42 CFR Part 2: Understanding Confidentiality for Substance Use Disorder Records

Many people avoid substance use disorder treatment because they fear that a diagnosis or treatment record could be used against them in court, employment, housing, custody, licensing, or other areas of life. Federal confidentiality law known as 42 CFR Part 2 was designed to reduce that fear by placing special limits on the use and disclosure of certain substance use disorder patient records. ¹

Part 2 is not a general rule covering every mention of alcohol or drug use in every medical record. It applies to records that identify a person as having or having had a substance use disorder and that are created, received, or maintained by a qualifying Part 2 program. The program must generally be federally assisted and hold itself out as providing—and actually provide—substance use disorder diagnosis, treatment, or referral for treatment. ²

Why Part 2 Is Different

HIPAA protects a broad range of health information held by covered entities and business associates. Part 2 is narrower in what it covers, but it can be stricter about how covered substance use disorder records are used—especially in investigations and proceedings against the patient.

The regulations state that Part 2 records may be used or disclosed only as permitted by Part 2. Any disclosure must be limited to the information necessary for its purpose. The restrictions apply even when the requester already knows about the person’s treatment, claims to have another source, is a government official, or presents a subpoena that does not satisfy Part 2. ²

What Records Are Covered?

Part 2 generally protects records that:

1. Identify a person directly or indirectly as having or having had a substance use disorder; and
2. Were created, received, or acquired by a federally assisted Part 2 program relating to substance use disorder diagnosis, treatment, or referral for treatment.

“Federally assisted” is broader than receiving a federal grant. It can include certain federal funding, tax status, authorization, registration, licensing, or other federal support described in the regulation. A hospital may have only one identified unit or provider that functions as a Part 2 program, while the rest of the hospital does not.

An emergency department note mentioning intoxication or an overdose is not automatically a Part 2 record. The regulation gives examples of circumstances that do not qualify, including an overdose or intoxication diagnosis that clearly shows the person does not have a substance use disorder. Likewise, a general medical provider does not become a Part 2 program merely because the provider screens for substance use or treats medical consequences of use. ²

Even Confirming Treatment Can Be a Disclosure

If a facility or unit is publicly identified as providing only substance use disorder diagnosis, treatment, or referral, staff ordinarily may not confirm that a named person is or was there without written consent or an authorizing Part 2 court order. When a requested disclosure is not permitted, the response must not reveal that the identified person has a substance use disorder or is a patient. ²

This is why a program may respond to a caller with a neutral statement such as, “Federal law restricts what information this program can confirm,” rather than confirming or denying that a person receives services.

Consent Under the Updated Part 2 Rule

Written patient consent remains a central pathway for sharing Part 2 records. The updated rule allows a patient to give a single consent for future uses and disclosures for treatment, payment, and health care operations. When a HIPAA covered entity or business associate receives Part 2 records under that consent, it may generally redisclose them as HIPAA permits, except for prohibited uses in proceedings against the patient. The patient may revoke the consent in writing, although revocation does not undo actions already taken in reliance on it. ³

A Part 2 consent must contain required elements. Depending on the type of consent, these include the patient’s name, the information to be disclosed, the purpose, who may disclose and receive it, an expiration date or event, the patient’s signature, and the date. Consent for treatment, payment, or health care operations must also explain the possibility of redisclosure and the consequences of refusing to sign. ²

Some information receives additional protection:

• SUD counseling notes maintained separately from the rest of the record require specific consent and cannot be disclosed through a broad treatment, payment, and operations consent.
• Consent to use records in a civil, criminal, administrative, or legislative proceeding must be separate from consent for other purposes.
• Each disclosure made with consent must include a copy of the consent or a clear explanation of its scope.

Before signing, a patient can ask what information is covered, who can receive it, whether it can be redisclosed, how long the consent lasts, and how to revoke it.

When Disclosure May Occur Without Patient Consent

Part 2 permits specific disclosures without written patient consent. These are exceptions with conditions, not permission for unlimited sharing.

Medical emergencies

Patient-identifying information may be disclosed to medical personnel to the extent necessary to meet a bona fide medical emergency when prior written consent cannot be obtained. The program must document who received the information, who made the disclosure, the date and time, and the nature of the emergency. ⁴

Suspected child abuse or neglect

Part 2 does not block reports of suspected child abuse or neglect required by state law. However, the original Part 2 treatment records remain protected, including in later civil or criminal proceedings arising from the report. Reporting suspected abuse does not automatically open the person’s complete substance use disorder record. ²

Crimes on program premises or against program personnel

A program may provide limited information to law enforcement about a crime committed on program premises, a crime against program personnel, or a threat to commit such a crime. The disclosure must be directly related to the incident and limited to the circumstances and certain identifying or location information allowed by the rule. ²

Qualified service organizations

A program may share information needed by a qualified service organization to provide services to or for the program, such as data processing, billing, laboratory, legal, accounting, or certain other professional services. The organization must enter a written agreement acknowledging that it is bound by Part 2 when handling the records.

