Friday, 9:40 p.m. A parent calls the admissions line about their 26-year-old. The on-call coordinator takes a name, a number and a time to call back. The consent packet is paper, in a folder behind the admissions desk, so it waits for Monday. On Saturday the parent calls again to ask whether their child has been in touch, and the coordinator can't say.
That is the gap the federal Part 2 rule opens on night one. Part 2 guards substance use records more tightly than HIPAA does, and it reaches the inquiry stage. Your admissions team texts, records calls and talks with families from that first night, and the consent form decides what they may do.
This guide is practical help for admissions teams, not legal advice. Have counsel write and approve the consent wording your center uses, and ask them about your state's own rules too.
Why the first call already counts
The rule covers records about anyone who has applied for, or received, help with substance use at a federally assisted program. “Applied for” is the part that reaches admissions. A caller's name, number and why they called can fall under Part 2 before any assessment happens.
Even confirming that someone called is a disclosure. Your coordinator can listen to a parent, but can't say whether their adult child is on the list, in care or already home, without that person's signed consent.
“Federally assisted” is wider than grants. Taking part in Medicare or Medicaid, holding a DEA registration, tax-exempt status or a federal license can each bring a center inside it. Most licensed centers are, but ask counsel to confirm yours.
What changed in 2024, and why 2026 matters
The current rule is dated February 16, 2024. Centers had until February 16, 2026 to comply, and enforcement began that day, per HHS's Part 2 page. Three changes reach the admissions desk:
- A single signature can now cover every future use for care, for payment and for running the program, until the person takes it back. Call it the general consent.
- A breach of these records follows HIPAA's breach notification rules, and HIPAA's penalties now apply.
- Substance use counseling notes need a separate consent of their own.
A fourth reaches the alumni coordinator: fundraising messages must offer an easy opt-out.
What a Part 2 consent form usually holds
Counsel writes the text. These are the parts counsel will usually want on it, in plain words, from the rule's consent section (§2.31):
- The client's name.
- Who may share the information: your center, named.
- What may be shared, described specifically.
- Who may receive it: a named person, or a described group.
- Why: the purpose of each share.
- That the person may take the consent back, and how.
- When it ends: a date, an event, or “none” for the general consent.
- A note that the recipient may pass the information on.
- Whether care depends on signing.
- The person's signature, with the signing date.
For a minor, state law decides who signs. Counsel will also tell you which pieces your state adds.
What to ask the first caller
The first call isn't the moment for the whole packet. Collect what lets you follow up safely:
- Who is calling, and who the call is about.
- The best number, and whether texts to it are okay.
- Whether a voicemail is safe, and what it may say.
- The program they asked about, and when to call back.
- A yes to texting the consent form right now, mid-call.
Then send the link before you hang up. A form signed at 9:52 p.m. beats one that waits in a folder until Monday.
If the caller is the person who wants care, they sign. If it's a parent, a partner or a friend, read the next part.
When a parent is the one calling
Most nights the first call comes from family. You can listen, ask questions and describe your programs in general terms. Without the adult's signed consent naming that parent, you can't confirm the adult called, booked or arrived.
Hand your coordinators a line for it: “I can't share whether anyone has contacted us, but I'm glad to hear what's happening and explain how admission works here.”
Once the adult calls or comes in, the first form asks who they want you to talk to. Each person is named, with what you may share and for how long. That one box turns a weekend of “I can't say” into updates the client signed off on.
In some states a minor may sign for their own care, and then the minor's own consent governs. Ask counsel how your state handles it.
Separate boxes for separate permissions
A single checkbox for everything causes trouble later. Keep these apart on the form:
- Care: the general consent, for care, payment and running the program.
- Family: each named loved one, and what they may hear.
- Texts: permission to text this number, for the TCPA. Never pre-checked.
- Alumni and news: messages after discharge, events and newsletters.
- Fundraising: an opt-out that's easy to find.
A person can say yes to care and no to texts. The form should let them.
A signature by text link
Part 2 accepts electronic signatures where state law allows them. That makes a text link the fastest road to a signature. The caller taps it, reads the form and signs on the screen, and the copy is filed on the record at once.
In RehabSignal, your coordinator texts the pre-admission forms from the inquiry's record, and each signed form is stored there as a PDF. Texts, calls, recordings and forms run in HIPAA mode, under a BAA your center signs with us. The consent wording stays your counsel's; we put it into the form word for word.
What texts and pages can say until the form is back
Until the form comes back, keep every message neutral. A lock-screen preview that says treatment, detox or rehab tells anyone holding that phone. Sign texts with the center's initials, and say nothing the caller doesn't already know: “Hi, it's J.R. from earlier. Here's the form we talked about.”
The same goes for your website. A study of opioid treatment websites found about half carried Meta's tracking pixel (HIPAA Journal, on data through June 2022). Keep ad pixels off the inquiry form and the confirmation page, so an ad network never learns that someone asked for help.
When someone revokes consent
People change their minds, and the form tells them how to say so. When a revocation comes in:
- Note the date and how it arrived.
- Stop the sharing and the messages it covered, that day.
- Tell everyone on the team who shares under it.
- Keep the revocation with the signed form.
What was already shared under the consent stays shared. Counsel should set how quickly the team acts and who confirms it.
Alumni messages, and which consent covers them
Is one consent enough for all alumni messages? Not by default. The general consent reaches care, payment and running the program. Milestone texts, event invites and newsletters may need their own yes, and every text needs TCPA permission. Fundraising needs its opt-out.
Have counsel map each message your alumni coordinator sends to the box that allows it. Then build the alumni list only from people who ticked that box, and the Tuesday group invite goes out without a second guess.
RehabSignal
RehabSignal sells admissions software, a website and marketing to US addiction treatment centers for one flat monthly fee. We turn centers' paper consent packets into phone forms, keeping their counsel's wording.
