Confused by Confidentiality? A Primer on 42 CFR Part 2

by Susan Awad | August 15, 2013

Red check and green x

Image courtesy of Salvatore Vuono /

Just about anyone who has ever received medical care has heard of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the law that regulates the use and disclosure of Protected Health Information (PHI) held by "covered entities" such as health plans. But far fewer are familiar with the special privacy protections afforded to alcohol and drug abuse patient records by 42 Code of Federal Regulations (“CFR”) Part 2.

The privacy provisions in 42 CFR Part 2 were motivated by the understanding that stigma and fear of prosecution might dissuade persons with substance use disorders from seeking treatment. To add an extra layer of protection on these records, the regulations outline under what limited circumstances information about a patient’s treatment may be disclosed with and without the patient’s consent. Who and what are covered can be confusing, though.

Thankfully, the Legal Action Center has developed a handy set of FAQs for the Substance Abuse and Mental Health Services Administration, which are summarized here:
  • 42 CFR Part 2 applies to any individual or entity that is federally assisted and holds itself out as providing, and provides, alcohol or drug abuse diagnosis, treatment or referral for treatment (42 CFR § 2.11). Most drug and alcohol treatment programs are federally assisted. For-profit programs and private practitioners that do not receive federal assistance of any kind would not be subject to the requirements of 42 CFR Part 2 unless the State licensing or certification agency requires them to comply. However, any clinician who uses a controlled substance for detoxification or maintenance treatment of a substance use disorder requires a federal DEA registrationand becomes subject to the regulations through the DEA license.
  • The regulations restrict the disclosure and use of alcohol and drug patient records which are maintained in connection with the performance of any federally assisted alcohol and drug abuse program (42 CFR § 2.3(a)). The restrictions apply to any information disclosed by a covered program that “would identify a patient as an alcohol or drug abuser …” (42 CFR §2.12(a) (1)). In laymen’s terms, the information protected by 42 CFR Part 2 is any information disclosed by a covered program that identifies an individual directly or indirectly as having a current or past drug or alcohol problem, or as a participant in a covered program.
  • With limited exceptions, 42 CFR Part 2 requires patient consent for disclosures of protected health information even for the purposes of treatment, payment, or health care operations. Consent for disclosure must be in writing.
For more information, see the full list of FAQs or contact your legal counsel.


Leave a comment
  1. Elina Smith May 17, 2017 - 05:12 AM
    tests 1-2 days after use, and hair tests up to 90 days after use. Are these information all true?? The time it takes to get clean can be a lot longer. Read the blog on - How long does heroin stay in your system? -
  2. Jennifer May 03, 2017 - 09:54 AM

    @ Stephen • Apr 14, 2017 - 05:51 PM   When I see a client/patient in an NA meeting that I am at, I take my work cap allllll the way off and leave it at that.  It is so important that people who come into NA can build trust and feel safe.  The principle of anonymity " what's said here stays here".  I try really hard to leave work at work, and when I am in a meeting, I am in a meeting. If my clients share some stuff in a meeting that I am in, when I return back to work, I have to act as if I never heard anything. 

    NA Tradition 7 is a really awesome tradition to read to. Especially for us who work in the health care, or behavioral health field.  I personally believe it is so important for the new comer to feel they can come in and share and get the help that they need without worrying it is going to back fire on them.   I am really grateful I am able to separate the two  (My work self, and my recovery self).

    I was taught early on when I got my job, to  not allow my job to become my recovery. 

    I hope this helps or helps with giving you a different perspective. :)

  3. Kevin Apr 29, 2017 - 01:21 AM
    I 10000000% disagree with the post left above by user named  A... I call your justifcation a total load of bull!!!!!  The PMP database was developed for protecting patients from overuse and abuse that dosent mean doctors accessing the PDMP always act in a patients best interest, these doctors well call the good doctors that are supposed to use the PDMP doesn't mean for one second that they are the only ones using it. Ive been on MAT for over 15 years and rejoined society, gained a college degree and started a family and was just terminated from $120,000 a year job due to a medical review officer that interprets drug testing results for a company illegally accessing the state PDMP to gain access to my substance-abuse records or medication I fill in regards to substance-abuse treatment prior to ever even seeibg me and tbe best part my MAT medication wasnt even on the panel the only way the MRO knew is because he pulls the PDMP for every person who takes a DT. With that said the stigma and discrimination against people in treatment for SUD  has not gotten better it's only gotten worse in my opinion and im sure in many others including my treating doctors and while we're on this topic putting the records of people that are being maintained on methadone or Buprenorphine against our will only puts us at risk for more discrimination when these records can be accessed by any person with the right letters following their name even if they are not your treating physician. You want to talk about how its all safe and confidential well come live in my shoes and while your at it support my child while i try to find a job knowing this discriminating personal protected information of mine is floating out there for anyone who may think we are just trading one addiction for another like the so called doctor who got me fired.
  4. Stephen Apr 14, 2017 - 05:51 PM

