HIPAA, 42 CFR Part 2, and TCPA: Which Rule Applies to Which Channel
Three different rules govern a single admissions call — HIPAA covers the record, 42 CFR Part 2 covers the fact of contact, and TCPA covers the outreach itself. Which applies where, in one reference.
On this page
A single admissions text message can implicate three separate federal rules at the same time, each governing a different question. HIPAA governs how the patient's information is stored and who can access it. 42 CFR Part 2 governs whether the fact that someone contacted a substance use treatment program can be disclosed at all — separate from what was actually said. TCPA governs whether you were allowed to send that message in the first place, and what consent it required.
Each of these has its own dedicated piece on this site — what to verify for HIPAA-compliant CRM communications, how 42 CFR Part 2 applies to admissions communications, and TCPA compliance for treatment center outreach — this piece is the map between them: which rule governs which decision, and where they stack on the same call.
Key takeaways: HIPAA, 42 CFR Part 2, and TCPA
- HIPAA governs storage and access to protected health information once it exists; 42 CFR Part 2 governs whether the fact of contact with an SUD program can be disclosed; TCPA governs whether you had consent to make the call or send the text at all.
- A single outreach message can implicate all three: TCPA decides if you can send it, 42 CFR Part 2 decides what it can reveal, and HIPAA decides how the underlying record is handled afterward.
- 42 CFR Part 2 only applies to substance use disorder treatment programs and records — mental-health-only facilities are outside its scope, though HIPAA and TCPA still fully apply.
- TCPA consent is channel- and purpose-specific; one blanket "I agree" rarely covers calls, texts, marketing, and informational messages all at once.
- These are three distinct frameworks with different triggers, not one general "compliance" checkbox — treating them as interchangeable is where most admissions teams get exposed.
What does each rule actually govern?
HIPAA governs the confidentiality, security, and integrity of protected health information (PHI) — a patient's name tied to their health information, their treatment history, insurance details, or clinical notes. It applies from the moment PHI exists in your system, regardless of channel, and requires a signed business associate agreement with any vendor that stores or processes it on your behalf.
42 CFR Part 2 is narrower in scope but stricter in what it protects: it applies specifically to records of substance use disorder (SUD) treatment, and — the detail most teams miss — it protects the fact that someone sought or received SUD treatment, not just the clinical content of what was discussed. A text message that never mentions a diagnosis can still violate Part 2 if it would let a third party infer the recipient is in SUD treatment.
TCPA is different in kind from the other two: it doesn't govern what information can be disclosed, it governs whether you were allowed to contact someone at all. It sets consent requirements for calls and texts, distinguishes informational from marketing messages, and requires an easy way to opt out.
Which rule applies to which admissions channel?
| Channel | HIPAA | 42 CFR Part 2 | TCPA |
|---|---|---|---|
| Phone call to a new lead | Applies once PHI is discussed | Applies if the caller is an SUD program | Applies — governs whether you can call and what consent covers |
| Text message | Applies to any PHI in the message | Applies — content can't reveal SUD contact | Applies — separate consent tier from calls |
| Marketing text/call | Applies if it references PHI | Applies — same disclosure risk as any contact | Applies at its strictest tier — highest consent bar |
| Email to a lead | Applies once PHI is included | Applies — same disclosure logic as text | Governed by CAN-SPAM, not TCPA |
| Stored call recording | Applies — PHI at rest, BAA required | Applies — recording itself is a Part 2 record if SUD-related | Not applicable (TCPA governs the act of contact, not storage) |
The pattern to notice: HIPAA and 42 CFR Part 2 both travel with the content and the record, so they apply anywhere PHI exists, in any channel or at rest. TCPA travels with the act of contact itself, so it applies at the moment of outreach and doesn't care what the message contains.
Where the three rules stack on a single call
Picture a first-touch outreach text to someone who filled out a web form asking about addiction treatment. TCPA decides whether you're allowed to text them at all — a form fill typically covers a reply to their inquiry, but a marketing follow-up often needs separate, explicit consent language. Assuming you can send it, 42 CFR Part 2 decides what the text can safely say: it should not reveal, even by implication, that the recipient is seeking substance use treatment, since that fact itself is protected. And whatever gets captured from their reply — a name, a phone number, anything resembling health information — falls under HIPAA the moment it lands in your CRM, which is why the vendor needs a signed BAA before it touches any of it.
Get any one of the three wrong and the other two don't save you: a Part-2-safe message sent without TCPA consent is still a violation, and a fully consented text that reveals SUD treatment status still breaches Part 2.
A practical way to sort a real question
When a new communication scenario comes up, ask it in this order: Am I allowed to contact this person at all, on this channel, for this purpose? — that's TCPA. If I can contact them, what can the message safely reveal about why they're in my system? — that's 42 CFR Part 2, if there's any SUD context at all. Once information exists in my system, who can see it and how is it protected? — that's HIPAA, for every record regardless of channel.
