Can you fax substance use disorder records?

Yes. A federally assisted program that provides substance use disorder (SUD) diagnosis, treatment or referral may fax a record with the patient's written consent or under another route in 42 CFR Part 2, and each consented fax must carry one of two prescribed statements (42 CFR 2.32). The 2024 rule's compliance date was February 16, 2026.

Do you need patient consent to fax medical records? covers the HIPAA side, and HHS summarizes the 2024 Part 2 changes in a fact sheet.

Does 42 CFR Part 2 apply to your practice?

It does when the practice is a Part 2 program: a federally assisted program that holds itself out as providing SUD diagnosis, treatment or referral for treatment and does provide it (42 CFR 2.11). Part 2 then covers any record that identifies a patient as having or having had a SUD and that the program obtained for that purpose (2.12(a)).

A general medical facility is not itself a program; an identified unit that does the same can be one, and so can identified staff whose primary function is that care. Section 2.12(e)(1) lists private practitioners who hold themselves out as providing that care among those covered.

Federal assistance (2.12(b)) is the second condition. Several routes meet it, among them Medicare participation, a federal authorization for maintenance treatment or withdrawal management, a Controlled Substances Act registration to dispense for SUD treatment, any federal financial assistance, and tax-exempt status or tax-deductible contributions.

What statement must go with a faxed record?

One of two written statements goes with each disclosure made with the patient's written consent (42 CFR 2.32(a)).

Statement 1 is the long form, about 220 words. It bars using or disclosing the record, or testimony about it, in a civil, criminal, administrative or legislative proceeding against the patient absent consent, a court order or the exception in 2.12(c)(5) for crimes on program premises. It allows further use or disclosure in three cases: the patient's written consent or another Part 2 permission, receipt by a covered entity or business associate for treatment, payment or health care operations, and receipt from one as HIPAA permits.

Statement 2 is the short form, 12 words, in full: "42 CFR part 2 prohibits unauthorized use or disclosure of these records."

The fax needs a second item (2.32(b)): a copy of the patient's consent or a clear explanation of its scope. A consent that has expired, is known to be revoked or substantially fails 2.31(a) on its face cannot support a disclosure (2.31(c)). SUD counseling notes, which HHS likens to HIPAA's psychotherapy notes, need a separate consent (2.31(b)).

A faxed record that identifies a patient as diagnosed with a SUD, as having or having had one, or as referred for its treatment is a disclosure under 2.11, and 2.32 draws no line between media: a fax carries the same statement and the same copy or explanation as a mailed record. The word facsimile appears once in all of Part 2, in the rule on a discontinued program's records, where facsimile ribbons are hard copy media to sanitize (2.19(b)(1)(i)(A)).

A consent for treatment, payment and health care operations does not remove the notice: HHS reads 2.32(a) to cover every consented disclosure, one made under that consent included (89 FR 12556). HHS adds that the notice attaches only to disclosures made with consent, so a redisclosure that HIPAA permits after such a consent needs none (89 FR 12555).

Who is bound once the fax arrives?

The recipient, once notified. Part 2's restrictions on use and disclosure apply to a person who receives records directly from a Part 2 program, a covered entity, a business associate, an intermediary or another lawful holder and is notified of the prohibition on redisclosure under 2.32 (2.12(d)(2)(i)(C)). A lawful holder under 2.11 is bound because records arrived through written consent "with an accompanying notice of disclosure" or under one of the rule's exceptions. The bar on using a record against the patient in a proceeding reaches further: it applies to anyone who obtains the record from any of those sources, whatever that person's status (2.12(d)(1)).

Is a fax service a qualified service organization?

A qualified service organization (QSO) can receive a program's records without patient consent when it needs them to provide services to or for the program (2.12(c)(4)). Section 2.11 reaches that status by two routes.

The general route is a written agreement with a provider of services such as data processing, in which the provider acknowledges that Part 2 fully binds it when it handles the program's records and agrees to resist in judicial proceedings, if necessary, any effort to obtain patient identifying information that Part 2 does not permit.

The second route is a separate clause. It includes a person who meets the business associate definition in 45 CFR 160.103 when the Part 2 program is also a covered entity, as to protected health information that is also a Part 2 record. A covered entity is a health plan, a clearinghouse or a health care provider that transmits health information electronically in a transaction HIPAA's standards cover. For any other program, a vendor reaches QSO status only through the written agreement.

A fax service that keeps a covered entity's faxes is its business associate under 160.103, and every Fax Pigeon plan includes a signed BAA, executed at signup. Which agreement a program needs is a question for its counsel.

What was the compliance date?

February 16, 2026, the date the rule and HHS's fact sheet give. The final rule appeared in the Federal Register on February 16, 2024 (89 FR 12472) and took effect April 16, 2024. One provision waits: HHS put off the compliance date for 2.25, the patient's right to an accounting of disclosures, until it revises the HIPAA accounting rule at 45 CFR 164.528 to cover treatment, payment and operations disclosures made through an electronic health record (89 FR 12476, 12536). The 2.32 statement is outside that delay.

Can a program fax a record without consent?

Yes, in the cases Part 2 lists. Subpart D (uses and disclosures without patient consent) has four: a medical emergency (2.51), scientific research (2.52), audits and program evaluation (2.53) and public health (2.54). Subpart E (court orders) lets a court authorize a disclosure. A subpoena alone does not: the holder may not respond with the records unless a court has entered an authorizing order (2.61(b)(1)).

Any disclosure is limited to the information necessary for its purpose (2.13(a)), and 2.16(a) requires formal policies and procedures for transferring paper records and for transmitting electronic ones. Section 2.16(b) applies HIPAA's breach rules to a program's unsecured records, so a fax that reaches the wrong number is a breach question under Part 2 too.

* Fax Pigeon prices and plan terms as of October 14, 2026.