Substance use disorder records consent

How do we capture a patient's specific consent before any substance use disorder record covered by 42 CFR Part 2 is shared, and record it so later disclosures are checked against it?

Treat every Part 2 disclosure as blocked until a consent that fits it exists. When a request would share records from a Part 2 program (a referral, a payer request, a records release, a care coordination exchange), Callvu classifies the records as Part 2 from the program and the encounter type, lists the consent elements the rule requires for that disclosure (the recipient, the purpose, the information, the expiration, the right to revoke, the redisclosure notice), captures the patient's signature on a secure screen or chases the signed form, routes an ambiguous or emergency case to the privacy officer in the Decision Desk, records the consent in the EHR with its scope and dates, and enforces it on every later release so a request outside the scope stops.

In scopeComplex: multi-party handoffsCallvu moves: chase and verify, decide, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The treatment notes went to the primary care office with the general release, and the program learned about it from the patient.

Today, without Callvu

A patient treated for a substance use disorder signs the hospital's general HIPAA release. A referral, a payer audit or a records request later pulls their whole chart, including the program's notes. The general release never covered them, the recipient was never told the redisclosure limits, and the breach is discovered by the patient, who now trusts nobody.

Records from a federally assisted substance use disorder program are protected by 42 CFR Part 2 on top of HIPAA: disclosure needs a written consent with specific elements, the consent's scope and expiration govern every later release, the recipient must receive the redisclosure notice, and exceptions (medical emergencies, audits, research, court orders) are narrow and must be documented. A general release does not qualify, and the record system has to know which records are Part 2.

A consent that is captured once with the right elements and enforced on release is the difference between coordination and a breach.

How it runs

From the requestto the system of record.

A disclosure of records from a Part 2 program is requested or proposed (a referral, a payer request, a release of information, a care coordination exchange). Callvu classifies the records and opens the consent.

Patient: Reads the consent in plain terms, chooses the scope, and signs on a secure screen; may revoke later.
Program staff: Confirm the records and the program, and help the patient where needed.
Privacy officer: Decides ambiguous cases, emergencies and exceptions in the Decision Desk.
Callvu: Classifies the records, lists the consent elements, captures or chases the signature, routes, records and enforces.

Classify the records and the disclosure
The encounter's program, the record types and the proposed recipient and purpose classify the disclosure as Part 2 or not and, if Part 2, which path applies: a patient consent, a medical emergency, an audit or evaluation, research, or a court order; a consent path lists the elements the rule requires for this recipient and purpose, including whether a general designation to treating providers is allowed.
Chase and verify the consent
The consent is presented to the patient on a secure screen in plain terms with the recipient, the purpose, the information to be disclosed, the expiration date or event, the right to revoke and the consequences of refusal; the patient signs, or a signed paper form is uploaded, read and checked for every element; a consent missing an element is sent back with the specifics, never filed.
Decide
A complete consent for a standard disclosure proceeds by rule; an emergency disclosure, a request that cites an exception, a minor's consent under the state's rules, a consent whose scope does not match the request, or a revocation with disclosures in flight goes to the privacy officer in the Decision Desk with the record and only the allowed outcomes (disclose within the scope, disclose under the documented exception, refuse, or ask the patient for a new consent).
Write back and enforce
The consent with its scope, recipient, purpose, expiration and signature is recorded in the EHR against the Part 2 records, the disclosure goes out with the redisclosure notice attached, the disclosure is logged for the accounting, and every later release request against those records is checked against the consent on file so a request outside the scope or after expiration stops.

Where it ends: No Part 2 record left the program without a consent with every element or a documented exception, the recipient received the redisclosure notice, and the EHR holds the consent that every later release is checked against. The Decision Trace shows the classification, the elements and any decision; the Audit Trace shows the signature, the disclosure and the notice with time.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

42 CFR Part 2 (confidentiality of substance use disorder patient records): Records of the identity, diagnosis, prognosis or treatment of a patient maintained by a federally assisted substance use disorder program may be disclosed only with a written consent that includes the elements in 42 CFR 2.31 (the patient's name, the program or the entity permitted to disclose, how much and what kind of information, the recipient or a general designation where permitted, the purpose, the right to revoke, the expiration date or event, the signature and date), or under a listed exception (medical emergency under 2.51, research under 2.52, audit and evaluation under 2.53, a court order under subpart E); each disclosure must carry the notice prohibiting redisclosure in 2.32; the 2024 final rule aligns the consent with HIPAA for treatment, payment and operations where the patient gives a single consent and adds the accounting of disclosures and the breach rules.
HIPAA Privacy Rule (45 CFR 164.508 and 164.520) as the baseline: A Part 2 disclosure must also satisfy HIPAA where the program is a covered entity; the HIPAA authorization elements overlap with 2.31 and the notice of privacy practices must describe the Part 2 protections; the stricter rule governs.
State substance use and mental health confidentiality laws and minor consent rules: States add their own confidentiality protections and set whether a minor may consent to treatment and to disclosure without a parent; the classification applies the state's rule to the consent path.

Company policies

Part 2 records are tagged in the EHR, and a general release never disclosures them; the consent must fit the disclosure.
Every consent is checked for every element before it is filed.
Exceptions are decided by the privacy officer and documented, never assumed by the requester.
The EHR is the system of record for the consent, and every later release is checked against it.

Controls

Part 2 record classification by program and encounter.
Consent element list by recipient and purpose.
Secure signature capture or signed form reading with element checks.
Decision Desk for exceptions, scope mismatches and revocations.
EHR consent record with redisclosure notice on each disclosure.
Enforcement on later releases and the disclosure log.

Clocks and deadlines

Consent expiration: The date or event the patient set; disclosures after it stop.
Revocation: Effective on receipt, with disclosures already in flight recorded.
Accounting of disclosures: Each disclosure logged for the accounting the rules require.

Documents and checks

The record classification
The consent with every element and the signature
Any privacy officer decision and the exception documentation
The disclosure with the redisclosure notice
The EHR consent record and the disclosure log

In the Decision Trace

The classification and the path.
Each element checked.
Any decision and the person.

In the Audit Trace

The signature with time and device.
Each disclosure with the notice and time.
Each later release check against the consent.

The handoff

Between the front doorand the back office.

The front door

The patient on a secure screen in the program or on their phone; a signed form uploaded by staff.

The back office

The privacy officer sees only exceptions and mismatches; release of information runs against the consent on file.

The Decision Desk

An emergency disclosure, a cited exception, a minor's consent, a scope mismatch or a revocation with disclosures in flight goes to the privacy officer in the Decision Desk with the record and only disclose within scope, disclose under the documented exception, refuse, or request a new consent.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

23 hospitals in the Ministry of Health network run on Callvu.

Across Callvu customers

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

Questions

What buyers ask next,answered plainly.

Does the hospital's general release cover these records?

No. Records from a Part 2 program need a consent with the specific elements in 42 CFR 2.31 for the recipient and purpose, or a documented exception; the process will not release them on a general form.

What does the recipient receive with the records?

The notice prohibiting redisclosure that the rule requires, attached to every disclosure and logged.

What happens when the patient revokes?

The revocation takes effect on receipt, later releases stop, and any disclosure already in flight is recorded and reviewed by the privacy officer.

Related processes

HIPAA authorizations Release of information requests Research informed consent Notice of Privacy Practices acknowledgment Try it in the sandbox All healthcare processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.