I've just been at a partner training event at Symantec and had it confirmed that HF2 is cumulative, it includes HF1. Some people, including Symantec staff, weren't sure and thought they might be separate fixes, particularly as the HF2 release notes make no mention of HF1.