HHS Issues Guidance on Use of Part 2 Substance Use Disorder Records to Verify Medicaid Community Engagement Exemptions

On September 29, 2026, the US Department of Health and Human Services Office for Civil Rights (HHS OCR) issued guidance addressing the interaction between the federal confidentiality requirements governing substance use disorder (SUD) treatment records and new Medicaid community engagement requirements. Specifically, the guidance explains when state Medicaid agencies may use records protected under 42 CFR Part 2 (Part 2) to determine whether a Medicaid applicant or beneficiary qualifies for an exemption from community engagement requirements.

Background of Part 2 Protections

Part 2 protects records relating to the identity, diagnosis, prognosis, or treatment of patients receiving services from federally assisted SUD programs. These confidentiality protections apply not only to covered treatment providers, but also, in certain circumstances, to downstream recipients of Part 2 records, including health plans and state Medicaid agencies.

Under recently enacted federal Medicaid requirements¹, certain adults between the ages of 19 and 64 must satisfy community engagement obligations, such as employment, education, or community service activities, as a condition of Medicaid eligibility. States are required to implement these requirements no later than January 1, 2027. The statute, however, excludes certain categories of individuals, including those who are medically frail, have special medical needs, or participate in certain SUD treatment programs, as set forth in 42 CFR 435.554(c).

The guidance was issued in response to concerns regarding how state Medicaid agencies can identify and verify individuals who qualify for these exclusions while remaining compliant with Part 2's confidentiality requirements.

When May a State Medicaid Agency Use Part 2 Records?

According to OCR, a state Medicaid agency may use Part 2-protected records to verify that an applicant or beneficiary qualifies for a community engagement exemption in two circumstances.

1. Existing Treatment, Payment, and Health Care Operations (TPO) Consent

A Medicaid agency may use Part 2 records where the patient previously executed a valid written consent authorizing future uses and disclosures for treatment, payment, and health care operations (TPO) purposes. Under the guidance, determining whether an individual qualifies for an exclusion from the community engagement requirement may constitute a payment or health care operations activity. Therefore, where records have been lawfully disclosed pursuant to a valid TPO consent, the Medicaid agency may use those records for exemption determinations without obtaining an additional patient authorization.

2. New Written Patient Consent

Alternatively, a state Medicaid agency may obtain a separate written consent from the Medicaid applicant or beneficiary authorizing use of the individual's Part 2 records for purposes of determining eligibility for an exemption. The guidance provides examples of consents that authorize:

• Use of existing Part 2 records solely to determine whether an exclusion applies; or
• Broader future use and disclosure of Part 2 records for treatment, payment, and health care operations purposes, including exemption determinations.

Any consent obtained by the Medicaid agency must comply with the requirements of 42 CFR § 2.31, including provisions concerning the patient's right to revoke consent and a specified expiration date or event.

Important Limits on Part 2 Disclosures Remain

The guidance emphasizes that even when Part 2 records are properly used to verify a Medicaid exemption, the records remain subject to Part 2's strict limitations on further use and disclosure. In particular, Part 2 records cannot be used to initiate or substantiate criminal charges, conduct criminal investigations, or serve as evidence in civil, criminal, administrative, or legislative proceedings against a patient, unless there is a separate specific patient consent authorizing such use or a valid court order.

Practical Implications and Key Take-Aways

The guidance confirms that Part 2 does not prohibit Medicaid agencies from using protected SUD treatment information to identify beneficiaries who qualify for community engagement exemptions. However, agencies must ensure that such use is supported by an appropriate patient authorization, whether through an existing TPO consent or a newly obtained written consent.

Providers, managed care organizations, and state Medicaid agencies should review their consent forms, data-sharing procedures, and eligibility verification processes to ensure compliance with both Medicaid requirements and Part 2's confidentiality protections as states prepare to implement community engagement requirements.

Key Takeaways from the Guidance include:

• Part 2 Rules continue to apply to SUD treatment records held by state Medicaid agencies.
• Medicaid agencies may use Part 2 records to verify community engagement exemptions when supported by a valid TPO consent or separate patient authorization.
• Exemption determinations may qualify as payment or health care operations activities under Part 2.
• Part 2's heightened restrictions on law enforcement and litigation-related uses remain in effect.
• Organizations should review consent and compliance processes before the January 1, 2027, implementation deadline for Medicaid community engagement requirements.

For additional information regarding Part 2 compliance, Medicaid eligibility determinations, or health information privacy requirements, please contact the authors of this Client Alert or your regular Butzel attorney.

Debra Geroux
248.258.2603
geroux@butzel.com

Robert Schwartz
248.258.2611
schwartzrh@butzel.com

Mark Lezotte
313.225.7058
lezotte@butzel.com

[1] 42 U.S.C. 1396a(xx); HHS-CMS Interim Final Rules, 91 FR 33348 (June 3, 2026), corrected 91 FR 39028 (June 29, 2026), 42 CFR Parts 431, 435, 438, 457 and 600.