Student substance use records can reach a school through a discharge summary, a referral packet, or an outside provider preparing a student to return to class. The team wants to help. Someone forwards the document to the case manager, adds it to a meeting folder, and assumes the release on file covers the next handoff. That assumption deserves a closer look this school year.

The updated federal confidentiality rules at 42 CFR Part 2 reached their compliance deadline on February 16, 2026. They make some treatment-related information sharing easier, but the rules still depend on the source of the record, the recipient, and the authority for the disclosure. A school team cannot resolve those questions by calling everyone a member of the care team.

For school-based clinicians and behavioral health practitioners, the useful task is concrete: build a reliable check between receiving sensitive information and sharing it again. This article offers a workflow for that check, not legal advice or a substitute for reviewing the rules that apply to a particular student and service arrangement.

What changed in 2026

HHS finalized the Part 2 changes in 2024 and required compliance by February 16, 2026. Part 2 refers to 42 CFR Part 2, the federal confidentiality regulations that provide heightened protections for records involving substance use disorder treatment from federally assisted programs. This is an existing requirement entering a new school year, not a regulation announced this week. HHS also identifies February 16 as the start of its current Part 2 complaint process through the Office for Civil Rights.

One major change permits a single consent for future uses and disclosures for treatment, payment, and health care operations. HHS calls this a TPO consent. HIPAA covered entities and business associates receiving records under that consent can generally redisclose them as HIPAA permits, subject to important restrictions, including protections against use in proceedings against the patient.

That permission is specific. It does not establish that every employee receiving a record has the same authority to pass it along. The question for a school remains: what rules govern this recipient and this proposed use?


Start student substance use records review with the source

Part 2 protects qualifying records connected to federally assisted substance use disorder programs. The regulatory definition of a program includes how it presents its services and what it actually provides. Federal assistance alone does not make every school counseling program a Part 2 program, and a reference to alcohol or drug use does not automatically settle a record's status.

An outside treatment summary and a school employee's independent observation may therefore require different analyses. Receiving protected records can also create obligations even when the recipient does not operate a Part 2 program. Do not assume the school's usual record-handling rule answers every question about an outside document.

At intake, ask the sending provider to identify the record's origin, the applicable confidentiality framework, and the authority used to send it. Keep the accompanying notice and consent information with the record in the approved system. If the answer is unclear, assign someone to resolve it before routine circulation. Missing information should create a follow-up task, not a guess.

Check the recipient, purpose, and consent together

The HIPAA-FERPA distinction still matters. HHS explains that student health records maintained by a school subject to FERPA, or by a provider acting on its behalf, are generally education records. An independent provider's records can be treated differently, even when services happen on campus. For that provider, HIPAA coverage also depends on covered-entity status. The office location and the clinician's license do not answer the entire question.

Part 2 adds another inquiry where it applies. A lawful disclosure to one recipient does not, by itself, establish authority for the next disclosure. Review the consent, the recipient's role, the proposed purpose, and any applicable restrictions together. A generic release should not be treated as sufficient without checking the Part 2 consent requirements.

Minors require particular care. Under 42 CFR 2.14, when state law lets a minor independently obtain substance use disorder treatment, the minor alone provides the written consent authorized under Part 2's consent provisions. Where state law requires parental consent to that treatment, those provisions generally require both signatures. The regulation also contains specific exceptions. Neither rule can be reduced to "the parent signed, so we are covered."

Use qualified consultation to identify the relevant state law and any applicable exception. Avoid applying a mental health minor-consent rule to substance use treatment without verifying that it covers the service involved. An annual school permission form may answer a different question entirely.