How to Get Medical Records from Hospitals in California (PI Law Firm’s Guide)

Obtaining complete medical records from California hospitals determines whether your personal injury case settles for fair value or leaves money on the table. Medical records documentation can increase settlement likelihood by 43%, yet incomplete authorization forms delay 45% of initial requests, adding weeks to case timelines. For California PI attorneys handling multiple cases simultaneously, streamlined medical record retrieval directly impacts case velocity, settlement negotiations, and client satisfaction.

Modern approaches to medical record retrieval like Codes Health combine legal authorization requirements with technological solutions that accelerate turnaround times. California's statutory framework provides clear pathways for attorneys to access client records, but practical implementation requires understanding provider workflows, avoiding common rejection triggers, and ensuring completeness before trial.

This guide provides California personal injury law firms with actionable protocols for requesting, retrieving, organizing, and analyzing medical records—from understanding statutory requirements to implementing verification systems that prevent missing documentation gaps.

Key Takeaways

• California law mandates 15-day response times for valid medical record requests, but incomplete authorizations cause most delays
• Record requests must comply with California Health and Safety Code Section 123110, CMIA, and HIPAA Privacy Rule requirements
• Properly executed HIPAA release forms require specific elements including wet signatures, dates of service, and provider identification
• Digital retrieval through HIEs and patient portals accelerates access for recent records, while traditional methods remain necessary for comprehensive case documentation
• AI-powered chronology tools identify breaches in care, pre-existing conditions, and future medical expenses that determine case valuation
• Missing record reviews prevent trial surprises by cross-referencing treatment timelines against provider documentation
• Codes Health's hybrid AI-human approach delivers 10-12 day average turnaround while maintaining verification accuracy for litigation-critical documentation

Why Personal Injury Attorneys Need Complete Medical Records Before Filing

Medical records form the evidentiary foundation for every personal injury claim in California. Without comprehensive documentation linking injuries to incidents, establishing causation, and quantifying damages, even strong liability cases settle below fair value or face dismissal challenges.

The Role of Medical Records in Proving Damages

Complete medical documentation establishes the causal connection between defendant conduct and client injuries. Emergency department records capture initial injury presentation, diagnostic imaging confirms structural damage, and treatment notes document pain progression and functional limitations over time.

Records also reveal pre-existing conditions that defense counsel will exploit to argue alternative causation. Identifying these conditions early allows you to distinguish acute injuries from chronic baseline conditions through medical chronologies and expert testimony.

Future medical expenses require documentation of ongoing treatment plans, specialist recommendations, and anticipated interventions. Without records supporting these projections, juries discount future damages claims as speculative.

How Incomplete Records Delay Case Resolution

Cases stall when discovery reveals documentation gaps that require supplemental requests. Defense attorneys file motions to compel when plaintiff counsel cannot produce complete records, while mediators discount settlement values when key treatment episodes lack documentation.

Healthcare providers fulfill 87% of requests within statutory deadlines, but the remaining 13% create bottlenecks that extend case timelines by months. Missing records from closed facilities, merged hospital systems, or out-of-network specialists require additional investigation and tracking.

Trial preparation demands complete record sets for expert witness review. Gaps identified weeks before trial force continuances, increase costs, and damage client relationships.

What a Personal Injury Lawyer Does with Medical Documentation

PI attorneys analyze medical records to identify:

• Breach of care incidents where providers failed to meet treatment standards
• Treatment gaps suggesting non-compliance or minimal injury impact
• Diagnostic inconsistencies between patient complaints and clinical findings
• Missed appointments that defense uses to argue lack of genuine injury
• Pre-existing conditions requiring differentiation from acute trauma
• Future treatment needs supporting life care plans and economic damages

This analysis shapes case strategy, determines settlement ranges, and guides expert witness selection. Attorneys who master record analysis build stronger cases and achieve better outcomes.

Understanding California's Medical Records Laws and Patient Rights

California's medical records access framework combines state statutes with federal HIPAA requirements, creating specific obligations for healthcare providers and clear access rights for attorneys representing injury claimants.

California vs. Federal HIPAA: Which Law Applies?

California Health and Safety Code Section 123110 grants patients legal rights to access medical records through written requests. The Confidentiality of Medical Information Act (CMIA) provides California-specific protections that often exceed HIPAA Privacy Rule requirements.

