42 CFR Part 2 Compliance for Houston Medical Couriers

A methadone clinic in southwest Houston sends a toxicology specimen to a reference lab three times a week. The requisition slip travels with it, and that slip identifies the patient as someone in treatment for a substance use disorder — a fact protected by a federal confidentiality law stricter than HIPAA. The clinic has a signed HIPAA Business Associate Agreement with its courier. As of February 16, 2026, that BAA is not enough. 42 CFR Part 2 compliance for medical couriers now requires a separate agreement, and the deadline to have one in place has already passed.

Why This Became Urgent in 2026

42 CFR Part 2 has protected substance use disorder treatment records since the 1970s, built on a legal theory HIPAA doesn't share: information tying someone to addiction treatment could be used against them — in a custody case, an employment dispute, a criminal proceeding — in ways ordinary medical records generally can't. For decades, that protection ran on its own set of rules, separate from HIPAA's Privacy and Security Rules and enforced separately.

In February 2024, HHS's Office for Civil Rights and SAMHSA jointly finalized a rule aligning Part 2 more closely with HIPAA — permitting a single patient consent to cover future treatment, payment, and operations disclosures, and importing HIPAA's breach notification and enforcement machinery. Programs and their vendors had two years to comply. That window closed on February 16, 2026, and OCR opened its civil enforcement program for Part 2 violations the same week — meaning a Houston program out of compliance today isn't in a grace period. It's in an active enforcement environment, with civil penalties now running as high as roughly $2.1 million per the 2025 inflation-adjusted HIPAA penalty schedule Part 2 now borrows.

A HIPAA BAA and a Part 2 QSOA Are Not the Same Document

Every medical courier handling protected health information should already have a signed Business Associate Agreement with each covered entity it serves. That's table stakes under HIPAA, and most Houston clinics check for it before onboarding a vendor. Part 2 doesn't recognize a BAA as sufficient on its own, because Part 2's confidentiality obligations attach to the record itself, not to the covered-entity relationship. The instrument Part 2 requires is a Qualified Service Organization Agreement — a QSOA.

Under 42 CFR § 2.11, a qualified service organization is an outside entity providing services like data processing, bill collecting, dosage preparation, or laboratory analyses to a Part 2 program. The regulation doesn't name courier or transport services explicitly, but any vendor whose work puts it in direct contact with records that identify a patient's SUD status — moving a labeled specimen, carrying a requisition form, transporting discharge paperwork between a program and a lab — sits squarely inside what a QSOA is built to cover. A QSOA obligates the courier to two things a standard BAA does not: it binds the courier directly to Part 2's confidentiality rules, not just HIPAA's, and it requires the courier to resist any legal effort to obtain the records except as Part 2 itself permits.

• The courier acknowledges in writing that it is fully bound by 42 CFR Part 2, not only HIPAA.
• The agreement is a separate document from the HIPAA BAA — one doesn't fold into the other automatically.
• It commits the courier to resist, in judicial or administrative proceedings, any effort to compel disclosure of the records beyond what Part 2 allows.
• It covers laboratory analyses, specimen handling, and any other service that puts the vendor in contact with SUD-identifying information — not just billing or IT vendors.

The Redisclosure Notice: What Travels With the Record

Part 2's other distinguishing feature is its redisclosure rule. Once a courier lawfully receives a record covered by Part 2 — a specimen requisition, a chain-of-custody form, a prescription for a medication-assisted treatment drug — it generally cannot pass that information further without the same notice restricting where it can go next. That prohibition follows the record itself, which is why a courier that also serves as a general medical logistics vendor needs staff who can recognize when a pickup is a Part 2 record and treat it differently from a routine HIPAA specimen, not just file it under the same standing procedure. Our guide on HIPAA-compliant medical courier vetting covers the baseline every vendor should meet; Part 2 sits on top of that baseline, not beside it.

Where Houston Programs Actually Touch This

This isn't a narrow edge case. Houston's opioid treatment programs, methadone clinics, and outpatient SUD treatment sites routinely send toxicology and drug-screen specimens to reference labs, receive lab results back, and move records between intake, treatment, and referral sites — all of it identifying a patient's status under Part 2. Programs that also handle DEA-regulated medications for treatment carry an additional, separate compliance layer covered in our guide on controlled substance courier compliance, but the Part 2 question is distinct from the DEA question: it's about who can see the paperwork, not who can carry the drug.

Key Takeaway

The 2024 final rule closed the gap between Part 2 and HIPAA on paper, but it didn't erase Part 2's separate legal foundation or its separate paperwork requirement. A Houston substance use disorder treatment program with a courier bound only by a HIPAA BAA is operating on an expired assumption now that OCR is actively enforcing Part 2 with HIPAA-level penalties. The fix is narrow and specific: a signed QSOA with any courier that handles specimens, requisitions, or records identifying a patient's SUD status, on top of — not instead of — the HIPAA BAA already in place.