What is 42 CFR Part 2? A Guide for Sober Living Operators

If you run a sober living home, you've probably heard of 42 CFR Part 2. Maybe a referral partner mentioned it. Maybe a state inspector asked about it. Maybe you've never heard of it — and that's a problem.

42 CFR Part 2 is a federal regulation that protects the confidentiality of people receiving substance use disorder (SUD) treatment. If you handle any information about a resident's substance use history, it may apply to you.

In plain language: you cannot share information about a person's substance use treatment without their written consent. This is stricter than HIPAA.

HIPAA allows healthcare providers to share patient information for treatment, payment, and operations without explicit consent. 42 CFR Part 2 does not. Under Part 2, you need written consent before sharing anything — even with other healthcare providers, even for the patient's own treatment.

The regulation covers:

It depends. 42 CFR Part 2 applies to programs that:

Many sober living homes fall into a gray area. If you're a peer-run recovery residence with no clinical services, you may not be covered. If you receive referrals from treatment centers, accept residents through court programs, or describe your services as part of a treatment continuum, you likely are.

The safest approach: treat resident information as if Part 2 applies. The cost of compliance is low. The cost of a violation is not.

For sober living operators, 42 CFR Part 2 compliance means:

Get written consent before sharing anything. If a probation officer calls asking about a resident, you need that resident's signed consent form before you can confirm they live there. If a parent calls, same thing.

Secure your records. Resident information — intake forms, drug test results, incident reports — must be stored securely. Paper files in a locked cabinet. Digital files in encrypted, access-controlled systems.

Limit who has access. Not every staff member needs access to every resident's records. Implement role-based access — house managers see what they need, and nothing more.

Train your team. Everyone who works in your home should understand that resident information is confidential. A house manager mentioning a resident's history at a community meeting is a violation.

Have a breach plan. If information is disclosed improperly, you need a process to identify it, contain it, and notify affected individuals.

In 2024, the federal government updated 42 CFR Part 2 to better align with HIPAA. Key changes:

These changes make compliance somewhat easier for sober living operators, but the core principle remains: you need consent, and you need security.

Here's a simple compliance checklist:

RecoveryOS is built with 42 CFR Part 2 in mind. Resident data is encrypted with AES-256, isolated by organization, and accessible only by authorized team members. Consent forms are collected digitally at intake and stored permanently.