Addiction treatment programs face a stricter federal confidentiality rule than most healthcare providers. When a treatment program's website carries advertising or analytics code, that rule, 42 C.F.R. Part 2, belongs in the same conversation as HIPAA and the wiretap statutes. This guide explains what Part 2 covers and where a website meets it.
What Part 2 protects
The statute is 42 U.S.C. § 290dd-2, and its regulations are at 42 C.F.R. Part 2. Under 42 C.F.R. § 2.12(a), the restrictions apply to records that would identify a patient as having or having had a substance use disorder, and that contain substance use disorder information obtained by a federally assisted program for treatment, diagnosis, or referral for treatment.
Three definitions in § 2.11 do most of the work:
- Program. A person, other than a general medical facility, that "holds itself out as providing, and provides, substance use disorder diagnosis, treatment, or referral for treatment," or an identified unit or staff within a general medical facility that does the same.
- Patient. "Any individual who has applied for or been given diagnosis, treatment, or referral for treatment for a substance use disorder at a part 2 program."
- Records. "Any information, whether recorded or not, created by, received, or acquired by a part 2 program relating to a patient," including information that identifies the patient.
"Federally assisted" is broad. Under § 2.12(b) it includes a program that participates in Medicare, is registered to dispense controlled substances for substance use disorder treatment, receives federal financial assistance in any form, or has tax-exempt status.
To "disclose," under § 2.11, is to communicate information identifying a patient as having a substance use disorder, or as having been referred for treatment, "either directly, by reference to publicly available information, or through verification of such identification by another person."
Consent under Part 2
Part 2 consent is written and specific. Under § 2.31, it must include the patient's name, who may make the disclosure, a meaningful description of the information, the recipients, the purpose, the right to revoke, an expiration date or event, and the patient's signature. A click on a cookie banner has none of those elements.
Penalties
Under § 2.3(a), anyone who violates § 290dd-2(a) to (d) is subject to the penalties in sections 1176 and 1177 of the Social Security Act, 42 U.S.C. §§ 1320d-5 and 1320d-6, and § 290dd-2(f) says the same. Section 2.3(c) applies the HIPAA enforcement rules to Part 2. HHS amended Part 2 by a final rule published February 16, 2024 (89 Fed. Reg. 12472), with a compliance date of February 16, 2026.
That penalty link matters beyond Part 2 itself. Because a knowing disclosure of Part 2 records is punishable under 42 U.S.C. § 1320d-6, it bears on the federal Wiretap Act's exception for interceptions made "for the purpose of committing any criminal or tortious act." In Cooper v. Mount Sinai Health System, Inc., 742 F. Supp. 3d 369, 379 (S.D.N.Y. 2024), the court held that exception plausibly alleged on a § 1320d-6 theory. See Federal Wiretap Act for Websites.
Where a website meets Part 2
Most of a treatment program's website is public information: programs, locations, insurance accepted. The risk sits where a visitor starts to become a patient. A person who "has applied for" treatment is a patient under § 2.11, and the program's information about that person is a record. The pages to watch:
- Admissions and intake forms. A submitted form is often the application itself.
- Insurance verification forms. They collect a name, date of birth, insurer, and member number, alongside the fact that the person is seeking treatment.
- Assessments and "find the right program" quizzes. Answers can describe a substance and a history of use.
- Click-to-call and chat. Call tracking and chat vendors can record that a call or conversation happened, and sometimes what was said.
- Thank-you pages. A page reached only after submitting an admissions form tells anyone who sees its address that the form was sent.
When a Meta Pixel, TikTok Pixel, or Google Ads tag fires on those pages, the event can tell an advertising platform that a person with a particular browser and IP address applied for addiction treatment. Event names such as Lead, SubmitApplication, or Schedule say it outright.
Meta's own Business Tools Terms tell advertisers not to send it information that "includes or is based on, directly or otherwise, health information."
What a treatment program should do
- Remove advertising pixels, including the Meta Pixel, TikTok Pixel, and Google Ads conversion and remarketing tags, from admissions, intake, insurance verification, assessment, chat, and thank-you pages.
- Keep form submissions and calls out of every advertising platform's conversion reporting, whether the event would leave from the browser or from a server.
- Turn off session recording on every form, or mask every field.
- Check call tracking and chat vendors for what they collect and where they send it.
- Block all non-essential tags until the visitor agrees, and test that "Reject" works. A banner click is not Part 2 consent, so it does not cure the pages above.
- Measure campaigns with counts you keep yourself. Our guide to removing the Meta Pixel from patient pages shows how.
Sources
Links checked on October 22, 2026. Regulation text is quoted from the eCFR as published that day.
- 42 C.F.R. Part 2 (eCFR)
- 42 U.S.C. § 290dd-2
- Confidentiality of Substance Use Disorder (SUD) Patient Records, 89 Fed. Reg. 12472 (Feb. 16, 2024)
- Meta: Business Tools Terms
- Cooper v. Mount Sinai Health System, Inc., 742 F. Supp. 3d 369 (S.D.N.Y. 2024)