1. What is 42 CFR Part 2 and what does it do?
The federal confidentiality law and regulations protect the privacy of substance use disorder (SUD) patient records by prohibiting unauthorized disclosures of patient records except in limited circumstances. Congress enacted the legislation in the 1970s to encourage individuals with SUDs to enter and remain in treatment. 42 USC § 290dd-2. The regulations implementing the law are at 42 CFR (Code of Federal Regulations) Part 2 and are commonly referred to as “Part 2.”
2. Why is Part 2 important to people living with substance use disorders?
Many people report that confidentiality is one of their top concerns before entering treatment for SUD. People often experience discrimination and negative consequences from the stigma and legal penalties associated with drug and alcohol addiction. These consequences include arrest, prosecution, and incarceration, as well as loss of housing, child custody, employment, insurance, and public benefits. As a result, public health experts agree that people living with SUD are more likely to seek out and stay in treatment if they know their treatment records will not be unnecessarily disclosed to others without their knowledge or permission.
Back to top
3. How does Part 2 work?
Part 2 generally prohibits treatment programs and certain third-party recipients from disclosing patient identities or records without patient consent, except in the following circumstances:
- Medical emergencies, 42 CFR § 2.51
- Child abuse or neglect reports required by state law, 42 CFR § 2.12(c)(6)
- Reporting a patient’s crime on program premises or against program personnel, 42 CFR § 2.12(c)(5)
- Qualified audit or evaluation of the program, 42 CFR § 2.53
- Research requests, 42 CFR § 2.52
- Qualified Service Organization Agreements, 42 CFR § 2.12(c)(4)
- Court orders authorizing disclosure and use of the patient records, 42 CFR §§ 2.61-2.67
4. How does Part 2 protect my treatment records from law enforcement and subpoenas?
Part 2 recognizes the sensitivity of SUD patient records by requiring a special court order before turning over patient records in response to a subpoena, search warrant, or law enforcement request. 42 USC § 290dd-2; 42 CFR §§ 2.61-2.67.
Legal Action Center has prepared a number of sample forms to help programs and courts comply with the Part 2-specific court order requirements, including:
5. How does Part 2 protect my treatment records from redisclosure?
Disclosures of Part 2-protected information must be accompanied by a notice prohibiting redisclosure. (See sample notice, available here.) In general, the recipient of Part 2-protected information must also comply with Part 2’s protections and may not re-disclose the information except as permitted by Part 2. 42 CFR § 2.32.
Back to top
6. What is the difference between Part 2 and HIPAA?
Both Part 2 and HIPAA – the Health Insurance Portability and Privacy Act of 1996 – protect patient privacy by regulating the way that patient information can be shared and disclosed. HIPAA applies to many types of patient information, not just SUD information, and generally is less protective of patient privacy than Part 2.
One of the most important differences between Part 2 and HIPAA is the privacy protections for patient records in criminal and civil legal proceedings. As discussed above, Part 2 requires a specific court order for the disclosure of Part 2-protected information in response to a subpoena, search warrant, or law enforcement request. Unlike other types of protected health information, SUD records may expose a patient to criminal liability or other negative legal consequences.
HIPAA also permits disclosures without patient consent for “treatment, payment, or healthcare operations.” 45 CFR § 164.506. For patients with SUDs, these disclosures may lead to stigma and discrimination at the hands of their healthcare providers and the loss of insurance or even employment. Part 2 requires patient consent authorizing disclosure of SUD records for treatment, payment, or healthcare operations. 42 CFR § 2.33.
For more information on this subject, visit our Confidentiality Resources page, including these additional resources:
- 42 CFR Part 2 vs. HIPAA – the Facts: This factsheet details the differences between 42 CFR Part 2 protections and HIPAA confidentiality protections.
- 42 CFR Part 2 Is Not the Problem: Changing the Privacy Requirement Could Cause a Lot of Harm without Any Real Benefit (Q&A): This handout with Q&A explains why changing 42 CFR Part 2, the federal regulations protecting substance use disorder confidentiality, could cause a lot of harm without any real benefit. These confidentiality regulations have been in place since the 1970s to assure patients seeking addiction care won’t be more vulnerable to negative legal and civil consequences through exposure of information about their substance use. Loosening these protections would only discourage patients from seeking the care they need to get and stay well.
