Subpoenas and Court Orders for SUD Records Under 42 CFR Part 2: The Legal Request File Behavioral Health Operators Need

A process server walks into the lobby of a residential substance use disorder program and hands the front desk a subpoena for a former client’s records. The receptionist, trying to be helpful, says the client “hasn’t been here in months.” In that one sentence, the program may already have made an unauthorized disclosure. Under 42 CFR Part 2, confirming that someone is or was a patient of a federally assisted SUD program is itself protected information, and a subpoena on its own does not authorize releasing it.

This post is for owners, clinical directors and compliance officers who need a working process for legal requests: subpoenas, court orders, attorney letters, and law enforcement inquiries. It is operational guidance, not legal advice. Every legal request involving SUD records should go to qualified healthcare counsel before anything leaves the building.

Why a Subpoena Alone Is Not Enough Under Part 2

Under 42 CFR Part 2, a subpoena by itself does not authorize a federally assisted substance use disorder program to disclose patient records, or even to confirm that a person was a patient. Disclosure without written patient consent generally requires a court order issued under the specific procedures in Subpart E of Part 2, and a subpoena or similar legal mandate is then what compels the program to comply with that order. HHS’s 2024 Part 2 final rule, which programs were required to comply with by February 16, 2026, kept this two-part structure and added an express ban on using Part 2 records in civil, criminal, administrative, or legislative proceedings against the patient without consent or a qualifying court order.

That is the paragraph your front desk, admissions team and medical records staff need to understand, because it is where HIPAA instincts lead people wrong. Under the HIPAA Privacy Rule, a covered entity can in some circumstances respond to a subpoena without a court order if it receives satisfactory assurances about notice to the patient or a protective order. Part 2 is stricter. A program that follows its general HIPAA subpoena procedure for SUD records can end up disclosing information that Part 2 does not allow. HHS summarizes the current framework in its fact sheet on the 42 CFR Part 2 final rule, and the full regulatory text is on the Electronic Code of Federal Regulations.

Where Legal Requests Actually Go Wrong

The regulation is rarely the problem. The intake path is. Legal requests arrive through channels that were never designed to recognize them, and the person who receives them usually has no script.

• Acknowledgment by reflex: A staff member confirms or denies that a person was a client while explaining why records cannot be released, which is a disclosure in itself.
• The HIPAA template trap: Medical records staff apply the organization’s general HIPAA subpoena workflow to SUD records because nobody flagged which records fall under Part 2.
• Silence as a strategy: A program ignores a subpoena because it “can’t comply,” and misses the response deadline. A subpoena that cannot be honored still needs a timely, appropriate response, usually handled by counsel.
• Overbroad production: Even when a valid court order exists, staff copy the entire chart. Court orders under Part 2 are meant to limit disclosure to the parts of the record essential to the order’s purpose and to the people who need it.
• Phone and email requests from police: An officer calls asking whether a person is in treatment. Without consent or a qualifying order, the answer cannot confirm anything, and many staff have never been told what to say instead.

In practice, the receptionist and the records clerk make the first, and often most consequential, decision.

What a Valid Part 2 Court Order Has to Do

Part 2 sets out separate court order pathways depending on the purpose: noncriminal proceedings, investigating or prosecuting a patient, investigating or prosecuting a program or its staff, and placing an undercover agent or informant in a program. You do not need to memorize them, but your compliance lead should recognize what a legitimate order generally looks like before it is routed to counsel.

In general terms, a Part 2 court order typically follows an application that uses a fictitious name for the patient, gives the patient and the program notice and an opportunity to respond (with some exceptions for certain criminal investigations), and involves a review conducted in a way that protects confidentiality, often in chambers. The court must find good cause, which includes weighing the public interest in disclosure against the potential harm to the patient, the physician-patient relationship, and the treatment services. Orders are expected to limit what is disclosed and who receives it.

A generic order demanding “all records” deserves a second look from counsel before anything is produced. For the criteria for each type of order, read Subpart E on eCFR.

The Legal Request File: What to Build This Week

The fix is not a longer policy. It is a short, enforced routing process and a file that proves it works. Here is what to put in place.

1. Pull every legal request received in the last 12 months. Today, ask your records lead and front desk manager to pull every subpoena, court order, attorney letter, and documented law enforcement contact since last October. For each one, record the date received, who received it, which client it concerned, what was disclosed (if anything), and on what authority. If you cannot reconstruct this, that is your first finding.

2. Write a three-line front desk script. Something your staff can say word for word: “Federal confidentiality rules do not allow us to confirm or deny whether any individual has received services here. Please leave the document and your contact information, and our compliance office will respond.” Post it where requests arrive. Train it. Test it with a mock call.

3. Name one intake owner. Every legal request goes to one named person, typically the privacy or compliance officer, within the same business day. That person logs it, identifies whether the records are Part 2, HIPAA-only, or both, and routes it to counsel.

4. Create a legal request log. A simple log with date received, requesting party, type of request (subpoena, court order, law enforcement, attorney letter), Part 2 status, counsel notified date, response date, response type, and what was produced. Retain it with your HIPAA documentation, which the Privacy Rule generally requires you to keep for six years.

5. Flag Part 2 records in the EHR. If your records team cannot tell at a glance which records are Part 2, they will default to the HIPAA workflow. Work with your EHR vendor to add a visible flag, and confirm that release-of-information workflows check it.

6. Update your Notice of Privacy Practices and training. The 2024 final rule brought Part 2 programs closer to HIPAA in several areas, including notice requirements. Confirm your notice, consent forms, and workforce training reflect the rule as finalized, and document the date each was updated. HHS maintains HIPAA Privacy Rule guidance that should sit alongside your Part 2 materials.

Law Enforcement Requests Deserve Their Own Procedure

Police inquiries are often more stressful than subpoenas because they arrive in person or by phone and carry implied urgency. Part 2 permits limited disclosures without consent in specific situations, such as certain crimes on program premises or against program personnel, and medical emergencies. Those exceptions are narrow and fact-specific.

Your procedure should cover what staff say when an officer arrives asking about a client, who is called immediately, what happens if an officer presents a warrant (which is not the same as a Part 2 court order), and how the encounter is documented. Run a tabletop exercise with shift leads at least once a year.

What Surveyors and Auditors Look For

Accreditors including The Joint Commission and CARF expect behavioral health organizations to protect the privacy and confidentiality of client information and to comply with applicable law. In practice, reviewers rarely ask “do you have a subpoena policy?” They ask a records clerk to walk them through what happens when a legal request arrives, and then they ask to see the last one. If the clerk hesitates, or the log does not exist, the policy carries little weight.

Getting Help

If you want an outside review of your legal request routing, Part 2 record flagging, or front desk training, our behavioral health compliance services team can help, and programs without a dedicated privacy lead often use our fractional compliance officer service to own this process day to day. Programs preparing for accreditation can also look at our Joint Commission accreditation consulting.

Call us at (888) 458-6619 to talk through your current process. If a subpoena or court order is sitting on a desk right now, call your healthcare counsel first, then call us at (888) 458-6619 to help build the system so the next one is routine.

This article provides general operational guidance and is not legal advice. Consult qualified healthcare counsel about any specific legal request or disclosure decision.