When state and federal laws conflict, the more restrictive standard applies. California law requires providers to respond within 15 calendar days after receiving valid requests, while HIPAA allows 30 days with a possible 30-day extension. New York patients must also be given an opportunity to inspect within 10 days.

For PI attorneys, this means California's stricter timeline governs provider response obligations for in-state healthcare facilities.

Who Can Access Medical Records in California Without Permission

Patient authorization remains mandatory for attorney access in personal injury cases. Healthcare providers may share records without authorization only in specific circumstances:

• Court orders or subpoenas with proper notice
• Public health reporting requirements
• Law enforcement investigations with valid warrants
• Workers' compensation proceedings where treatment relates to workplace injuries
• Medical emergencies requiring immediate care coordination

For PI case preparation, valid HIPAA-compliant authorization from your client remains the primary access mechanism.

Maximum Fees Hospitals Can Charge for Records

California law caps medical record fees at $0.25 per page plus reasonable clerical costs for locating and copying records. Standard requests average $35, though extensive hospital stays can exceed $150.

Recipients of public benefit programs including Medi-Cal, CalWORKs, SSI/SSP, and similar assistance qualify for free record copies. Approximately 28% of California residents meet these criteria.

Electronic delivery typically costs less than paper copies, making digital formats preferable when available. Some facilities charge flat fees for electronic transmission rather than per-page rates.

What You Need: HIPAA Release Forms and Authorization Documents

Valid authorization documentation determines whether providers fulfill requests promptly or reject submissions for technical deficiencies. California PI attorneys must ensure release forms contain all legally required elements before submission.

Required Elements of a Valid HIPAA Authorization

HIPAA-compliant authorizations must include specific components to withstand provider scrutiny:

• Patient demographic information - Full legal name, date of birth, current address, and contact information
• Provider identification - Specific hospital, clinic, or practice name and address
• Description of information - Records requested (all records, specific dates of service, particular record types)
• Purpose of disclosure - Legal representation for personal injury claim or litigation
• Expiration date - Specific date or event triggering authorization termination
• Patient signature - Original wet signature (not photocopied or electronic for many facilities)
• Date of signature - Must be current and match authorization submission timing
• Right to revoke - Statement explaining patient can withdraw authorization

Some California facilities require notarization for particularly sensitive records, though this exceeds standard HIPAA requirements.

Common Form Mistakes That Cause Provider Rejections

Approximately 45% of initial requests face delays due to incomplete authorizations. Common errors include:

• Misspelled patient names that don't match registration records
• Missing or incorrect dates of birth preventing patient identification
• Vague record descriptions like "all records" without date parameters
• Photocopied signatures instead of original wet signatures
• Expired authorizations submitted months after signing
• Incomplete provider addresses causing delivery failures
• Missing dates of service for targeted record requests

AI error-checking systems can identify these deficiencies before submission, preventing rejection cycles that add weeks to retrieval timelines.

HIPAA Release Form PDF Templates for California

Standard HIPAA authorization templates work for most California facilities, but some hospital systems require facility-specific forms. Major California healthcare networks maintain their own templates:

• Kaiser Permanente provides system-specific authorization forms through their patient resources portal
• Stanford Health Care requires detailed specification of record components in authorization language
• UCSF Health accepts general authorizations but processes targeted requests faster

When submitting to multiple providers for a single client, verify whether each facility accepts standard forms or requires custom templates.

Step-by-Step: How to Request Medical Records from California Hospitals

Systematic record request protocols minimize rejection rates and accelerate provider responses. California PI firms should establish standardized procedures that staff can execute consistently.

Contacting the Hospital's Health Information Management Department

Every California hospital operates a Health Information Management (HIM) department responsible for processing record requests. Contact information typically appears on hospital websites under patient resources or medical records sections.

Calling the HIM department before submitting written requests confirms:

• Current mailing address and fax numbers
• Facility-specific authorization requirements
• Fee structures and payment methods accepted
• Expected processing timeframes
• Preferred submission methods (portal, fax, mail, email)

Document these details in your case management system to streamline future requests to the same facility.

