The 2024 overhaul of 42 C.F.R. Part 2 reached its February 16, 2026 compliance deadline earlier this year: its consent requirements were rewritten to align more closely with HIPAA, allowing broad, open-ended authorizations for treatment, payment, and health care operations. What many may not realize, however, is that New Jersey’s AIDS Assistance Act ties its definition of “informed consent” directly to § 2.31 of Part 2.
That link now raises a critical question:
Does New Jersey follow the newly relaxed 2024 consent standard, or is it locked into the stricter version of § 2.31 that existed back in 1989-1990, when these confidentiality protections were adopted?
The answer has enormous implications for providers, patients, and especially for today’s health information exchanges and networks, which depend on whether consent rules are flexible enough to support seamless data sharing . . . or stuck in a time warp.
The New Jersey AIDS Consent Conundrum
When New Jersey adopted these confidentiality protections under P.L.1989, c.303, effective January 12, 1990, it was stepping into uncharted waters. The HIV/AIDS crisis was not just a public health emergency but also a social and legal one. People living with HIV were being fired from jobs, evicted from apartments, and denied medical care. Fear and stigma were everywhere.
In response, the Legislature adopted a strong confidentiality law. It said, in effect: records identifying someone as having or suspected of having HIV/AIDS can only be disclosed with prior written informed consent or as otherwise permitted by the Act. For example, § 26:5C-8(b)(3) allows certain disclosures to qualified personnel directly involved in the person’s diagnosis or treatment. But here’s where things get tricky. Instead of spelling out what “informed consent” meant, the Act pointed to a federal regulation:
“Informed consent” means “consent obtained pursuant to policies and procedures prescribed in 42 C.F.R. § 2.31.” See N.J. Stat. Ann. § 26:5C-5
At the time, that regulation lived in Part 2 of the federal confidentiality rules, regulations originally designed to protect substance use disorder treatment records. Part 2 was widely regarded as the gold standard for patient confidentiality. By incorporating § 2.31, New Jersey lawmakers imported a federal model that required written, detailed, and revocable consents.
But here’s the problem: § 2.31 has not stood still. Federal regulators have updated it several times since 1987, most recently in 2024, when the Department of Health and Human Services (HHS) rewrote large portions of Part 2 to align with HIPAA and the CARES Act. Those changes created more flexibility, including broad, open-ended consents for treatment, payment, and operations, and redisclosures more in line with HIPAA.
So, the key issue is this: when New Jersey said “informed consent means consent under § 2.31,” did it mean § 2.31 as it existed when these protections were adopted (what lawyers call static incorporation)? Or does it mean whatever § 2.31 says now (a dynamic incorporation)?
The answer matters. If the incorporation is static, New Jersey’s HIV/AIDS consent standard is “frozen in time” to the 1987 version. If it’s dynamic, then later changes to § 2.31 could change the rules for HIV consent in New Jersey, potentially without the New Jersey Legislature ever voting on it.
A Historical Look at 42 C.F.R. § 2.31
The first version of § 2.31 came out in 1975. It required a written consent that checked nine boxes:
- the patient’s name
- the name of the program making the disclosure
- the name of the recipient
- the purpose
- the type of information
- a revocation clause
- an expiration date, event, or condition
- the date signed, and
- the patient’s signature.
Disclosures made with consent also had to carry a warning against redisclosure under a separate provision, § 2.32.
In 1987, the rules were updated, but they didn’t overhaul the structure. Consents still had to include the same nine elements and identify “the name or title of the individual or the name of the organization to which disclosure is to be made”; disclosures couldn’t rely on a consent that failed to substantially conform. That was the version on the books when New Jersey adopted these confidentiality protections. And that’s important because the cross-reference pointed to a very specific, very strict federal standard.
Fast-forward to 2024. HHS issued a sweeping Final Rule to modernize Part 2. The new § 2.31 is far more flexible:
- Patients can sign one consent for all future uses and disclosures for treatment, payment, and health care operations (TPO).
- Covered entities and business associates under HIPAA can redisclose Part 2 records received under a TPO consent consistent with HIPAA rules, subject to restrictions on proceedings against the patient (§ 2.33).
- Patients don’t have to name every recipient; they can authorize disclosures to a class of providers, subject to special rules for intermediaries. That federal definition excludes HIPAA covered entities and business associates.
- For TPO consents, expiration language can be as simple as “end of treatment” or even “none.”
- Patients signing TPO consents must be warned that their information may be redisclosed and lose Part 2 protection.
Compared to the 1987 version, this is a huge change. Although older consents could cover future disclosures, we now have broader recipient and expiration options that allow consents to travel more easily in today’s health IT environment.
One important caveat: New Jersey incorporates § 2.31’s consent standard, not all of Part 2. Under N.J.S.A. 26:5C-11, recipients must keep covered records confidential and may redisclose them only as the NJ AIDS Act permits.
