Quality & Science

Confused by Confidentiality? A Primer on 42 CFR Part 2

by Susan Awad | August 15, 2013

Red check and green x

Image courtesy of Salvatore Vuono / FreeDigitalPhotos.net

Just about anyone who has ever received medical care has heard of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the law that regulates the use and disclosure of Protected Health Information (PHI) held by "covered entities" such as health plans. But far fewer are familiar with the special privacy protections afforded to alcohol and drug abuse patient records by 42 Code of Federal Regulations (“CFR”) Part 2.

The privacy provisions in 42 CFR Part 2 were motivated by the understanding that stigma and fear of prosecution might dissuade persons with substance use disorders from seeking treatment. To add an extra layer of protection on these records, the regulations outline under what limited circumstances information about a patient’s treatment may be disclosed with and without the patient’s consent. Who and what are covered can be confusing, though.

Thankfully, the Legal Action Center has developed a handy set of FAQs for the Substance Abuse and Mental Health Services Administration, which are summarized here:
  • 42 CFR Part 2 applies to any individual or entity that is federally assisted and holds itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment or referral for treatment (42 CFR § 2.11). Most drug and alcohol treatment programs are federally assisted. For-profit programs and private practitioners that do not receive federal assistance of any kind would not be subject to the requirements of 42 CFR Part 2 unless the State licensing or certification agency requires them to comply. However, any clinician who uses a controlled substance for detoxification or maintenance treatment of a substance use disorder requires a federal DEA registrationand becomes subject to the regulations through the DEA license.
  • The regulations restrict the disclosure and use of alcohol and drug patient records which are maintained in connection with the performance of any federally assisted alcohol and drug abuse program (42 CFR § 2.3(a)). The restrictions apply to any information disclosed by a covered program that “would identify a patient as an alcohol or drug abuser …” (42 CFR §2.12(a) (1)). In laymen’s terms, the information protected by 42 CFR Part 2 is any information disclosed by a covered program that identifies an individual directly or indirectly as having a current or past drug or alcohol problem, or as a participant in a covered program.
  • With limited exceptions, 42 CFR Part 2 requires patient consent for disclosures of protected health information even for the purposes of treatment, payment, or health care operations. Consent for disclosure must be in writing.
For more information, see the full list of FAQs or contact your legal counsel.


Leave a comment
  1. Philip Reisetter Apr 12, 2019 - 04:18 PM
    How perfect must a 42 cfr 2.31 consent form be to substantially comply with that reg? 
  2. judy Feb 09, 2019 - 05:27 PM
    im having a problem recieving records regarding my daughter dying in a facility. They are privately run facility.
  3. school substance abuse prevention Dec 10, 2018 - 12:05 PM
    What about minors? I work in a school system as a substance abuse prevention specialist and the question has come up about what we are required to disclose information to parents
  4. Richard logan Dec 05, 2018 - 03:25 AM
    I sent client names to my personal email by accident. Is this a violation?
  5. Sharon Nov 27, 2018 - 01:16 PM
    DOes this also protect the client if an organization asks them for a testimonial?
  6. Steave Gray Jul 03, 2018 - 06:58 AM
    Join expert speaker Melissa Soliz as she breaks down a complex legal concept into a set of straightforward questions health care organizations can ask to determine Part 2 applicability and compliance obligations. - https://www.audioeducator.com/hospitals-and-health-systems/42-cfr-part-2-opioid-use-reporting-requirements.html
  7. Catdaddt Dec 03, 2017 - 12:08 AM
    They did it to me also. I got a letter from experian stating that my approved third party requested that I release my phi on my credit report. People are dirty. It is what it is. Yep.
  8. asam member May 14, 2016 - 11:24 AM
    Webmaster need to be monitoring these posts for inappropriate comments.
  9. CReam Mar 09, 2016 - 06:39 PM
    Question does hipaa include patients talking about other patients in order to attempt to get them evicted. I would think that since we all had to sign that paper she wouldn't be able to tell another person about another patient.
  10. Chief Spencer Jan 28, 2016 - 05:02 AM
    Can information obtained through drug testing be disclosed to treatment providers from methadone MMT even though the patient has not given permission 
  11. gmk Dec 08, 2015 - 04:15 AM
    Scenerio---Under 42 CFR can pts first names, last names initialed and admission dates be used as references in a written statement that could  eventually go into  someone's  personnel file?
  12. Kevin Collins Sep 25, 2015 - 06:00 PM
    I need information on the use of security cameras in D&A  facilities 
  13. Tracy Sep 19, 2015 - 01:04 AM

    I'm getting ready to go to another "sop posed" chronic pain treatment center...I'm SO TIRED AND AT THE END OF MY ROPE!!!! I really am not a drug addict or alcoholic, he'll, I don't even drink, but I do have the need and God given right to be prescribed pain medication,at least that's what I thought!!! I've been totally disabled since I was 32, I am now 51... And I'm NOT GONNA GET ANY BETTER!!!!! Anyway I don't know what I m trying to say, except that living a life of 24/7 chronic pain SUCKS. AND I WOULDNT HAVE EVER TAKEN A PILL FOR PAIN RELIEF UNTIL NOW, but now I'm not allowed to have any and it has nothing to do with my health, life or death, just a bunch of people who abuse the mess that I really need and U have to suffer EVERY DAY FOR THEIR IGNORANCE, SO PLEASE ALLOW ME TO THANK YOU IDIOTS FOR MY DAILY PAIN YMISERY

  14. Brad May 29, 2014 - 01:19 PM

    Rules are different for those involved with criminal justice?  The legal system can talk to treatment provider, and, if contracted by probation or parole, the provider is covered to talk to criminal justice?

  15. 101N Sep 07, 2013 - 05:30 PM

    "exempt medications specifically indicated for the treatment of a substance use disorder"

    A blanket exemption for suboxone & methadone will not work as both are prescribed for pain as well. As a pain subspecialist I want to 'trust' that my PDMP is inclusive of all opioids that my patients are prescribed.

  16. Zac Talbott | NAMA Recovery of TN Aug 22, 2013 - 03:41 AM
    I fully concur with @Sharon in the previous comment. Buprenorphine patients of DATA 2000 practices in states that employ the use of prescription monitoring programs should be exempt from the reporting to those databases in keeping with 42 CFR. I can only assume this has been an oversight within states that employ the use of a PMP because a substance abuse treatment patient's prescription information and history pertaining to medications specifically indicated for the detoxification and/or maintenance treatment of opioid addiction being reported to and accessible through such a state-implemented system is a clear violation of federal law and creates significant legal liability for all involved. It seems the easiest way to bring PMPs in compliance with federal privacy/confidentiality laws and regulations would be to exempt medications specifically indicated for the treatment of a substance use disorder from being reported to these state-created and state-implemented systems and programs.
  17. Sharon Dembinski Aug 20, 2013 - 10:20 AM

    42 CFR should be protecting all Pts. Why are bupe Pts not being protected? Prescription Monitoring Programs are exposing info that is supposed to be protected by 42 CFR. 

    I believe if the inclusion of buprenorphine info in the PMP was challenged it would not be defensible. 

    Leave a comment