Submitting Requests by Fax vs. Mail vs. Portal

California hospitals accept medical record requests through multiple channels, each with different processing speeds:

Fax transmission:

• Provides immediate delivery confirmation
• Allows tracking of submission date for statutory deadline calculation
• Risks quality degradation for poor-resolution signatures
• May require follow-up calls to confirm receipt

Certified mail with return receipt:

• Creates definitive proof of submission date
• Takes 10-12 business days before provider receives request
• Provides legal documentation if enforcement becomes necessary
• Slows initial processing compared to digital methods

Patient portals (MyChart, MyHealthONE, HealtheLife):

• Processes requests 7 days faster on average than paper submissions
• Requires client portal registration before attorney access
• May not include complete hospital stay records or specialist notes
• Best for recent outpatient treatment documentation

Email submission:

• Some facilities accept scanned authorizations via secure email
• Faster than mail but lacks delivery confirmation of fax
• Verify facility email security meets HIPAA requirements

Approximately 83% of California healthcare providers now use electronic health record systems enabling digital request processing.

What to Do When Hospitals Don't Respond Within 15 Days

California's 15-day statutory deadline begins when providers receive valid requests. If providers miss this deadline:

1. Submit written follow-up - Reference original request date, authorization details, and statutory deadline
2. Contact HIM supervisor - Escalate beyond front-line staff to department management
3. Document non-compliance - Maintain records of all communications and submission confirmations
4. File complaint with Medical Board - California Medical Board maintains complaint systems for non-compliance
5. Consider court intervention - Motions to compel may become necessary for critical case documentation

Automated follow-up systems that contact providers daily eliminate the need for manual tracking and ensure persistent pursuit of outstanding records without staff time investment.

How to Find Old Medical Records Online in California

Digital health information systems provide faster access to recent treatment records, though limitations exist for comprehensive case documentation needs.

Using Patient Portals to Access Recent Medical Records

Approximately 93% of California hospitals now offer online patient portals for medical record access. Major portal platforms include:

• MyChart (Epic Systems) - Used by Stanford Health Care, UCSF Health, and many California hospital systems
• MyHealthONE - Common for Good Samaritan and community hospitals
• HealtheLife - Alternative platform for smaller healthcare networks

Portal access provides immediate record availability for:

• Office visit summaries and clinical notes
• Laboratory results and diagnostic reports
• Medication lists and prescription histories
• Vaccination records
• Recent imaging study reports (though actual images may require separate requests)

Limitations include incomplete records from hospital admissions, missing specialist consultations, and gaps in historical treatment predating portal implementation.

California Health Information Exchanges for Multi-Provider Records

Health Information Exchanges (HIEs) connect multiple healthcare organizations to share patient data across systems. California's health information infrastructure includes:

• California Health Information Exchange (CalHIE) - Statewide network connecting providers
• Epic Care Everywhere - Interoperability network linking Epic system hospitals
• Direct messaging standards - Secure provider-to-provider communication protocols
• TEFCA qualified health information networks - Federal framework for nationwide exchange

HIE access typically requires provider credentials rather than patient authorization, limiting direct attorney access. However, clients can request consolidated records from their primary care providers who access HIE data.

Limitations of Free Online Medical Record Access

While 32% of patients know they can request records electronically through patient portals, digital access rarely provides complete documentation for PI cases.

Portal records typically exclude:

• Handwritten provider notes and annotations
• Complete imaging studies (X-rays, MRIs, CT scans)
• Billing records and itemized charges
• Records from closed or merged facilities
• Treatment predating EHR system implementation
• Emergency department documentation beyond discharge summaries

Comprehensive case preparation requires combining portal downloads with formal record requests that capture complete documentation across all treatment sources.

Finding Old Medical Records from Childhood and Closed Facilities

Historical records and documentation from defunct healthcare facilities require specialized retrieval strategies beyond standard request protocols.

How Long California Hospitals Must Keep Medical Records

California law mandates minimum retention periods that vary by patient age:

• Adult patients - 7 years from last treatment date
• Minors - Until patient reaches age 18 plus 7 additional years (age 25 minimum)
• Specialized records - Longer retention for specific record types (surgical, psychiatric, radiation)

For PI cases involving childhood injuries where claims emerge in adulthood, California's extended minor retention rules often preserve critical documentation. Birth injury cases, childhood accidents, and early-life exposures benefit from these longer retention periods.

