Substance Use Disorder Records (42 CFR Part 2)
42 CFR Part 2 provides federal confidentiality protections for substance use disorder (SUD) patient records that are stricter than HIPAA in many respects. Originally enacted to encourage people to seek treatment without fear of disclosure, Part 2 restricts how SUD treatment programs, and those who receive records from them, can use and disclose patient information.
Key Points
Part 2 protections are stricter than HIPAA and apply ON TOP of HIPAA
Patient consent is generally required for ANY disclosure, including for treatment and payment (unlike HIPAA)
Records that identify a patient as having or being treated for a SUD are protected
Re-disclosure is prohibited: anyone who receives Part 2 records cannot share them further without patient consent
Recent amendments (2024) have aligned some Part 2 provisions with HIPAA, allowing disclosure for treatment, payment, and operations with patient consent
Key Areas
Consent Requirements
Patient consent for disclosure, revocation
Permitted Disclosures
Medical emergencies, audits, research, court orders
Key Provisions
Consent Requirements
Specifies what a valid consent must include: who can disclose, who will receive, purpose, what information, right to revoke, expiration date.
Applicability
Defines which programs and records are covered by Part 2. Understanding scope is the first compliance question.