Part 2 Part Deux - Three Fine‑Print Changes in the 2024 Part 2 Final Rule Every HIE Now Has to Engineer Around

When the 2024 overhaul of 42 CFR Part 2 dropped, most headlines focused on the new single TPO consent. A quieter clause - one sentence in § 2.32(b) - is turning out to be the heavier lift for health information exchanges:

“Each disclosure made with the patient’s written consent must be accompanied by a copy of the consent or a clear explanation of the scope of the consent provided.” Legal Information Institute

The mandate applies to everything an HIE does: real‑time portal views, nightly CCD pushes, even a query‑based FHIR pull. With the Feb. 16, 2026 compliance deadline less than 18 months away (Federal Register,) here’s a practical road map for making consent “travel.”

“Traveling Consent” Becomes Mandatory Cargo

Hidden deep in the revised text of 42 CFR § 2.32(b) is a line with outsized operational impact: every time an HIE discloses substance‑use‑disorder (SUD) data under patient consent, that disclosure must be accompanied by either  

• a copy of the signed consent, or

• a clear explanation of the scope of that consent. eCFR

OCR and SAMHSA doubled‑down in their post‑rule fact sheet, warning that the rule covers all exchange modes: portal views, HL7 feeds, FHIR queries, CCD downloads. HHS.gov

What compliance looks like

Workflow	Practical implementation
Portal view	Banner or pop up every time Part 2 data appears: “Patient’s Part 2 consent #2025‑TPO‑17 authorizes disclosure for Treatment, Payment & Operations (TPO) only • Expiration: none (valid until revoked)  • 42 CFR Part 2 prohibits redisclosure.”
C‑CDA / CCD push	One‑page cover sheet or header <nonXMLBody> block with the same text.
HL7 v2 feed	OBX
FHIR API / bulk export	Embed (or reference) a Consent resource; when the patient revokes, flip status to inactive so downstream systems know to stop redisclosing.

Take‑away: If the consent doesn’t ride shotgun with the data, the disclosure is unlawful.

Speaking of "TPO Consent," when regulators unveiled the 160‑page overhaul of 42 CFR Part 2 in February 2024, one response stuck out: Can a patient’s new “TPO consent” really cover everything an HIE already holds plus whatever rolls in tomorrow?  The answer, buried in the Federal Register, is an emphatic yes.

“A consent may apply broadly to all future uses and disclosures for TPO and may apply to a patient’s entire treatment record.” Federal Register

That single sentence means HIEs no longer need to segment SUD data by date received or date of the encounter. If the consent’s “description of information” is written broadly, for example, “any and all SUD information maintained by [HIE], past, present or future,” the exchange may disclose historical encounters right alongside today’s lab feed, so long as the patient hasn’t revoked.

Example language now showing up on updated consent forms:

Description of records: “Any substance use disorder information held by [HIE], whether created before or after I sign this consent, for Treatment, Payment, and Health‑Care Operations.”

Legal analysts say the change eliminates one of the most stubborn technical burdens in HIE design: “date based segmentation,” a patchwork many networks used to avoid shipping pre‑consent notes. With that hurdle gone, interface teams can focus on minimum‑necessary rules for payment and operations, rather than calendar math.

Lastly, “Expiration: None” is now an option within the new Part 2 text. The same rule answers another long‑standing gray area: how to set an end date. Earlier versions of Part 2 nudged programs toward the phrase “upon my death” to mimic an indefinite term. The new text in § 2.31(a)(7) removes the ambiguity:

“The statement ‘end of the treatment,’ ‘none,’ or similar language is sufficient if the consent is for a use or disclosure for treatment, payment, or health‑care operations.” Legal Information Institute

Regulators reinforced the point in the preamble, noting that an expiration date “is not required” for the new all‑purpose consent. In fact, they argue, allowing “none” aligns Part 2 with HIPAA, which does not ask for a TPO authorization at all.

Example language for consent:

Expiration: none — valid until revoked in writing.

Compliance attorneys recommend pairing that line with the standard revocation clause (“I may withdraw consent at any time except to the extent action has already been taken”) to remind patients and auditors that control still rests with the individual.

What HIEs should be doing now

Task	Why it matters
Inventory every disclosure path (portal, query, push, bulk)	All must carry the consent copy or scope text.
Choose a standard transmission method (PDF vs. banner/metadata)	Consistency simplifies audits.
Refactor consent templates	Add “none” expiration and “past, present, future” language.
Automate revocation alerts	SAMHSA expects real‑time cut‑off.
Update BA/QSO agreements	Downstream holders must honor banners and revocations.
Train clinicians	Banners replace guesswork with clarity about redisclosure limits.

The Bottom Line

The new Part 2 rule isn’t theory anymore—it’s engineering homework on a firm deadline. First, every SUD record must now travel with its "passport" - a copy of the patient’s consent or a banner that spells out exactly what the patient authorized. Second, that single consent stretches across past, present, and future data, wiping out the old calendar gymnastics that hobbled many exchanges. Third, “expiration: none” is now an option within the new Part 2 text for treatment/payment/operations sharing, eliminating the need for annual re-consent exercises.

HIE leaders have eighteen months to retrofit portals, message feeds, and revocation triggers before regulators start asking hard questions. Converge Health is uniquely positioned to assist HIEs ensure compliance by the upcoming deadline.