Mental Health AI Agents and 42 CFR Part 2: The February 16, 2026 Compliance Cliff

If your AI agent answers calls for a methadone clinic, an MAT prescriber, or any SAMHSA-funded SUD program, HIPAA is the floor, not the ceiling. 42 CFR Part 2 is the ceiling, and it just got rebuilt.

What the law actually says

flowchart LR
  Voice[Voice call] --> Redact[PII / PHI redaction]
  Redact --> LLM[LLM with BAA]
  LLM --> Resp[Response]
  Resp --> Sanitize[Remove non-needed PHI]
  Sanitize --> Caller[Caller]
  Resp --> AuditDB[(Audit DB)]

42 CFR Part 2 governs the confidentiality of substance use disorder (SUD) patient records held by federally assisted programs. SAMHSA published a final rule on February 16, 2024 (89 Federal Register 12472) that aligns Part 2 with HIPAA in five major dimensions. The rule went into effect April 16, 2024 with a two-year compliance window — enforcement of the updated provisions began February 16, 2026.

The five alignment changes most relevant to AI voice agents are: (1) a single patient consent now covers all future uses and disclosures for treatment, payment, and health care operations under 42 CFR 2.31; (2) HIPAA covered entities and business associates that receive Part 2 records under that consent may redisclose under HIPAA rules at 42 CFR 2.33; (3) the HIPAA Breach Notification Rule (45 CFR Subpart D) now applies to Part 2 breaches; (4) Part 2 penalties shift from criminal-only to the civil and criminal HIPAA enforcement structure; and (5) patients gain HIPAA-style rights to an accounting of disclosures and to request restrictions.

Critically, even after alignment, Part 2 still prohibits use of Part 2 records in legal proceedings against the patient without specific written consent or a court order — a protection that exceeds HIPAA.

What this means for AI voice and chat agents

An AI voice agent at a Part 2 program collects, by definition, Part 2 records the moment a caller says "I'm calling about my methadone dose" or "I have an appointment for my buprenorphine refill." That utterance, the call recording, the transcript, the AI summary, and the post-call analytics are all Part 2 records.

The single-consent simplification helps — once a patient signs the new omnibus consent, downstream HIPAA business associates (the EHR, the claims clearinghouse, the AI vendor) can move records under HIPAA rules. But the agent still needs to: (a) recognize Part 2 status at intake; (b) capture and version the consent; (c) tag every record produced by the call as a Part 2 record so segmentation rules can fire; (d) prevent the records from being used in legal proceedings without explicit additional authorization; and (e) honor the new accounting-of-disclosures right under 42 CFR 2.25.

How CallSphere implements

CallSphere ships a behavioral-health workflow at /lp/behavioral-health that turns Part 2 mode on by default for SUD-coded clinics. The intake flow captures the omnibus consent at the first call, records the consent version, and tags every record produced thereafter with a Part 2 flag in the healthcare_voice PostgreSQL database. Tagged records are excluded from non-Part-2 reporting paths automatically. Sentiment, lead score, and AI summary still run, but the segregated tag flows through every downstream view. Accounting of disclosures is generated on demand. Breach notifications use the HIPAA timeline (60 days, business associate to covered entity). Practices treating opioid use disorder, alcohol use disorder, or running residential SUD programs should explore /industries/behavioral-health and /lp/behavioral-health, and start with a 14-day trial.

Compliance and build checklist

1. Identify whether your program is "federally assisted" under 42 CFR 2.12(b) — most are, even via Medicaid alone.
2. Capture the new omnibus consent under 42 CFR 2.31 at first contact and version it.
3. Tag every record (audio, transcript, summary, sentiment, lead score) as Part 2 in the database.
4. Block use of Part 2 records in legal-discovery exports without 42 CFR 2.63/2.64 authority.
5. Apply the HIPAA Breach Notification Rule timing to Part 2 breaches (60-day ceiling).
6. Generate accounting-of-disclosures on patient request under 42 CFR 2.25.
7. Train the agent to never disclose Part 2 status to a third party without consent — including to an employer or family member.
8. Confirm every sub-processor BAA covers Part 2 records, not just HIPAA PHI.
9. Update the Notice of Privacy Practices to the aligned Part 2 patient notice.
10. Document segmented-record handling in the risk analysis as an AI-specific control.
11. Reconfirm SAMHSA program status annually.

FAQ

Did 42 CFR Part 2 go away? No. It was aligned with HIPAA on the consent, breach, and penalty mechanics. The core protection — heightened confidentiality of SUD records — remains, especially around legal proceedings.

When does the new rule have to be in place? April 16, 2024 effective date, with a two-year compliance window. Enforcement of the new provisions began February 16, 2026.

Can a single consent cover treatment, payment, and operations? Yes, under 42 CFR 2.31 as amended. That is the headline simplification of the 2024 rule.

Does the AI agent need its own Part 2 designation? No. It operates as a HIPAA business associate. But records originating from a Part 2 program retain their Part 2 status when the agent processes them.

Are mental-health-only practices covered by Part 2? No. Part 2 covers SUD records held by federally assisted SUD programs. A general therapy practice that does not meet the 42 CFR 2.11 program definition is HIPAA-only.

Sources

• HHS, Fact Sheet: 42 CFR Part 2 Final Rule: https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html
• Federal Register, 89 FR 12472 (Feb 16, 2024): https://www.federalregister.gov/documents/2024/02/16/2024-02544/confidentiality-of-substance-use-disorder-sud-patient-records
• 42 CFR Part 2, eCFR: https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2
• HHS Understanding Part 2: https://www.hhs.gov/hipaa/for-professionals/special-topics/hipaa-part-2/index.html
• SAMHSA, Confidentiality Regulations: https://www.samhsa.gov/about-us/who-we-are/laws-regulations/confidentiality-regulations-faqs