Locating Records When a Hospital Has Closed

Hospital closures, mergers, and acquisitions create record custody challenges. When seeking records from defunct facilities:

Identify successor entities:

• Merged hospitals often transfer records to acquiring organizations
• Hospital system consolidations create centralized record repositories
• Contact California Department of Public Health for closure documentation

Bankruptcy record custodians:

• Court-appointed custodians maintain records for bankrupt healthcare facilities
• Bankruptcy dockets identify designated record keepers
• Special procedures may apply for accessing custodian-held records

Microfilm and archive services:

• Older records may exist only on microfilm or microfiche
• Third-party storage companies often maintain legacy hospital archives
• Extended processing times apply for archive retrieval

Proprietary databases that track provider history and facility closures significantly accelerate the process of locating records from defunct organizations.

Accessing Pediatric Records for Adult Injury Claims

Adult plaintiffs claiming injuries from childhood events need pediatric treatment records to establish historical baselines and pre-existing condition timelines.

California's minor record retention requirements mean hospitals must maintain pediatric records until patients reach age 25. For cases filed by adults in their 20s or 30s claiming childhood injuries, these records often still exist.

When requesting pediatric records for adult clients:

• Specify patient was treated as a minor on specific dates
• Reference California's extended minor retention requirements
• Request archive searches if standard retention periods expired
• Consider statute of limitations implications for delayed discovery claims

Common Record Retrieval Problems PI Lawyers Face (and Solutions)

Even experienced PI firms encounter systematic obstacles that delay record retrieval and extend case timelines. Understanding these patterns enables proactive prevention.

Why Hospitals Reject Medical Record Requests

Provider rejections stem from technical deficiencies rather than substantive objections. Common rejection reasons include:

Authorization defects:

• Missing wet signatures or photocopied signature images
• Expired authorizations submitted beyond validity periods
• Vague record descriptions lacking specificity
• Absent or incorrect patient identifiers

Request processing errors:

• Misspelled patient names not matching registration records
• Wrong facility locations for multi-site health systems
• Missing dates of service for targeted requests
• Incomplete provider addresses causing delivery failures

Fee-related issues:

• Failure to include advance payment when required
• Disputes over reasonable fee calculations
• Requests without payment method information

AI error-checking systems review requests before submission, catching misspellings, missing dates of service, and absent wet signatures that trigger rejections.

How to Reduce Retrieval Time from Months to Weeks

Traditional medical record retrieval timelines often extend to months when cases involve multiple providers. Acceleration strategies include:

Multi-channel retrieval approaches:

• Combine portal downloads for recent records with formal requests for complete documentation
• Use HIE integrations where available to access multi-provider records simultaneously
• Submit requests to all known providers concurrently rather than sequentially

Automated follow-up systems:

• Daily provider contact eliminates manual tracking burden
• Real-time status updates identify delays requiring escalation
• Persistent pursuit prevents requests from languishing in processing queues

Proactive error prevention:

• Pre-submission validation catches authorization defects
• Provider database verification ensures correct facility contact information
• Templates customized for specific hospital requirements reduce rejection rates

Platforms offering 10-12 day average turnaround represent significant improvements over traditional months-long retrieval timelines.

Handling Provider Fee Disputes in California

When providers demand fees exceeding California's statutory limits, document the dispute and respond formally:

1. Request itemized fee breakdown - Providers must justify charges under "reasonable clerical costs" standard
2. Reference California Health and Safety Code Section 123110 - Cite statutory $0.25 per page limit
3. Negotiate electronic delivery - Digital formats often cost less than paper copies
4. File complaint if necessary - Medical Board complaints address fee violations
5. Consider payment under protest - Pay disputed fees to obtain records while reserving objection rights

Most fee disputes resolve when providers receive formal challenges citing specific statutory limits.

Organizing and Analyzing Medical Records for Case Strategy

Raw medical records require transformation into structured case chronologies that reveal key facts, treatment patterns, and strategic considerations.

Creating a Medical Chronology from Thousands of Pages

Multi-provider cases generate thousands of pages of documentation that overwhelm manual review. Systematic chronology creation organizes records into usable formats:

Chronological organization:

• Sort all records by treatment date rather than receipt order
• Group related encounters (emergency visit, admission, discharge) together
• Create timeline visualization showing treatment episodes and gaps

Visit-by-visit summaries:

• Condense each encounter into key findings, diagnoses, and treatments
• Link summaries to underlying source documents for verification
• Flag critical events requiring detailed analysis

Provider categorization:

• Separate records by treating facility and specialty
• Track referral patterns between providers
• Identify missing links in treatment chains

AI-powered chronology tools automatically organize, compile, and summarize case records with all patient encounters grouped by visit, enabling rapid navigation through extensive documentation.