    I have a question regarding client disclosure in a NA meeting when I was present. Person admits to multiple relapses. Person is not my client, however is receiving services at my agency. Person is in a therapeutic community, they are court mandated. How do I handle this? I am completely confused as how to proceed. I live in Washington State, I am a CDP, so any state specific information I can find would be very, very helpful to me.

    I thank you very much!

  5. cepheus Apr 03, 2017 - 12:56 AM

    To "A",

    If possible, can you please cite the law on your statement.  My probation officer is taking me to court for not signing a HIPPA release for him to talk to my doctors (although Ive had no probation violation, he is calling the refusal to sign a release a probation violation).

    Thank you

  6. A Mar 26, 2017 - 08:08 PM

    The PMP was created to help detect and prevent fraud, waste, and (most importantly) abuse.  It's not about WHY an individual is taking a certain medication, it is about making sure that any and all controlled medications are being used as directed and to prevent people from jumping from pharmacy to pharmacy with prescriptions from multiple doctors, etc.  This allows everyone involved in a prescription filling process (from the doctor that writes the script to the pharmacist that fills it) that the patient is using the medication as prescribed.  The PMP was put in to place because there were too many "pain management" doctors who handed out scripts for pain meds like candy and had no intentions on actually trying to find alternatives to just masking the patient's pain... More and more people were becoming addicted to prescription drugs and unethical doctors were fueling the habit.  The professionals that have access to the PMP are the only ones who are allowed to view it and discuss it.  If a pharmacist sees a potential issue on the PMP and calls the prescribing doctor to consult, if the doctor's office doesn't have access to the PMP then they are not allowed to show them it (via fax, email, print out, etc).  

    Point is, the PMP is not identifying anyone as a substance abuser by seeing what addiction medications they are on, if anything it is identifying POTENTIAL substance abusers in order to help them seek out the help they need.

  7. NayNay Mar 23, 2017 - 05:25 PM

    It is illegal for the government to even compel a drug & alcohol treatment client to provide information that is prohibited from being revealed, yet it happens all the time. The DMV tells the client he must provide two clean Urine Drug Screens from the treatment program he was just enrolled in in order to get his license back;  cops call and try to play on our emotions to find out if someone is or was here sometimes giving us a sob story that the client is missing (and sometimes it IS true - but we cannot help); a probation officer tells the client he has to reveal his psychiatric diagnosis or a UDS from when he was admitted; drug courts draw up blanket consents to try to make it so programs involved with helping drug court clients have to share the information obtained with lawyers for the prosecution and they believe that they are entitled to receive any information they want from us because they have a signed consent,- - - - this is not the case!!!!!!!!!!!!!!! Government officials are entitled only up to the 5-points - and that's only if the client has signed a consent to release them.....these are (1) whether the client is or is not in treatment (2) the prognosis of the client (3) the nature of the project (4) a brief description of the progress of the client (5) a short statement as to whether the client has relapsed into drug or alcohol abuse and the frequency of such relapse - - - -THAT IS IT!!!

    We have employers threatening to end employment if the client's medications, psychiatric diagnosis, how treatment was completed, medication diagnoses, drug of choice, UDS results, etc are not released. All a drug and alcohol facility is able to release to an employer or Employee Assistance Program is strictly dates of treatment - THAT IS IT!!!It is illegal for them to even compel the client for that information - yet they do, and the client usually ends up providing it in an attempt to keep his job. Individuals apply for housing, a credit check is run - and shabang...the client got in trouble once and the county decided to illegally put the costs & fines on their credit report by sending it off to a collection agency because the client chose to unknowingly set up a payment plan instead of paying it all at once.

    The courts continually re-write rule after rule in an attempt to appease the police, drug task forces and other government officials to the point where the law becomes so ambiguous that even lawyers who specialize in this type of law have to hire someone to help them research specific laws and then research how judges have interpreted the law since it was written. Give me a damn break - let's just take it back to the constitution and start over!

