Bookmark This! Copies of All 42 CFR Part 2 Rules Published from 1974 to 2024

by | Sep 3, 2025 | 42 CFR Part 2, Legislation & Rulemaking, Privacy & Consent, Tools & Resources

If you’ve ever wasted precious time chasing down what feels like endless versions of 42 CFR Part 2, I feel your pain. To save myself (and you) from that frustration, I pulled together every single Notice of Proposed Rulemaking (NPRM) and Final Rule, starting with the very first proposal in 1974 and running all the way through the 2024 CARES Act overhaul. (Yes, even those relics from the 1970s — mercifully, no microfiche required 🙄). In total, eight (8) Final Rules have been published since July 1, 1975 — so no wonder it’s been nearly impossible to keep them all straight.

Here’s why having the original Federal Register rules matters: the preambles, with their public comments and agency responses, give you a peek into the regulators’ own thought process. That’s where you find the reasoning, the clarifications, and the interpretive choices, and it’s almost always my first stop when grappling with the toughest and most nuanced Part 2 questions.

So, whether you’re a compliance officer, privacy lawyer, or just a regs nerd who craves quick access to the rules that matter, this list has you covered. Bookmark it, share it, and breath easy knowing you’ll never again waste hours digging through archives.

You’re welcome. 😉

Citation
Type
Short Description
Effective Date
April 16, 2024
42 C.F.R. Part 2
C.F.R.
42 CFR Part 2 Rule as published in the Code of Federal Regulations. This is the current binding regulatory language.
The changes are Effective April 16, 2024.
Enforcement begins February 16, 2026
Feb. 16, 2024
89 Fed Reg 12472
Final Rule
CARES Act implementation; aligns Part 2 with HIPAA Privacy Rule, expands patient rights, modifies consent/re-disclosure, breach notification, penalties. (160 pgs)
April 16, 2024
Compliance deadline February 16, 2026
Dec. 2, 2022
87 Fed Reg 74216
NPRM
Proposed CARES Act alignment with HIPAA; joint SAMHSA/ OCR proposal for patient rights, consent, enforcement. (72 pgs)
N/A
Dec. 14, 2020
85 Fed Reg 80626
Final Rule
Limited clarification: court has the authority to permit disclosure of confidential communications when the disclosure is necessary in connection with investigation or prosecution of an extremely serious crime, such as one that directly threatens loss of life or serious bodily injury, where the extremely serious crime was allegedly committed by either a patient or an individual other than the patient. (7 pgs)
January 13, 2021
July 15, 2020
85 Fed Reg 42986
Final Rule
"Major modernization: streamlined consent, new definitions, clarification of lawful holder/QSO disclosures, audit/evaluation. (54 pgs)
August 14, 2020
Aug. 26, 2019
84 Fed Reg 44566
NPRM
Technical correction: Proposed court-order process clarifications and conforming edits. (3 pgs)
N/A
Aug. 26, 2019
84 Fed Reg 44568
NPRM
Proposed broader modernization: disclosure for care coordination/payment, consent flexibility, new definitions. (22 pgs)
N/A
Jan. 3, 2018
83 Fed Reg 239
Final Rule
Finalizes SNPRM changes; clarifies “lawful holder” and audit/evaluation; aligns with HIPAA research exception. (14 pgs)
February 2, 2018
Jan. 18, 2017
82 Fed Reg 5485
NPRM
Proposed changes to research disclosures, audit/evaluation, lawful holder provisions. (6 pgs)
N/A
Jan. 18, 2017
82 Fed Reg 6052
Final Rule
First major update since 1987; new consent format, electronic exchange provisions, definition updates. (76 pgs)
Feb. 17, 2017
Feb. 9, 2016
81 Fed Reg 6988
NPRM
Proposed 2017 updates: electronic exchange, simplified consent, new definitions. (37 pgs)
N/A
May 5, 1995
60 Fed Reg 22296
Final Rule
Implements 1994 proposed clarifications; adjusts definition of “program” and coverage scope. (2pgs)
June 5, 1995
Aug. 18, 1994
59 Fed. Reg. 42561
NPRM
Proposed definitional and scope clarifications; updates for managed care context. (see pgs 10-12)
N/A
June 9, 1987
52 Fed Reg 21796
Final Rule
Major revisions: expands coverage, clarifies court order process, strengthens security/confidentiality standards. (see pgs 9-28)
July 9, 1987
Aug. 25, 1983
48 Fed Reg 38758
NPRM
Proposed revisions to definitions, scope, court order procedures.(see pgs 165-188)
N/A
July 1, 1975
40 Fed Reg 27802
Final Rule
Original promulgation of confidentiality rules under 42 U.S.C. § 290ee–3. (see pgs 151-171)
Aug. 1, 1975
Aug. 22, 1974
39 Fed Reg 30426
NPRM
Advance notice proposing original confidentiality regulations. (see pgs 101-113)
N/A

If you are not a subscriber to our backend Legal HIE compliance library, download our Table of Contents here to check out all of the tools, checklists, whitepapers, sample policies we make available to our members to help their organizations comply with Information Blocking, HIPAA, 42 CFR Part 2, Data Breaches and more. Ready to subscribe now? Click here to review our subscription options.

Archives