Research, audits, and evaluations

Part 2 contains pathways for qualifying scientific research and authorized audits or evaluations. These pathways have detailed conditions, including safeguards, restrictions on redisclosure, and limits on using information to investigate or prosecute patients. Research reports must use aggregate data de-identified under HIPAA standards when Part 2 patient-identifying information was received under the research provision. ²

Public health

The updated rule permits disclosures to public health authorities without consent when the records are de-identified under the HIPAA Privacy Rule’s standards. ³

A Subpoena Alone May Not Be Enough

One of the most important Part 2 principles is that ordinary legal process does not automatically authorize use of covered records. A subpoena, warrant application, administrative demand, or other request must be evaluated under Part 2. The regulations include detailed procedures and standards for a court order authorizing use or disclosure.

Part 2 sharply restricts using covered records or testimony based on those records to investigate or prosecute the patient or against the patient in civil, criminal, administrative, or legislative proceedings. Generally, that use requires the patient’s specific written consent or a court order that satisfies Part 2. These restrictions can follow the records after a lawful disclosure and apply to people who later obtain them. ²

A Part 2 court order is not the same thing as a subpoena. Depending on the purpose, the court must make required findings, provide required notice and an opportunity to be heard, and limit disclosure to essential information and people with a need for it. Applications and proceedings must also use safeguards to avoid unnecessary identification of the patient.

Rules for Minors

Part 2 connects a minor’s control over disclosure to the law governing the minor’s ability to consent to substance use disorder treatment. When state law allows the minor to obtain treatment without parental consent, only the minor generally may consent to disclosure. When state law requires parental or guardian consent for treatment, both the minor and the authorized adult may be required to consent to disclosure. Part 2 also contains a limited safety provision for a minor who lacks capacity to make a rational choice and faces a substantial threat to life or physical well-being. ²

Because minor-consent law varies by state and circumstance, families and providers should not assume that a parent always has complete access or that a minor always controls every record.

Patient Rights Under Part 2

Under the current rule, a patient has important rights that include:

• Receiving a plain-language Notice of Privacy Practices explaining uses, disclosures, rights, complaints, and the program’s duties.
• Accessing the patient’s own Part 2 records; Part 2 does not prohibit a program from allowing inspection and copying.
• Requesting restrictions on certain uses and disclosures.
• Revoking a written consent as allowed by the rule.
• Receiving breach notification when unsecured Part 2 records are breached under the applicable notification rules.
• Filing a complaint with the Part 2 program and directly with the HHS Office for Civil Rights.
• Being protected from retaliation for filing a complaint or exercising Part 2 rights.

The updated rule also provides rights relating to an accounting of disclosures, although HHS has stated that the compliance date for the revised accounting requirement will be set with related HIPAA rulemaking. ³

Security and Breach Protection

Part 2 programs and other lawful holders generally must maintain formal policies and procedures to protect patient-identifying information from unauthorized uses, disclosures, and reasonably anticipated threats or hazards. The rule addresses paper and electronic records, access, transfer, storage, destruction, and de-identification. It also applies HIPAA-style breach-notification requirements to breaches of unsecured Part 2 records. ²

How Part 2 Relates to HIPAA and State Law

Part 2 and HIPAA may protect the same information. The 2024 final rule aligned several Part 2 requirements with HIPAA, particularly consent for treatment, payment, and health care operations, breach notification, enforcement, and notices. But Part 2 did not disappear. Its restrictions on proceedings against a patient remain especially important. ³

State law may also provide stronger confidentiality. Part 2 does not authorize a disclosure that state law prohibits, and a state law cannot authorize or compel a disclosure that Part 2 prohibits. The holder must comply with all applicable protections. ²

Practical Examples

A family member asks whether someone is in treatment

If confirming the person’s presence would identify them as a patient of a Part 2 program, the program generally cannot confirm it without valid consent or another Part 2 basis. Staff may give a neutral response without confirming or denying treatment.

A hospital needs records during an emergency

When a bona fide medical emergency exists and prior consent cannot be obtained, the program may disclose necessary information to medical personnel and must document the disclosure. This exception is tied to the emergency; it is not a general release for unrelated purposes.

A patient signs a broad consent for coordinated care

A compliant single consent may authorize future treatment, payment, and health care operations disclosures. If the patient later revokes it in writing, future disclosures based on that consent must stop, subject to actions already taken and any other lawful basis.

Law enforcement asks for the chart

The program cannot release covered records merely because law enforcement asks, knows the person attended, or presents ordinary process that does not meet Part 2. Specific consent or a qualifying Part 2 court order may be required, and the records generally cannot be used to investigate or prosecute the patient.

How to Raise a Concern

If you believe Part 2 records were improperly used or disclosed:

1. Document what happened, including dates, people, the information involved, and how you learned of the disclosure.
2. Request the program’s Notice of Privacy Practices and complaint instructions.
3. Contact the program’s privacy contact or file a complaint with the program.
4. File a written complaint with the HHS Office for Civil Rights. HHS generally requires complaints within 180 days of when the person knew of the act, although it may extend that period for good cause. ⁵
5. Consider speaking with an attorney experienced in health privacy or substance use disorder confidentiality when the records affect a criminal, civil, custody, employment, licensing, or benefits matter.

The Main Point

42 CFR Part 2 provides specialized protection for identifiable substance use disorder records held by qualifying programs. It permits carefully defined disclosures, including consent-based sharing for care and limited exceptions such as medical emergencies, but it continues to place strong restrictions on using records against patients. The safest question is not simply, “Does HIPAA allow this?” It is, “Is this a Part 2 record, what exact authority permits this use or disclosure, and does any other federal or state law impose a stricter rule?”