Identifying Hidden Facts That Impact Case Value

Systematic record analysis uncovers case-critical details that shape settlement negotiations and trial strategy:

Pre-existing conditions:

• Historical diagnoses that defense attributes to current complaints
• Baseline functional limitations predating incident
• Prior similar injuries requiring differentiation

Treatment gaps:

• Missed appointments suggesting injury minimization
• Extended periods without care indicating recovery
• Non-compliance with treatment recommendations

Missed appointments:

• Provider documentation of no-shows and cancellations
• Patient explanations for missed care
• Patterns suggesting injury severity versus convenience

Diagnostic inconsistencies:

• Discrepancies between patient complaints and clinical findings
• Conflicting provider opinions on causation
• Imaging studies not matching symptom presentation

AI extraction engines specifically flag breaches in care, future medical expenses supported by documentation, and hidden facts like missed appointments and pre-existing conditions that opposing counsel exploits.

Cross-Referencing Medical and Billing Records

Medical records and billing documentation tell different stories that must align for credibility:

Billing record verification:

• Confirm charges match documented services
• Identify billing for services not appearing in clinical notes
• Detect potential upcoding or billing irregularities

Treatment timeline confirmation:

• Billing dates establish service chronology
• Missing bills suggest incomplete medical record production
• Charge descriptions clarify ambiguous clinical documentation

Damages calculation support:

• Itemized billing provides economic damages foundation
• Reasonable and necessary charges analysis
• Future care cost projections based on historical billing patterns

Automated systems cross-reference medical and billing records to identify discrepancies requiring investigation.

Missing Record Review: Ensuring You Have Everything Before Trial

Incomplete record sets create trial vulnerabilities when defense counsel produces documentation during discovery that plaintiff counsel should have obtained initially.

How to Identify Gaps in Medical Record Collection

Systematic gap analysis prevents missing documentation that emerges during depositions or trial:

Timeline-based detection:

• Map all treatment dates from billing records and provider references
• Identify documentation gaps between known encounters
• Flag missing records within chronology visualization

Referral documentation verification:

• Track specialist referrals mentioned in primary care notes
• Request records from all referenced consultants
• Verify receipt of diagnostic study results discussed in notes

Cross-provider reconciliation:

• Compare patient medication lists across providers
• Identify treatments mentioned but not documented
• Investigate references to outside facilities

Missing Record Review systems cross-reference patient medical history to identify gaps in record collection before trial, allowing targeted requests rather than redundant broad submissions.

Common Missing Records That Undermine PI Cases

Specific record categories frequently slip through initial collection efforts:

Emergency transport documentation:

• Ambulance run sheets with first responder observations
• Paramedic treatment notes and patient complaints
• Transport times and facility selection rationale

Imaging studies:

• Actual images (X-rays, MRIs, CT scans) versus radiologist interpretations
• Comparison studies showing injury progression
• Digital imaging files for expert witness review

Physical therapy treatment logs:

• Session-by-session progress notes
• Home exercise program compliance documentation
• Functional capacity evaluations and restrictions

Pharmacy records:

• Complete medication dispensing history
• Early refill patterns suggesting pain levels
• Prescription changes indicating treatment adjustments

Specialist consultation records:

• Referral notes from specialists mentioned by primary providers
• Independent medical evaluations
• Expert opinions on causation and prognosis

Pre-Trial Record Certification

Before trial, verify record completeness through systematic review:

1. Create provider list - Document every facility and practitioner mentioned anywhere in records
2. Cross-reference authorizations - Confirm requests submitted to all identified providers
3. Verify responses - Ensure received records from every requested source
4. Conduct timeline review - Check for unexplained gaps in treatment chronology
5. Expert witness consultation - Have medical experts identify missing critical documentation

This certification process prevents courtroom surprises when opposing counsel produces records during cross-examination that should have been in plaintiff counsel's possession.

How Codes Health Transforms Medical Record Retrieval for California PI Firms

California personal injury firms managing high case volumes face systematic bottlenecks in medical record acquisition, analysis, and organization. Codes Health addresses these challenges through AI-powered retrieval and automated chronology creation specifically designed for legal applications.

