42 CFR Part 2 Fax — Sharing Substance Use Disorder Records the Right Way
42 CFR Part 2 protects the confidentiality of substance use disorder (SUD) treatment records held by federally assisted Part 2 programs, with stricter consent and redisclosure rules than HIPAA. Send FAX Mail gives you encrypted transmission, access controls, and audit logs to support faxing those records — from $39.99/month.
42 CFR Part 2 Requirements for Fax
- Patient consent before disclosing SUD records, meeting Part 2's specific written-consent content
- The Part 2 prohibition-on-redisclosure notice must accompany any disclosure
- Records limited to the minimum necessary for the stated purpose
- Access to Part 2 records restricted to authorized personnel only
- Security safeguards for records in transit and at rest
- An accounting/audit record of disclosures made
How Send FAX Mail Meets 42 CFR Part 2
- Encryption of every fax in transit and at rest so records aren't exposed on the wire
- Role-based access and per-user login so only authorized staff open received SUD faxes
- A per-fax audit trail (sender, recipient, timestamp, page count, delivery status) you can attach to your accounting of disclosures
- Cover-page templates where you can place the required prohibition-on-redisclosure notice and consent reference
- Configurable retention so records are kept and purged on your program's schedule
- A signed BAA on the Professional plan ($39.99/month) and above for the business-associate role the 2024 Part 2 rule recognizes
Industries Affected
Starter
- 600 fax pages per month
- 1 dedicated fax number
- Send & receive faxes
- Fax to email delivery
- Fax history & downloads
- No per-page overage charges
Professional
- 2,000 fax pages per month
- 3 dedicated fax numbers
- HIPAA compliance + self-serve BAA
- Sign documents before sending
- Priority delivery
- No per-page overage charges
Business
- 5,000 fax pages per month
- 5 dedicated fax numbers
- HIPAA compliance + self-serve BAA
- Public API & webhooks
- Audit logs
- Team roles & permissions
- Priority support
Enterprise
- 8,000 fax pages per month
- 10 dedicated fax numbers
- Everything in Business
- Public API & signed webhooks
- Dedicated support
- Custom integrations
No per-page overage. No activation fees. No contracts. Cancel anytime.
What’s current · as of August 2026
- HIPAA large-breach reporting threshold
- 500+ individuals — reported to HHS OCR without unreasonable delay Source: HHS Office for Civil Rights
- HIPAA documentation retention period
- 6 years from creation or last-effective date Source: HHS — HIPAA Administrative Requirements (45 CFR 164.316)
Recent updates
Federal interoperability rules keep pushing healthcare past the fax machine
CMS has advanced a series of interoperability rules that press hospitals, payers, and providers toward electronic data exchange and standardized claims attachments. The direction of travel is clear: paper and analog fax workflows are being replaced by digital transmission that carries an auditable record — which is exactly what a cloud fax with delivery confirmation provides for offices not yet on a full EHR pipeline.
CMS →Federal agencies still write fax into new rules and notices
The Federal Register — the daily journal of U.S. federal rulemaking — regularly publishes rules and notices that reference fax as an accepted or required submission channel for filings with agencies like the IRS, SSA, and CMS. That is why fax remains a live requirement for many official forms even as electronic portals expand.
Federal Register →Healthcare breach reporting keeps document handling under scrutiny
Ongoing reporting on HIPAA breaches and OCR settlements underscores how much scrutiny falls on how medical documents are stored, sent, and received. Sending records through a controlled, access-logged channel rather than an unmanaged machine reduces the mishandling risks that show up repeatedly in breach analyses.
HIPAA Journal →
42 CFR Part 2 Fax Compliance — FAQ
Part 2 is stricter than HIPAA about consent and redisclosure of substance use disorder records. Even after the 2024 rule aligned parts of it with HIPAA, a Part 2 disclosure still needs a conforming consent and must carry the prohibition-on-redisclosure notice — obligations that live in your consent forms and cover page, not in the fax transport itself.
Send FAX Mail supplies the technical safeguards — encrypted transmission, access controls, audit logs, retention. It does not manage your patient consents or automatically insert the required notices. Part 2 compliance is a program-level obligation; we support the transmission piece of it and can't certify your consent workflow.
Put it on your cover page. Send FAX Mail's cover-template feature lets you save the Part 2 notice language (the record may not be redisclosed without written consent) so it accompanies every SUD fax you send.
The 2024 Part 2 rule brought business-associate and HIPAA-style breach concepts into Part 2. If you handle PHI that is also Part 2 data, Send FAX Mail provides a signed BAA on the Professional plan ($39.99/month) and above. Confirm your program's specific arrangement requirements with your compliance officer.
42 CFR Part 2-compliant faxing starts at $39.99/mo
Encrypted transmission, audit logs, secure storage. No enterprise contract needed.
7-day free trial · No credit card required