None of this is legal advice — your specific obligations depend on your state, license, and payer mix, so run real scenarios past counsel. But knowing which rule you're actually asking about is what makes that conversation with counsel productive instead of a restart from zero every time.
If you want to see how Census CRM keeps these three frameworks straight inside a single admissions workflow rather than as three separate manual checks, book a walkthrough.
HIPAA, 42 CFR Part 2, and TCPA FAQs
Do HIPAA, 42 CFR Part 2, and TCPA all apply to the same phone call?
Often yes, and each governs a different part of it. HIPAA governs how the patient's information is stored and handled once it's captured. 42 CFR Part 2 governs whether the fact that someone contacted a substance use treatment program can be disclosed at all, separate from what was said. TCPA governs whether you were allowed to place the call or text in the first place, and what consent that required. A single outreach text to a lead can implicate all three at once.
Which rule applies to a first-touch marketing text to a new lead?
TCPA applies first, since it governs consent to send the message at all — a form fill typically covers informational replies but not marketing texts without separate consent language. HIPAA applies once the message contains or references protected health information. 42 CFR Part 2 applies specifically if the text would reveal, even indirectly, that the recipient is seeking substance use disorder treatment, which most first-touch texts should avoid stating outright regardless of consent status.
Does 42 CFR Part 2 apply to a mental health facility that doesn't treat substance use disorders?
No. 42 CFR Part 2 is scoped specifically to substance use disorder treatment programs and records — a mental health facility with no SUD component isn't subject to it, though HIPAA and TCPA still apply in full. A co-occurring program treating both conditions is subject to all three, and Part 2's stricter confidentiality rules apply to the SUD-related portions of the record.
Which rule is strictest about what you can say in a text message?
42 CFR Part 2 is the strictest on content, because it protects the fact of contact itself, not just clinical details — a text that would let a third party infer someone is in SUD treatment can violate Part 2 even if it never names a diagnosis. HIPAA is stricter about who can access the underlying record and how it's stored. TCPA doesn't govern content at all — it governs whether you had consent to send the message in the first place.
If a lead consents once, does that consent cover every future channel?
No. TCPA consent is channel- and purpose-specific — consent to receive a call doesn't automatically cover texts, and consent to informational messages doesn't cover marketing messages, in most interpretations. HIPAA authorization and 42 CFR Part 2 consent are separate concepts entirely, tied to disclosure of health information rather than the right to contact someone, so a single blanket 'I agree' rarely satisfies all three frameworks at once.
Keep reading
HIPAA-Compliant CRM Communications: What to Verify
“HIPAA compliant” is a slide claim, not a certificate. A concrete checklist — the BAA plus the technical and operational safeguards — to verify before you trust a vendor with PHI.
42 CFR Part 2 in Admissions Communications
Part 2 protects not just the record but the fact of contact, and it applies from the first call. Where it trips up admissions, and how to communicate on the record.
TCPA Compliance for Treatment Center Outreach
A lead's phone number becomes a liability when the consent is wrong. The TCPA consent tiers behind lawful calls and texts, and what a form fill actually allows.
VOB and Bed Matching for Detox Admissions: Why the Clock Is Different
A detox admission and a residential admission run through the same VOB and bed-matching mechanics, but on a different clock — what actually changes for detox specifically.
VOB and Bed Matching for MAT Admissions: The Program-Capability Check
Medication-assisted treatment adds a question VOB and bed matching don't ask elsewhere: can this specific program actually administer this specific medication.
VOB and Bed Matching for Mental Health Admissions: The Safety-First Read
A mental health admission runs the same VOB and bed-matching mechanics as substance use placement, but psychiatric safety screening and benefit-structure quirks change what actually matters.
VOB and Bed Matching for Outpatient, IOP, and PHP: The Capacity Question
There's no bed to match at outpatient, IOP, or PHP — the equivalent question is group or session capacity, and VOB shifts from per-diem to session-based coverage.
VOB and Bed Matching for Residential Admissions: What Actually Changes
A residential admission still runs VOB and bed matching, but length-of-stay coverage and exclusion checks carry more weight than the speed that dominates detox.
What Is a Bed-Matching Algorithm? A Plain-English Definition
A bed-matching algorithm checks a patient against level of care, insurance, exclusions, and specialty needs before a bed is offered — not just whether one is empty.
What Is a Guided Talk-Track? A Plain-English Definition
A guided talk-track is software, not a script — a step-by-step flow embedded in the CRM that adapts to what the caller says as the call happens.
What Is the ASAM Criteria? The 6 Dimensions Explained
The ASAM Criteria is the standard framework addiction treatment uses to decide level of care, assessed across six dimensions from withdrawal risk to recovery environment.
How to Avoid Switching CRM Platforms Later
Most CRM switches are self-inflicted at selection. How to avoid switching CRM platforms later by choosing and setting up the right system now — with room to grow into.