Faster Retrieval With Proactive Error Prevention

Codes Health operates medical record retrieval services averaging 10-12 day turnaround times, significantly faster than traditional services requiring months. The platform employs AI error checking to review record requests before submission, proactively catching misspellings, missing dates of service, and absent wet signatures that cause provider rejections.

This pre-submission validation eliminates the rejection cycles that add weeks to retrieval timelines. The system provides complete visibility into request status with real-time updates for every fax and call made on your behalf, ensuring transparent tracking without manual follow-up burden.

Automated daily follow-ups with all providers ensure persistent pursuit of outstanding records without staff intervention, while proprietary databases locate patients' previous providers—particularly important for cases involving multiple treatment facilities or years of medical history.

AI-Powered Analysis That General Platforms Cannot Match

While general AI platforms like ChatGPT cannot accurately analyze medical records, Codes Health's specialized legal AI platform processes records with precision specifically for personal injury case needs. The platform automatically organizes, compiles, and summarizes case records into chronological order, with all patient encounters and bills grouped and summarized by visit.

This enables rapid navigation through potentially thousands of pages of medical documentation, with chronology visualization identifying missing records within timelines. Rather than conducting redundant broad requests, attorneys can request specific gaps identified through AI analysis.

The insights extraction engine flags case-critical elements including:

• Breaches in care where providers failed to meet treatment standards
• Future medical expenses supported by documentation
• Hidden case facts such as missed appointments and pre-existing conditions
• Buried diagnoses that could determine case outcomes

An intake co-pilot chat interface allows conversational queries of patient history rather than manual document review, dramatically reducing the time attorneys spend extracting case-relevant facts.

Integration and Scalability for High-Volume Practices

Codes Health integrates with multiple health information exchanges (HIEs), TEFCA networks, and EHR systems, combining digital access channels with traditional retrieval methods. For high-volume firms, the platform can build custom integrations with CRM platforms and other medical software systems.

The HIPAA-compliant e-signature system for release of information requests eliminates common authorization errors, while secure document storage enables record reuse across multiple cases without repeated retrieval costs—particularly relevant for mass tort practices handling multiple claims for individual plaintiffs.

Missing Record Review cross-references patient medical history to identify gaps in record collection before trial, ensuring complete documentation sets that withstand defense scrutiny. The platform operates on a flat fee structure, providing cost predictability for firms processing high volumes of record requests.

For California PI firms ready to eliminate months-long retrieval delays and manual chronology creation, Codes Health offers specialized capabilities that general legal technology cannot replicate.

Frequently Asked Questions

How long does it take to get medical records from California hospitals for personal injury cases?

California law requires providers to respond within 15 calendar days after receiving valid requests. However, approximately 45% of initial requests face delays due to incomplete authorization forms. AI-powered retrieval platforms average 10-12 day turnaround times by preventing authorization errors and maintaining automated daily follow-ups.

What is the maximum fee California hospitals can charge for medical records?

California law caps fees at $0.25 per page plus reasonable clerical costs. Standard requests average $35, though extensive hospital stays can exceed $150. Electronic delivery typically costs less than paper copies. Recipients of Medi-Cal, CalWORKs, SSI/SSP, or similar public benefit programs qualify for free records.

What happens if a California hospital refuses to release medical records to my attorney?

Document the refusal and statutory deadline violation, then submit written follow-up referencing the original request date and California's 15-day requirement. Escalate to HIM department supervisors, file complaints with the Medical Board of California, and consider motions to compel for critical case documentation. Most non-compliance stems from authorization defects rather than substantive refusals.

How far back can I request medical records in California for personal injury cases?

California requires adult patient records be maintained for 7 years from last treatment, while minor records must be kept until the patient reaches age 18 plus 7 additional years (minimum age 25). Records older than retention requirements may still exist in archives or microfilm storage, though retrieval requires special requests and extended processing times.

Do I need separate HIPAA release forms for mental health and substance abuse records?

Yes. Psychiatric care, HIV/AIDS status, and substance abuse treatment records require specific authorization language explicitly referencing these record types. Generic "all records" authorizations may result in redacted releases excluding protected information. Federal 42 CFR Part 2 regulations impose stricter consent requirements for substance abuse treatment beyond standard HIPAA protections.