  8. Gina Dec 29, 2016 - 11:38 PM
    Need help with this one! My license is monitored for 4 years by dph in ct. I have a worker who called my nephrologist behind my back asking for medical information about me. The office admitted to speaking with her to. I gave bo oral or written consent in this matter and i do have a diagnosis of substance abuse. Am i covered under cfr42? Did she break law by contacting one of my physicians without my consent? Any info would be appreciated.
  9. Pat Nov 20, 2016 - 12:03 PM

    Hi my name is Pat I'm in a Drug treatest program it's a out patients program because I got in trouble with less then 20 grams of weed , I take Trazodone , and I have Grand Mal serious due to epilepsy I also have been prescribed Keppra 500 mg and Diazexam 10 mg for my seizures and this out patients program are saying I can not take my DiazePam  are they able to do this.     thanks for any information, ,

  10. asam member May 14, 2016 - 11:24 AM
    Webmaster need to be monitoring these posts for inappropriate comments.
  11. CReam Mar 09, 2016 - 06:39 PM
    Question does hipaa include patients talking about other patients in order to attempt to get them evicted. I would think that since we all had to sign that paper she wouldn't be able to tell another person about another patient.
  12. Chief Spencer Jan 28, 2016 - 05:02 AM
    Can information obtained through drug testing be disclosed to treatment providers from methadone MMT even though the patient has not given permission 
  13. gmk Dec 08, 2015 - 04:15 AM
    Scenerio---Under 42 CFR can pts first names, last names initialed and admission dates be used as references in a written statement that could  eventually go into  someone's  personnel file?
  14. Kevin Collins Sep 25, 2015 - 06:00 PM
    I need information on the use of security cameras in D&A  facilities 
  15. Tracy Sep 19, 2015 - 01:04 AM

    I'm getting ready to go to another "sop posed" chronic pain treatment center...I'm SO TIRED AND AT THE END OF MY ROPE!!!! I really am not a drug addict or alcoholic, he'll, I don't even drink, but I do have the need and God given right to be prescribed pain medication,at least that's what I thought!!! I've been totally disabled since I was 32, I am now 51... And I'm NOT GONNA GET ANY BETTER!!!!! Anyway I don't know what I m trying to say, except that living a life of 24/7 chronic pain SUCKS. AND I WOULDNT HAVE EVER TAKEN A PILL FOR PAIN RELIEF UNTIL NOW, but now I'm not allowed to have any and it has nothing to do with my health, life or death, just a bunch of people who abuse the mess that I really need and U have to suffer EVERY DAY FOR THEIR IGNORANCE, SO PLEASE ALLOW ME TO THANK YOU IDIOTS FOR MY DAILY PAIN YMISERY

  16. Brad May 29, 2014 - 01:19 PM

    Rules are different for those involved with criminal justice?  The legal system can talk to treatment provider, and, if contracted by probation or parole, the provider is covered to talk to criminal justice?

  17. 101N Sep 07, 2013 - 05:30 PM

    "exempt medications specifically indicated for the treatment of a substance use disorder"

    A blanket exemption for suboxone & methadone will not work as both are prescribed for pain as well. As a pain subspecialist I want to 'trust' that my PDMP is inclusive of all opioids that my patients are prescribed.

  18. Zac Talbott | NAMA Recovery of TN Aug 22, 2013 - 03:41 AM
    I fully concur with @Sharon in the previous comment. Buprenorphine patients of DATA 2000 practices in states that employ the use of prescription monitoring programs should be exempt from the reporting to those databases in keeping with 42 CFR. I can only assume this has been an oversight within states that employ the use of a PMP because a substance abuse treatment patient's prescription information and history pertaining to medications specifically indicated for the detoxification and/or maintenance treatment of opioid addiction being reported to and accessible through such a state-implemented system is a clear violation of federal law and creates significant legal liability for all involved. It seems the easiest way to bring PMPs in compliance with federal privacy/confidentiality laws and regulations would be to exempt medications specifically indicated for the treatment of a substance use disorder from being reported to these state-created and state-implemented systems and programs.
  19. Sharon Dembinski Aug 20, 2013 - 10:20 AM

    42 CFR should be protecting all Pts. Why are bupe Pts not being protected? Prescription Monitoring Programs are exposing info that is supposed to be protected by 42 CFR. 

    I believe if the inclusion of buprenorphine info in the PMP was challenged it would not be defensible. 

    Leave a comment