each payer by entity, specifies SUD treatment as the subject matter, and includes an expiration event tied to the episode of care. This adds two to three minutes to intake but eliminates the single largest source of post-adjudication clawback risk we see in SUD practices.

ERA and Remittance Posting: The Overlooked Disclosure Point

When a payer sends an 835 electronic remittance advice, that file contains patient identifiers, service codes, and often remark codes that describe why a claim was adjusted. If that ERA file is routed through a shared practice management system where staff without a need-to-know relationship to the Part 2 program can view SUD-specific remittance data, you have created an internal impermissible disclosure.

The fix is not complicated but it requires deliberate configuration. In most modern practice management systems, role-based access controls can segment ERA visibility by program type. We configure this for every SUD client we onboard. The annual cost of not doing it, across practices billing 400 or more SUD claims per month, typically runs between $22,000 and $60,000 in audit-triggered recoupments when a payer or state agency reviews your remittance access logs.

Payer Audits and the MHPAEA Intersection

One dynamic we are watching closely in 2026 is the intersection of 42 CFR Part 2 compliance reviews and mental health parity audits. Payers conducting utilization management reviews under MHPAEA obligations are pulling SUD records at higher rates than two years ago. When they pull those records, the disclosure pathway your practice used to respond to that request is itself a potential Part 2 audit point. If you are navigating parity appeals alongside Part 2 compliance, those two tracks must be coordinated by the same compliance-aware RCM team. We have detailed the parity appeal framework separately at our MHPAEA parity appeals resource for behavioral health practices.

Building the Compliant Billing Workflow: A Practical Checklist

For any SUD practice that wants to operationalize Part 2 compliance at the billing level, the following are the non-negotiable workflow elements we implement:

• Intake: Separate Part 2 consent from general HIPAA authorization. Consent must name specific payers.
• Authorization management: Prior auth requests to payers should transmit only the minimum necessary clinical data. Strip narrative notes from auth packets unless specifically required.
• Claim submission: Implement a pre-submission scrub rule that flags any SUD claim with an attached document longer than what your payer contract specifies as required for adjudication.
• ERA routing: Configure role-based access in your PMS so SUD remittance data is viewable only by staff designated within your Part 2 program definition.
• Records requests: Create a separate Part 2 records request response protocol distinct from your HIPAA records policy. Every response should be logged with the consent element it relied on.
• Annual review: Conduct a formal Part 2 workflow review each January to incorporate any SAMHSA guidance or payer policy updates issued in the prior year.

If you are a CFO or RCM director at a SUD or behavioral health practice and you are not certain whether your current billing workflow is exposing you to Part 2-related recoupments, the most efficient first step is a structured denial audit. At Revenant Care Group, we offer a free 30-day denial audit that maps your current denial patterns against Part 2, MHPAEA, and payer-specific compliance triggers. You can schedule directly at our audit scheduling calendar. Thirty days of data is typically enough to identify the two or three workflow gaps that account for the majority of your recoverable revenue.