Static vs. Dynamic Incorporation
So which version applies in New Jersey — 1987 or 2024?
Statutory interpretation gives us two options: If incorporation is static, the law locked in the 1987 version; but if it is dynamic, later amendments to § 2.31 update the incorporated consent standard.
Courts generally presume that a reference to a specific provision is static unless legislative intent indicates otherwise, for example, when a statute adds “as amended and supplemented.” New Jersey administrative law even requires agencies to identify whether incorporated material includes future amendments, although that rule governs agency rulemaking rather than the Legislature. And, notably, the AIDS Assistance Act doesn’t say “as amended.” That supports an argument that the Legislature intended a static incorporation, consistent with the Act’s protective purpose. But that purpose alone does not establish which version the Legislature intended to incorporate.
But the statute is silent, and that silence leaves room for debate. Therefore, a court could decide that New Jersey wanted to maintain ongoing harmony with federal rules and therefore intended a dynamic reading. In In re Commitment of Edward S., 118 N.J. 118, 132–35 (1990), the New Jersey Supreme Court explained that legislative intent can overcome the general incorporation rule. And there does not appear to be a published New Jersey decision resolving this particular cross-reference after the 2024 changes. That’s why this is not just an academic exercise, the ambiguity it’s a real compliance risk.
Why the Stakes are So High: Penalties & Private Lawsuits
The AIDS Assistance Act has teeth. Wrongful disclosures aren’t just technical violations. The law creates a private right of action under § 26:5C-14(a). That section provides civil remedies, not criminal penalties. The statute says:
“Each disclosure made in violation of this act is a separate and actionable offense.” N.J. Stat. Ann. § 26:5C-14(b).
That means patients can sue directly. And if a provider were to rely on the new, more flexible 2024 consent form, but a court later ruled that the stricter 1987 model is still required, that provider could be liable for wrongful disclosure if no other legal basis authorized it. Relief can include actual damages, equitable relief, and reasonable attorneys’ fees and costs, with punitive damages available for wantonly reckless or intentionally malicious conduct. The organization could also face reputational harm and years of litigation stress.
In other words, this isn’t just an interpretive puzzle for lawyers . . . it’s a real potential liability trap for providers and health systems.
Practical Implications for Providers
So, what should providers do in the face of this uncertainty?
1. Stick with the 1987 standard. The most conservative, legally defensible option is to assume New Jersey law is frozen to the 1987 version. That means every HIV consent form must check all nine boxes from § 2.31 as it existed then:
- The name of the program making the disclosure;
- The name of the individual or organization to which disclosure is to be made;
- The name of the patient;
- The purpose of the disclosure;
- How much and what kind of information is to be disclosed;
- The signature of the patient (and, when required, of a person authorized to give consent under § 2.14);
- The date on which the consent is signed;
- A statement that the consent is subject to revocation at any time except to the extent that the program has already acted in reliance on it; and
- The date, event, or condition upon which the consent will expire if not revoked before.
2. Layer in the 2024 flexibility. There’s nothing wrong with also satisfying the new 2024 requirements. In fact, dual-compliant forms may be the safest approach. Just make sure they still contain all the mandatory elements from 1987.
3. Train staff carefully. Clinical staff, records departments, and compliance officers need to understand that HIV records carry extra risk. A generic HIPAA consent form is not enough.
4. Tighten contracts with vendors. Many disclosures today flow through electronic health records and third-party vendors. Contracts should specify that redisclosure restrictions for HIV data remain in place, even if federal rules now allow broader redisclosure.
5. Push for legislative clarity. Ultimately, the safest fix is a statutory amendment. The Legislature could add “as amended” to make the incorporation dynamic, or clarify that the 1987 version controls. Until then, providers are stuck in limbo.
Unfortunately, New Jersey’s cross-reference tethers its consent standard to a moving federal target. That means New Jersey providers must navigate uncertainty about which version of the federal standard applies when updating their forms and exchange practices.
So, Where Does This Leave Us in New Jersey?
At the end of the day, the conservative position is that New Jersey’s AIDS Assistance Act incorporated the 1987 version of § 2.31. That’s what was on the books when these protections were adopted, and the specific cross-reference supports that reading. But it remains an interpretation, not a settled ruling. Until the issue is clarified, providers should evaluate whether their consents satisfy the older standard as well as any current federal requirements that independently apply. But most importantly, relying on the new 2024 flexibility alone could expose organizations to private lawsuits under § 26:5C-14.
That means, paradoxically, that the very flexibility the federal government intended to create in 2024 could become a liability in New Jersey. For now, the most prudent path is to account for the older consent safeguards, satisfy current federal requirements where they apply, and continue enforcing New Jersey’s independent disclosure restrictions while awaiting clarification.