- Confidentiality and Overdose: Q & A (2017): This factsheet addresses questions about how confidentiality rules are applied in cases of emergency drug and alcohol overdose, including: when does HIPAA apply versus 42 CFR Part 2? And what are the rules around disclosure of substance use disorder information to family members/friends involved in the patients’ care in these cases?
- Privacy Rights of Patients Treated for Overdose in Emergency Departments (2018): This memorandum provides guidance for hospital emergency department staff on how to notify patients’ family members after an overdose while complying with two federal privacy laws: 42 CFR Part 2 and HIPAA. LAC prepared this legal resource for Addiction Policy Forum’s “Hospital Toolkit.”
7. How did the Part 2 regulations change?
The federal agency responsible for promulgating the Part 2 regulations, the Substance Abuse and Mental Health Services Administration (“SAMHSA”), amended the Part 2 regulations in 2017 and again in 2018.
To help treatment programs understand the changes to the law, Legal Action Center offered a series of webinars on the new amendments, and also developed two factsheets:
- What Substance Use Treatment Providers Should Know – 2018 Amendments
- What Substance Use Treatment Providers Should Know – 2017 Amendments
Prior to amending the regulations, SAMHSA asked for feedback on the regulations and the importance of patient privacy in a series of listening sessions and Federal Register notices. Legal Action Center’s comments – including oral commentary at public listening sessions, formal written comments, and responses to proposed rulemakings – strongly advocated for maintaining the confidentiality of substance use disorder treatment records. Copies of our comments, and templates for stakeholders, are available in our Confidentiality Resources.
Back to top
8. How do the updated Part 2 regulations help integrate SUD with other protected health information?
The new amendments make it easier to share Part 2 information with providers and other entities who need access to it. Patients can now disclose their SUD information to their “treating providers” in entities that are involved in integrated care settings (e.g., health information exchanges, networks of care, and accountable care organizations). The consent form does not need to list the names of each healthcare provider. 42 CFR § 2.31(a)(4)(iii)(2), (3). Similarly, patients can now authorize disclosure of information to entire entities with treating provider relationships (e.g., community health centers and medical centers). 42 CFR § 2.31(a)(4)(ii).
The revised regulations also allow patients to consent to disclose their information using a general designation and a timeframe for the disclosure, such as to “all of my past, present, and future treating providers at the ABC Health Information Exchange.”
These and other developments should help to integrate SUD information with overall health information to assist providers in delivering comprehensive care to their patients, while maintaining patients’ rights to protect the confidentiality of their SUD records.
Back to top
9. What’s the bottom line?
People living with SUDs continue to experience stigma, discrimination, and serious negative consequences when treatment information is disclosed without their knowledge or consent. As a member of the Campaign to Protect Patient Privacy Rights, the Legal Action Center and over 100 of the nation’s leading addiction treatment, recovery, healthcare and advocacy organizations strongly support Part 2’s core confidentiality protections. Part 2 regulations play an integral and unique role in safeguarding the confidentiality of SUD information. The regulations also have made it easier for patients to consent to disclosures of their SUD information to their treating providers in integrated care settings. In light of the current national opioid crisis, now more than ever – people living with SUDs depend on Part 2’s protections to stay and complete their treatment without fear of negative consequences.
Back to top
10. Where can I get more information on 42 CFR Part 2 and Substance Use Confidentiality?
- Take one of the Legal Action Center webinars on the latest updates to 42 CFR Part 2.
- Purchase Confidentiality and Communication: A Guide to the Federal Alcohol and Drug Confidentiality Law and HIPAA. This seminal book for SUD treatment providers and others who must comply with federal confidentiality laws puts decades of LAC attorneys’ experience in your hands. Currently being updated for 2018 and soon will be available for purchase.
- Call the Legal Action Center’s confidentiality hotline. Our hotline is free to New York treatment providers and government agencies. We also offer a paid subscription service to state SUD licensing agencies and provider associations; programs in states that subscribe to our “Actionline” can call and speak to a Legal Action Center attorney anytime Monday through Friday, between 1-5pm.
- Visit our Substance Use Disorder Resources.
- Subscribe to our 42 CFR Part 2 email list to ensure you get the latest updates on substance use disorder confidentiality.